View Full Version : WINDOWS UPDATE.EXE Keylogger?
Hi,
Firstly, thanks in advance for your help :)
I'm having a problem with a popup screen displayed by Kaspersky Internet Security. I've attached a snippet of a screen shot so you can see it.
The warning is yellow, and displays: "WINDOWS UPDATE.EXE: Behavior similar to keylogger. Detected."
I have run a kaspersky scan but nothing has changed.
I have run a scan using norman malware cleaner. It picked up a variety of suspected files and deleted them. It also picked up what I suspect to be part of kaspersky but I'm not sure. It's called avp.exe. There are 2 running and one is in SYSTEM, the other is in my own logon name. The one in system is using high system resources. This may be normal but I thought it worth mentioning since it was picked up by norman.
I'm just about to run a scan using spybot, and I've posted my htj log below. (This is before I run spybot).
Oh, I also ran ccleaner too.
**********************
Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 10:56:33 AM, on 29/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\$ISR\0\ISRService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\Micro Niche Finder2\srvany.exe
C:\Program Files\Micro Niche Finder2\bggoogle.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Thinkmo\Tudumo\Tudumo.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\WINDOWS\system32\Windows Update.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\Program Files\Ipswitch\WS_FTP Pro\wsbho2k0.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [SPIRun] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [ISR_MONITOR] C:\$ISR\$APP\ISRMonitor.exe
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DNS7reminder] "C:\Program Files\Nuance\NaturallySpeaking9\Ereg\Ereg.exe" -r "C:\Documents and Settings\All Users\Application Data\Nuance\NaturallySpeaking9\Ereg.ini
O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Tudumo] C:\Program Files\Thinkmo\Tudumo\Tudumo.exe startup
O4 - HKCU\..\Run: [Windows Updater] "C:\WINDOWS\system32\Windows Update.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-583907252-1060284298-839522115-500\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Folder Size (FolderSize) - Brio - C:\Program Files\FolderSize\FolderSizeSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: FirstDefense-ISR Service (ISRService) - Raxco Software, Inc. - C:\$ISR\0\ISRService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: Micro Niche Finder Background Download Service - Unknown owner - C:\Program Files\Micro Niche Finder2\srvany.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP4\RpcAgentSrv.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
--
End of file - 10070 bytes
Hi,
Download DDS and save it to your desktop from here (http://www.techsupportforum.com/sectools/sUBs/dds) or here (http://download.bleepingcomputer.com/sUBs/dds.scr) or here (http://www.forospyware.com/sUBs/dds).
Disable any script blocker, and then double click dds.scr to run the tool.
When done, DDS will open two (2) logs:
DDS.txt
Attach.txt
Save both reports to your desktop. Post them back to your topic.
Thanks, here are the logs you requested.
************
DDS (Ver_09-12-01.01) - NTFSx86
Run by Mr Amazing! at 23:57:44.57 on Sat 06/02/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.1924 [GMT 11:00]
AV: Kaspersky Internet Security *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Thinkmo\Tudumo\Tudumo.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
svchost.exe
svchost.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\$ISR\0\ISRService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Micro Niche Finder2\srvany.exe
C:\Program Files\Micro Niche Finder2\bggoogle.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Micro Niche Finder2\microniche.exe
C:\Program Files\Notepad2\Notepad2.exe
C:\Program Files\Market Samurai\Market Samurai.exe
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Mr Amazing!\My Documents\Downloads\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.com/webhp
BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2009\ievkbd.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: WsftpBrowserHelper Class: {601ed020-fb6c-11d3-87d8-0050da59922b} - c:\program files\ipswitch\ws_ftp pro\wsbho2k0.dll
BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Tudumo] c:\program files\thinkmo\tudumo\Tudumo.exe startup
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe"
mRun: [SPIRun] Rundll32 SPIRun.dll,RunDLLEntry
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [ISR_MONITOR] c:\$isr\$app\ISRMonitor.exe
mRun: [mxomssmenu] "c:\program files\maxtor\onetouch status\maxmenumgr.exe"
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [DNS7reminder] "c:\program files\nuance\naturallyspeaking9\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\nuance\naturallyspeaking9\Ereg.ini
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\mramaz~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: Add to Banner Ad Blocker - c:\program files\kaspersky lab\kaspersky internet security 2009\ie_banner_deny.htm
IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\internet download manager\IEGetVL.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky internet security 2009\SCIEPlgn.dll
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: klogon - c:\windows\system32\klogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Eudora's Shell Extension: {edb0e980-90bd-11d4-8599-0008c7d3b6f8} - c:\program files\qualcomm\eudora2\EuShlExt.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
Hosts: 127.0.0.1 www.spywareinfo.com
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\mramaz~1\applic~1\mozilla\firefox\profiles\h12bidcd.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp
FF - component: c:\documents and settings\mr amazing!\application data\idm\idmmzcc3\components\idmmzcc.dll
FF - component: c:\documents and settings\mr amazing!\application data\mozilla\firefox\profiles\h12bidcd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\program files\siber systems\ai roboform\firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\mr amazing!\application data\facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
============= SERVICES / DRIVERS ===============
R0 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2008-7-21 121872]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 33808]
R0 Rss;Rss;c:\windows\system32\drivers\rss.sys [2005-7-15 15791]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2009-9-7 226832]
R2 AVP;Kaspersky Internet Security;c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe [2008-11-11 208616]
R2 ISRService;FirstDefense-ISR Service;c:\$isr\0\ISRService.exe []
R2 Micro Niche Finder Background Download Service;Micro Niche Finder Background Download Service;c:\program files\micro niche finder2\srvany.exe [2009-10-16 8192]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-8-28 92008]
R3 ITECIR;ITE EC CIR Driver (PMC);c:\windows\system32\drivers\ITECIR.sys [2008-5-9 7808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-3-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-4-30 24592]
R3 t3;SB Xtreme Audio Notebook;c:\windows\system32\drivers\t3.sys [2009-9-8 742936]
R3 t3filt;t3filt;c:\windows\system32\drivers\t3filt.sys [2009-9-8 1803136]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\sisoftware\sisoftware sandra lite 2009.sp4\RpcAgentSrv.exe [2009-11-12 99176]
=============== Created Last 30 ================
2010-01-29 11:40:00 0 d-----w- c:\docume~1\mramaz~1\applic~1\XnView
2010-01-29 11:36:07 0 d-----w- c:\program files\XnView
2010-01-29 00:35:35 0 d-----w- c:\docume~1\mramaz~1\applic~1\Facebook
2010-01-28 23:55:28 0 d-----w- c:\program files\TrendMicro
2010-01-28 22:27:23 0 d-----w- c:\docume~1\mramaz~1\applic~1\AVG8
2010-01-28 06:33:42 0 d-----w- c:\program files\ARPR
2010-01-28 06:33:33 854 ----a-w- c:\windows\ARPR.INI
2010-01-28 06:03:03 54 ----a-w- c:\windows\rar_crck.ini
2010-01-28 05:58:59 0 d-----w- c:\program files\Information Packaging
2010-01-28 05:57:59 0 d-----w- c:\documents and settings\mr amazing!\WINDOWS
2010-01-27 07:56:31 0 ----a-w- c:\windows\system32\ddfger.dll
2010-01-25 09:57:45 540672 ----a-w- c:\windows\system32\Windows Update.exe
2010-01-21 23:12:46 0 d-----w- c:\program files\Thinkmo
2010-01-10 14:08:11 18832 ----a-w- c:\docume~1\mramaz~1\applic~1\GDIPFONTCACHEV1.DAT
2010-01-10 10:09:56 659456 ----a-w- c:\windows\system32\NETw5c32.dll
2010-01-10 10:09:56 3626112 ----a-w- c:\windows\system32\drivers\NETw5x32.sys
2010-01-10 10:09:56 2756608 ----a-w- c:\windows\system32\NETw5r32.dll
2010-01-10 10:09:22 229376 ----a-w- c:\windows\system32\nvmccs.dll
2010-01-10 10:03:24 81408 ----a-w- c:\windows\system32\devcon_x64.exe
2010-01-10 10:03:24 55808 ----a-w- c:\windows\system32\devcon.exe
2010-01-10 09:40:54 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
==================== Find3M ====================
2010-02-04 21:08:35 8564 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-02-04 21:08:35 18819616 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-04 21:08:35 152300 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-04 21:08:35 1269792 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-01-29 11:49:00 1315 ----a-w- c:\docume~1\mramaz~1\applic~1\SAS7_000.DAT
2009-12-21 19:14:05 916480 ----a-w- c:\windows\system32\wininet.dll
2009-11-30 07:02:40 171144 ----a-w- c:\windows\system32\xliveinstall.dll
2009-11-30 07:02:38 72840 ----a-w- c:\windows\system32\xliveinstallhost.exe
2006-05-03 09:06:54 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47:16 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30:52 216064 --sh--r- c:\windows\system32\nbDX.dll
============= FINISH: 23:58:33.40 ===============
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-12-01.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 7/09/2009 3:09:01 PM
System Uptime: 2/05/2010 6:07:45 PM (-2035 hours ago)
Motherboard: Clevo Co. | | SANTA ROSA
Processor: Intel Pentium III Xeon processor | U2E1 | 2793/mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 186 GiB total, 60.603 GiB free.
G: is CDROM ()
==== Disabled Device Manager Items =============
Class GUID: {6BDD1FC6-810F-11D0-BEC7-08002BE2092F}
Description: USB2.0
Device ID: USB\VID_174F&PID_6D51\5&B7C3DAA&0&1
Manufacturer:
Name: USB2.0
PNP Device ID: USB\VID_174F&PID_6D51\5&B7C3DAA&0&1
Service:
Class GUID:
Description: Modem Device on High Definition Audio Bus
Device ID: HDAUDIO\FUNC_02&VEN_1057&DEV_3055&SUBSYS_10573055&REV_1007\4&35D5E23F&0&0101
Manufacturer:
Name: Modem Device on High Definition Audio Bus
PNP Device ID: HDAUDIO\FUNC_02&VEN_1057&DEV_3055&SUBSYS_10573055&REV_1007\4&35D5E23F&0&0101
Service:
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: PCI Memory Controller
Device ID: PCI\VEN_8086&DEV_444E&SUBSYS_444E8086&REV_01\4&23F5EDAD&0&00E0
Manufacturer:
Name: PCI Memory Controller
PNP Device ID: PCI\VEN_8086&DEV_444E&SUBSYS_444E8086&REV_01\4&23F5EDAD&0&00E0
Service:
==== System Restore Points ===================
RP106: 9/11/2009 9:30:59 AM - System Checkpoint
RP107: 11/11/2009 11:14:48 AM - System Checkpoint
RP108: 12/11/2009 9:02:43 AM - Software Distribution Service 3.0
RP109: 12/11/2009 9:57:46 AM - Removed TweetDeck
RP110: 12/11/2009 5:56:40 PM - Software Distribution Service 3.0
RP111: 12/11/2009 6:05:55 PM - Installed BisonCam
RP112: 12/11/2009 6:53:35 PM - Removed BisonCam
RP113: 12/11/2009 7:07:37 PM - SiSoftware Sandra Lite
RP114: 12/11/2009 7:11:57 PM - Installed DirectX
RP115: 13/11/2009 7:27:58 PM - System Checkpoint
RP116: 14/11/2009 8:07:12 PM - System Checkpoint
RP117: 15/11/2009 9:55:46 AM - ShortKeys Lite
RP118: 17/11/2009 8:51:35 PM - System Checkpoint
RP119: 18/11/2009 10:38:12 PM - System Checkpoint
RP120: 19/11/2009 11:16:27 PM - System Checkpoint
RP121: 21/11/2009 12:02:10 AM - System Checkpoint
RP122: 21/11/2009 9:18:13 PM - Installed CommentKahuna
RP123: 22/11/2009 10:12:14 PM - System Checkpoint
RP124: 23/11/2009 11:27:08 PM - System Checkpoint
RP125: 25/11/2009 10:37:11 AM - System Checkpoint
RP126: 25/11/2009 4:34:11 PM - Software Distribution Service 3.0
RP127: 26/11/2009 7:15:44 PM - System Checkpoint
RP128: 30/11/2009 4:28:21 AM - System Checkpoint
RP129: 30/11/2009 6:16:33 PM - Installed DirectX
RP130: 30/11/2009 6:20:11 PM - Installed DirectX
RP131: 30/11/2009 6:21:05 PM - Installed Steam
RP132: 30/11/2009 9:29:27 PM - Installed Microsoft Games for Windows - LIVE Redistributable
RP133: 30/11/2009 9:30:10 PM - Removed Microsoft Games for Windows - LIVE Redistributable
RP134: 1/12/2009 11:33:55 PM - System Checkpoint
RP135: 2/12/2009 11:52:17 PM - System Checkpoint
RP136: 4/12/2009 12:39:38 AM - System Checkpoint
RP137: 4/12/2009 10:22:16 PM - Removed e-tax 2009
RP138: 6/12/2009 2:35:01 PM - System Checkpoint
RP139: 8/12/2009 11:57:28 PM - System Checkpoint
RP140: 10/12/2009 1:15:49 AM - System Checkpoint
RP141: 10/12/2009 5:59:49 PM - Software Distribution Service 3.0
RP142: 12/12/2009 7:25:34 PM - System Checkpoint
RP143: 14/12/2009 9:47:19 AM - System Checkpoint
RP144: 15/12/2009 11:26:51 PM - System Checkpoint
RP145: 18/12/2009 6:24:17 PM - System Checkpoint
RP146: 21/12/2009 12:12:54 PM - System Checkpoint
RP147: 24/12/2009 12:23:40 AM - System Checkpoint
RP148: 25/12/2009 4:51:43 PM - System Checkpoint
RP149: 26/12/2009 5:57:44 PM - System Checkpoint
RP150: 27/12/2009 9:48:14 PM - System Checkpoint
RP151: 30/12/2009 11:51:44 PM - System Checkpoint
RP152: 2/01/2010 8:04:56 PM - System Checkpoint
RP153: 4/01/2010 5:10:29 PM - System Checkpoint
RP154: 6/01/2010 8:51:07 PM - System Checkpoint
RP155: 7/01/2010 9:00:58 PM - System Checkpoint
RP156: 8/01/2010 9:51:10 PM - System Checkpoint
RP157: 10/01/2010 11:19:56 AM - System Checkpoint
RP158: 10/01/2010 8:41:08 PM - Software Distribution Service 3.0
RP159: 11/01/2010 8:51:03 PM - System Checkpoint
RP160: 13/01/2010 2:57:51 PM - System Checkpoint
RP161: 13/01/2010 10:24:54 PM - Software Distribution Service 3.0
RP162: 15/01/2010 6:15:33 PM - System Checkpoint
RP163: 16/01/2010 7:04:29 PM - System Checkpoint
RP164: 17/01/2010 9:13:19 PM - System Checkpoint
RP165: 19/01/2010 9:21:25 AM - System Checkpoint
RP166: 20/01/2010 8:12:55 PM - Software Distribution Service 3.0
RP167: 21/01/2010 11:34:35 PM - System Checkpoint
RP168: 22/01/2010 11:52:41 PM - System Checkpoint
RP169: 23/01/2010 3:00:16 AM - Software Distribution Service 3.0
RP170: 25/01/2010 11:44:23 PM - System Checkpoint
RP171: 28/01/2010 2:16:38 AM - System Checkpoint
RP172: 28/01/2010 4:52:56 PM - Software Distribution Service 3.0
RP173: 29/01/2010 10:55:27 AM - Installed HiJackThis
RP174: 30/01/2010 12:16:14 PM - System Checkpoint
RP175: 1/02/2010 12:07:55 AM - System Checkpoint
RP176: 5/02/2010 2:36:10 AM - System Checkpoint
RP177: 6/02/2010 3:12:29 AM - System Checkpoint
==== Installed Programs ======================
µTorrent
AAC Decoder
Ad Word Analyzer
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Photoshop 7.0
Advanced RAR Password Recovery
Ahead Nero Burning ROM
AI RoboForm (All Users)
Audacity 1.2.6
AutoUpdate
Belarc Advisor 8.1
Camtasia Studio 6
CCleaner
ClipName
ColorPic
CommentKahuna
Creative Audio Console
DirectoryBot
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
Dragon NaturallySpeaking 9
Driver Checker v2.7.3
Driver Magician 3.41
ERUNT 1.1j
Eudora
Facebook Plug-In
FirstDefense-ISR
Flash Movie Player 1.5
FLV Player 2.0 (build 25)
Folder Size for Windows
Foxit PDF Suite
H.264 Decoder
Harvester 1.1
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
IAW20
IBP & ARELIS 9.7.1
Internet Download Manager
Ipswitch WS_FTP Pro
Java(TM) 6 Update 17
K-Lite Codec Pack 5.1.0 (Basic)
Kaspersky Internet Security 2009
Macro Express 3
Macromedia Dreamweaver MX
Macromedia Extension Manager
Macromedia Fireworks MX
Macromedia Flash MX
Magic Article Rewriter
Magic Article Submitter
Magic Tokens Database
Market Samurai
Maxtor Manager
Micro Niche Finder
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Games for Windows - LIVE
Microsoft Games for Windows - LIVE Redistributable
Microsoft Office Live Add-in 1.4
Microsoft Office XP Professional with FrontPage
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
mIRC
MKV Splitter
Mozilla Firefox (3.5.3)
MP4 Player
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Neuro-Programmer Professional 2.4.2
NVIDIA Drivers
NVIDIA PhysX
OGA Notifier 2.0.0048.0
Ogg Codecs 0.81.15562
QuickTime Alternative 2.9.2
RAR Password Finder
Realtek High Definition Audio Driver
RSSBot
Secret Spider Generator
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Segoe UI
SEO Elite 4
ShortKeys 2
ShortKeys Lite
SiSoftware Sandra Lite 2009.SP4
Skype web features
Skype 4.1
SocialBot
Spybot - Search & Destroy
Steam
SUPER © Version 2009.bld.36 (June 10, 2009)
Swiff Player 1.5
Synaptics Pointing Device Driver
The Action Machine
TomTom HOME 2.7.2.1825
TomTom HOME Visual Studio Merge Modules
Traffic Travis 3.1.11
Tudumo 1.1.1.56
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 8 (KB973874)
Update for Windows Internet Explorer 8 (KB975364)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows XP (KB943729)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.762
Warhammer 40,000: Dawn of War II
WebCompAnalyst
WebFldrs XP
WinDirStat 1.1.2
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Messenger
Windows Live Upload Tool
Windows Media Format 11 runtime
Windows Media Player 11
Windows PowerShell(TM) 1.0
Windows PowerShell(TM) 1.0 MUI pack
Windows Search 4.0
Windows XP Service Pack 3
WinRAR archiver
World of Warcraft
XnView 1.97
XSite Pro
==== Event Viewer Messages From Past Week ========
5/02/2010 6:11:07 PM, error: NetBT [4321] - The name "MSHOME :1d" could not be registered on the Interface with IP address 192.168.0.199. The machine with the IP address 192.168.0.197 did not allow the name to be claimed by this machine.
31/01/2010 7:24:09 PM, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
==== End Of File ===========================
Hi,
IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.
µTorrent
I'd like you to read this thread (http://forums.spybot.info/showthread.php?t=282).
Please go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).
Please visit this webpage for download links, and instructions for running ComboFix tool:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Please ensure you read this guide carefully first.
Please continue as follows:
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link (http://www.bleepingcomputer.com/forums/topic114351.html)
Remember to re-enable them afterwards.
Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please include the following reports for further review, and so we may continue cleansing the system:
C:\ComboFix.txt
New dds log.
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
Again, thank you for your assistance.
I uninstalled utorrent (and also some other software I haven't been using)
I noticed the file windows update.exe was deleted by combofix. Yay! :)
Here are the logs you requested:
****************
ComboFix 10-02-06.02 - Mr Amazing! 07/02/2010 19:24:44.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2340 [GMT 11:00]
Running from: c:\documents and settings\Mr Amazing!\My Documents\Downloads\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Mr Amazing!\Application Data\.#
c:\windows\system32\ddfger.dll
c:\windows\system32\tmp1.tmp
c:\windows\system32\windows update.exe
.
((((((((((((((((((((((((( Files Created from 2010-01-07 to 2010-02-07 )))))))))))))))))))))))))))))))
.
2010-02-06 23:46 . 2010-02-06 23:46 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink
2010-02-06 23:46 . 2010-02-06 23:46 -------- d-----w- c:\program files\DVD Shrink
2010-01-29 11:40 . 2010-01-29 11:42 -------- d-----w- c:\documents and settings\Mr Amazing!\Application Data\XnView
2010-01-29 00:35 . 2010-01-29 00:35 50354 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Facebook\uninstall.exe
2010-01-29 00:35 . 2010-01-29 00:35 -------- d-----w- c:\documents and settings\Mr Amazing!\Application Data\Facebook
2010-01-28 23:55 . 2010-01-28 23:55 388096 ----a-r- c:\documents and settings\Mr Amazing!\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-28 23:55 . 2010-01-28 23:55 -------- d-----w- c:\program files\TrendMicro
2010-01-28 23:53 . 2010-01-28 23:53 -------- d-----w- c:\program files\ERUNT
2010-01-28 22:27 . 2010-01-28 22:27 -------- d-----w- c:\documents and settings\Mr Amazing!\Application Data\AVG8
2010-01-28 06:36 . 2010-01-28 06:36 -------- d-----w- c:\documents and settings\Mr Amazing!\Local Settings\Application Data\Help
2010-01-28 06:33 . 2010-02-07 08:17 -------- d-----w- c:\program files\ARPR
2010-01-28 05:58 . 2010-01-28 05:58 -------- d-----w- c:\program files\Information Packaging
2010-01-28 05:57 . 2010-01-28 05:57 -------- d-----w- c:\documents and settings\Mr Amazing!\WINDOWS
2010-01-27 03:21 . 2010-01-27 03:21 847040 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Facebook\axfbootloader.dll
2010-01-27 03:20 . 2010-01-27 03:20 5578752 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Facebook\npfbplugin_1_0_1.dll
2010-01-21 23:12 . 2010-01-21 23:12 -------- d-----w- c:\program files\Thinkmo
2010-01-10 10:09 . 2010-01-10 10:09 659456 ----a-w- c:\windows\system32\NETw5c32.dll
2010-01-10 10:09 . 2010-01-10 10:09 3626112 ----a-w- c:\windows\system32\drivers\NETw5x32.sys
2010-01-10 10:09 . 2010-01-10 10:09 2756608 ----a-w- c:\windows\system32\NETw5r32.dll
2010-01-10 10:09 . 2010-01-10 10:09 229376 ----a-w- c:\windows\system32\nvmccs.dll
2010-01-10 10:03 . 2008-12-03 06:40 81408 ----a-w- c:\windows\system32\devcon_x64.exe
2010-01-10 10:03 . 2002-11-14 11:32 55808 ----a-w- c:\windows\system32\devcon.exe
2010-01-10 09:40 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-07 08:31 . 2009-09-23 12:24 -------- d-----w- c:\documents and settings\Mr Amazing!\Application Data\DMCache
2010-02-07 08:23 . 2009-10-19 06:18 -------- d-----w- c:\program files\XSite Pro
2010-02-07 08:22 . 2009-11-30 07:21 -------- d-----w- c:\program files\Steam
2010-02-07 08:18 . 2009-10-17 10:46 -------- d-----w- c:\program files\Neuro-Programmer 2 Professional
2010-02-07 08:17 . 2009-11-21 10:18 -------- d-----w- c:\program files\CommentKahuna
2010-02-07 08:16 . 2009-09-07 13:35 -------- d-----w- c:\documents and settings\Mr Amazing!\Application Data\uTorrent
2010-02-06 23:22 . 2009-09-07 06:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-02-06 13:28 . 2009-09-07 06:04 8564 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-02-06 13:28 . 2009-09-07 06:04 18819616 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-06 13:28 . 2009-09-07 06:04 152300 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-06 13:28 . 2009-09-07 06:04 1269792 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-01-29 11:49 . 2009-10-15 12:24 1315 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\SAS7_000.DAT
2010-01-28 23:51 . 2009-09-08 01:56 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-28 23:49 . 2009-09-08 01:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-21 10:48 . 2009-11-12 06:58 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-13 03:36 . 2010-01-03 02:59 -------- d-----w- c:\program files\World of Warcraft
2010-01-10 11:44 . 2009-09-19 16:53 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-01-10 11:43 . 2009-09-19 16:53 38784 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-10 11:43 . 2009-09-19 16:53 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-10 10:04 . 2009-09-07 13:52 -------- d-----w- c:\program files\Driver Checker
2010-01-06 11:45 . 2010-01-06 11:45 -------- d-----w- c:\program files\CCleaner
2010-01-05 08:43 . 2010-01-05 08:43 76555 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\IDM\DwnlData\Mr Amazing!\SetupWebCompAnalyst_713\SetupWebCompAnalyst.exe
2010-01-03 05:49 . 2010-01-03 05:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2010-01-03 04:04 . 2010-01-03 02:56 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-01-03 02:54 . 2010-01-03 02:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard
2010-01-02 13:37 . 2009-09-23 12:24 -------- d-----w- c:\documents and settings\Mr Amazing!\Application Data\IDM
2009-12-30 10:33 . 2009-12-30 09:28 -------- d-----w- c:\program files\WebCompAnalyst
2009-12-28 11:32 . 2009-12-28 11:31 -------- d-----w- c:\program files\Instant Article Wizard 2.0
2009-12-21 19:14 . 2006-02-28 12:00 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-20 23:17 . 2009-12-20 23:17 -------- d-----w- c:\program files\Common Files\SWF Studio
2009-12-20 23:17 . 2009-12-20 23:17 -------- d-----w- c:\program files\The Action Machine
2009-12-15 10:39 . 2009-12-15 10:38 -------- d-----w- c:\program files\Clipname
2009-12-14 03:04 . 2009-10-20 12:41 -------- d-----w- c:\documents and settings\Mr Amazing!\Application Data\IBP
2009-12-12 11:20 . 2009-12-12 11:20 -------- d-----w- c:\program files\WinDirStat
2009-11-30 07:02 . 2009-11-30 07:02 171144 ----a-w- c:\windows\system32\xliveinstall.dll
2009-11-30 07:02 . 2009-11-30 07:02 72840 ----a-w- c:\windows\system32\xliveinstallhost.exe
2009-11-21 15:51 . 2006-02-28 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-19 00:48 . 2009-11-28 08:37 872960 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Mozilla\Firefox\Profiles\h12bidcd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2009-11-19 00:48 . 2009-11-28 08:37 43008 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Mozilla\Firefox\Profiles\h12bidcd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-11-19 00:48 . 2009-11-28 08:37 340480 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Mozilla\Firefox\Profiles\h12bidcd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-11-19 00:48 . 2009-11-28 08:37 346624 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Mozilla\Firefox\Profiles\h12bidcd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-11-12 08:17 . 2009-11-12 08:17 2311 ----a-w- c:\documents and settings\All Users\Application Data\xml146.tmp
2009-11-12 08:17 . 2009-11-12 08:17 13382 ----a-w- c:\documents and settings\All Users\Application Data\xml145.tmp
2009-11-12 08:17 . 2009-11-12 08:17 8757 ----a-w- c:\documents and settings\All Users\Application Data\xml144.tmp
2009-11-12 07:11 . 2009-11-12 07:11 76416 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-07-14 00:16 . 2009-07-14 00:16 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-07-14 00:16 . 2009-07-14 00:16 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2006-05-03 09:06 . 2009-09-17 22:33 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2009-09-17 22:33 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2009-09-17 22:33 216064 --sh--r- c:\windows\system32\nbDX.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tudumo"="c:\program files\Thinkmo\Tudumo\Tudumo.exe" [2009-04-15 589824]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-13 815104]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-09-07 208616]
"SPIRun"="SPIRun.dll" [2006-11-29 8704]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-10 13680640]
"nwiz"="nwiz.exe" [2007-11-15 1626112]
"ISR_MONITOR"="c:\$isr\$APP\ISRMonitor.exe" [2005-11-03 65536]
"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 169264]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"DNS7reminder"="c:\program files\Nuance\NaturallySpeaking9\Ereg\Ereg.exe" [2007-03-18 259624]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-16 221184]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-10 86016]
"RTHDCPL"="RTHDCPL.EXE" [2009-09-07 17508864]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Mr Amazing!\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Qualcomm\Eudora2\EuShlExt.dll" [2004-03-22 86016]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ShortKeys Lite.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ShortKeys Lite.lnk
backup=c:\windows\pss\ShortKeys Lite.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2005-02-16 05:15 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MP4 Player]
2007-09-19 13:00 639488 ----a-w- c:\program files\MP4 Player\Mp4Player.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2003-07-12 15:49 155648 ----a-w- c:\windows\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-24 22:03 210472 ----a-w- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2009-12-02 02:37 1217808 ----a-w- c:\program files\Steam\steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-10 17:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-08-27 15:05 247144 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"SerialNumber"="A109A-K13-3ZXD-BAP5-TE"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Foxit Software\\PDF Editor\\PDFEdit.exe"=
"c:\\Program Files\\Macromedia\\Fireworks MX\\Fireworks.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe"=
"c:\\Program Files\\Koe\\Magic Article Submitter\\Magic Article Submitter.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Steam\\steam.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0-enUS-downloader.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 6:29 PM 33808]
R0 Rss;Rss;c:\windows\system32\drivers\rss.sys [15/07/2005 11:55 AM 15791]
R2 ISRService;FirstDefense-ISR Service;c:\$isr\0\ISRService.exe [12/09/2009 2:48 PM 139264]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [28/08/2009 2:05 AM 92008]
R3 ITECIR;ITE EC CIR Driver (PMC);c:\windows\system32\drivers\ITECIR.sys [9/05/2008 12:18 AM 7808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 7:02 PM 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 6:06 PM 24592]
R3 t3;SB Xtreme Audio Notebook;c:\windows\system32\drivers\t3.sys [8/09/2009 9:55 PM 742936]
R3 t3filt;t3filt;c:\windows\system32\drivers\t3filt.sys [8/09/2009 9:55 PM 1803136]
S2 Micro Niche Finder Background Download Service;Micro Niche Finder Background Download Service;c:\program files\Micro Niche Finder2\srvany.exe [16/10/2009 12:32 AM 8192]
.
Contents of the 'Scheduled Tasks' folder
2010-02-06 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 05:07]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/webhp
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
FF - ProfilePath - c:\documents and settings\Mr Amazing!\Application Data\Mozilla\Firefox\Profiles\h12bidcd.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp
FF - component: c:\documents and settings\Mr Amazing!\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\documents and settings\Mr Amazing!\Application Data\Mozilla\Firefox\Profiles\h12bidcd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\program files\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\Mr Amazing!\Application Data\Facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -
MSConfigStartUp-WinsysMon - c:\docume~1\MRAMAZ~1\LOCALS~1\Temp\nsoA7.tmp\googletoolbar.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-07 19:31
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):f4,50,13,eb,c0,26,02,44,ee,cc,56,b9,40,59,f4,05,70,ff,af,a8,65,
ac,30,1d,94,0b,8f,d9,dd,92,ba,de,ec,72,ed,9f,54,09,61,c1,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{9cb42425-33d6-41b9-b4b3-ea4eed928279}]
@Denied: (Full) (Everyone)
"Model"=dword:0000001b
"Therad"=dword:0000000b
"MData"=hex(0):73,d5,cf,b8,a4,07,89,80,31,e4,35,6b,2a,ca,fe,43,b6,1f,81,1f,5a,
1b,4d,36,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,ee,21,46,8f,3c,f2,5c,68,\
.
Completion time: 2010-02-07 19:33:15
ComboFix-quarantined-files.txt 2010-02-07 08:33
Pre-Run: 69,178,265,600 bytes free
Post-Run: 69,282,951,168 bytes free
- - End Of File - - 038C12E818C8C9975DA5B754A5222023
*****************
DDS (Ver_09-12-01.01) - NTFSx86
Run by Mr Amazing! at 19:36:11.20 on Sun 07/02/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2332 [GMT 11:00]
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Thinkmo\Tudumo\Tudumo.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
svchost.exe
svchost.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\$ISR\0\ISRService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Micro Niche Finder2\bggoogle.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Mr Amazing!\My Documents\Downloads\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.com/webhp
BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2009\ievkbd.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: WsftpBrowserHelper Class: {601ed020-fb6c-11d3-87d8-0050da59922b} - c:\program files\ipswitch\ws_ftp pro\wsbho2k0.dll
BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
uRun: [Tudumo] c:\program files\thinkmo\tudumo\Tudumo.exe startup
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe"
mRun: [SPIRun] Rundll32 SPIRun.dll,RunDLLEntry
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [ISR_MONITOR] c:\$isr\$app\ISRMonitor.exe
mRun: [mxomssmenu] "c:\program files\maxtor\onetouch status\maxmenumgr.exe"
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [DNS7reminder] "c:\program files\nuance\naturallyspeaking9\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\nuance\naturallyspeaking9\Ereg.ini
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [RTHDCPL] RTHDCPL.EXE
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\mramaz~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\internet download manager\IEGetVL.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky internet security 2009\SCIEPlgn.dll
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: klogon - c:\windows\system32\klogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Eudora's Shell Extension: {edb0e980-90bd-11d4-8599-0008c7d3b6f8} - c:\program files\qualcomm\eudora2\EuShlExt.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
Hosts: 127.0.0.1 www.spywareinfo.com
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\mramaz~1\applic~1\mozilla\firefox\profiles\h12bidcd.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp
FF - component: c:\documents and settings\mr amazing!\application data\idm\idmmzcc3\components\idmmzcc.dll
FF - component: c:\documents and settings\mr amazing!\application data\mozilla\firefox\profiles\h12bidcd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\program files\siber systems\ai roboform\firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\mr amazing!\application data\facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
============= SERVICES / DRIVERS ===============
R0 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2008-7-21 121872]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 33808]
R0 Rss;Rss;c:\windows\system32\drivers\rss.sys [2005-7-15 15791]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2009-9-7 226832]
R2 ISRService;FirstDefense-ISR Service;c:\$isr\0\ISRService.exe [2009-9-12 139264]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-8-28 92008]
R3 ITECIR;ITE EC CIR Driver (PMC);c:\windows\system32\drivers\ITECIR.sys [2008-5-9 7808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-3-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-4-30 24592]
R3 t3;SB Xtreme Audio Notebook;c:\windows\system32\drivers\t3.sys [2009-9-8 742936]
R3 t3filt;t3filt;c:\windows\system32\drivers\t3filt.sys [2009-9-8 1803136]
S2 AVP;Kaspersky Internet Security;c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe [2008-11-11 208616]
S2 Micro Niche Finder Background Download Service;Micro Niche Finder Background Download Service;c:\program files\micro niche finder2\srvany.exe [2009-10-16 8192]
=============== Created Last 30 ================
2010-02-07 08:11:54 0 d-sha-r- C:\cmdcons
2010-02-07 08:11:04 77312 ----a-w- c:\windows\MBR.exe
2010-02-07 08:11:04 261632 ----a-w- c:\windows\PEV.exe
2010-02-07 08:11:03 98816 ----a-w- c:\windows\sed.exe
2010-02-07 08:11:03 161792 ----a-w- c:\windows\SWREG.exe
2010-02-06 23:46:49 0 d-----w- c:\program files\DVD Shrink
2010-01-29 11:40:00 0 d-----w- c:\docume~1\mramaz~1\applic~1\XnView
2010-01-29 00:35:35 0 d-----w- c:\docume~1\mramaz~1\applic~1\Facebook
2010-01-28 23:55:28 0 d-----w- c:\program files\TrendMicro
2010-01-28 22:27:23 0 d-----w- c:\docume~1\mramaz~1\applic~1\AVG8
2010-01-28 06:33:42 0 d-----w- c:\program files\ARPR
2010-01-28 06:33:33 854 ----a-w- c:\windows\ARPR.INI
2010-01-28 06:03:03 54 ----a-w- c:\windows\rar_crck.ini
2010-01-28 05:58:59 0 d-----w- c:\program files\Information Packaging
2010-01-28 05:57:59 0 d-----w- c:\documents and settings\mr amazing!\WINDOWS
2010-01-21 23:12:46 0 d-----w- c:\program files\Thinkmo
2010-01-10 14:08:11 18832 ----a-w- c:\docume~1\mramaz~1\applic~1\GDIPFONTCACHEV1.DAT
2010-01-10 10:09:56 659456 ----a-w- c:\windows\system32\NETw5c32.dll
2010-01-10 10:09:56 3626112 ----a-w- c:\windows\system32\drivers\NETw5x32.sys
2010-01-10 10:09:56 2756608 ----a-w- c:\windows\system32\NETw5r32.dll
2010-01-10 10:09:22 229376 ----a-w- c:\windows\system32\nvmccs.dll
2010-01-10 10:03:24 81408 ----a-w- c:\windows\system32\devcon_x64.exe
2010-01-10 10:03:24 55808 ----a-w- c:\windows\system32\devcon.exe
2010-01-10 09:40:54 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
==================== Find3M ====================
2010-02-06 13:28:47 8564 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-02-06 13:28:47 18819616 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-06 13:28:47 152300 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-06 13:28:47 1269792 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-01-29 11:49:00 1315 ----a-w- c:\docume~1\mramaz~1\applic~1\SAS7_000.DAT
2009-12-21 19:14:05 916480 ------w- c:\windows\system32\wininet.dll
2009-11-30 07:02:40 171144 ----a-w- c:\windows\system32\xliveinstall.dll
2009-11-30 07:02:38 72840 ----a-w- c:\windows\system32\xliveinstallhost.exe
2006-05-03 09:06:54 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47:16 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30:52 216064 --sh--r- c:\windows\system32\nbDX.dll
============= FINISH: 19:36:25.39 ===============
**********************
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_09-12-01.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 7/09/2009 3:09:01 PM
System Uptime: 2/07/2010 10:20:24 AM (-3471 hours ago)
Motherboard: Clevo Co. | | SANTA ROSA
Processor: Intel Pentium III Xeon processor | U2E1 | 2793/mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 186 GiB total, 64.553 GiB free.
G: is CDROM ()
==== Disabled Device Manager Items =============
Class GUID: {6BDD1FC6-810F-11D0-BEC7-08002BE2092F}
Description: USB2.0
Device ID: USB\VID_174F&PID_6D51\5&B7C3DAA&0&1
Manufacturer:
Name: USB2.0
PNP Device ID: USB\VID_174F&PID_6D51\5&B7C3DAA&0&1
Service:
Class GUID:
Description: Modem Device on High Definition Audio Bus
Device ID: HDAUDIO\FUNC_02&VEN_1057&DEV_3055&SUBSYS_10573055&REV_1007\4&35D5E23F&0&0101
Manufacturer:
Name: Modem Device on High Definition Audio Bus
PNP Device ID: HDAUDIO\FUNC_02&VEN_1057&DEV_3055&SUBSYS_10573055&REV_1007\4&35D5E23F&0&0101
Service:
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: PCI Memory Controller
Device ID: PCI\VEN_8086&DEV_444E&SUBSYS_444E8086&REV_01\4&23F5EDAD&0&00E0
Manufacturer:
Name: PCI Memory Controller
PNP Device ID: PCI\VEN_8086&DEV_444E&SUBSYS_444E8086&REV_01\4&23F5EDAD&0&00E0
Service:
==== System Restore Points ===================
RP107: 11/11/2009 11:14:48 AM - System Checkpoint
RP108: 12/11/2009 9:02:43 AM - Software Distribution Service 3.0
RP109: 12/11/2009 9:57:46 AM - Removed TweetDeck
RP110: 12/11/2009 5:56:40 PM - Software Distribution Service 3.0
RP111: 12/11/2009 6:05:55 PM - Installed BisonCam
RP112: 12/11/2009 6:53:35 PM - Removed BisonCam
RP113: 12/11/2009 7:07:37 PM - SiSoftware Sandra Lite
RP114: 12/11/2009 7:11:57 PM - Installed DirectX
RP115: 13/11/2009 7:27:58 PM - System Checkpoint
RP116: 14/11/2009 8:07:12 PM - System Checkpoint
RP117: 15/11/2009 9:55:46 AM - ShortKeys Lite
RP118: 17/11/2009 8:51:35 PM - System Checkpoint
RP119: 18/11/2009 10:38:12 PM - System Checkpoint
RP120: 19/11/2009 11:16:27 PM - System Checkpoint
RP121: 21/11/2009 12:02:10 AM - System Checkpoint
RP122: 21/11/2009 9:18:13 PM - Installed CommentKahuna
RP123: 22/11/2009 10:12:14 PM - System Checkpoint
RP124: 23/11/2009 11:27:08 PM - System Checkpoint
RP125: 25/11/2009 10:37:11 AM - System Checkpoint
RP126: 25/11/2009 4:34:11 PM - Software Distribution Service 3.0
RP127: 26/11/2009 7:15:44 PM - System Checkpoint
RP128: 30/11/2009 4:28:21 AM - System Checkpoint
RP129: 30/11/2009 6:16:33 PM - Installed DirectX
RP130: 30/11/2009 6:20:11 PM - Installed DirectX
RP131: 30/11/2009 6:21:05 PM - Installed Steam
RP132: 30/11/2009 9:29:27 PM - Installed Microsoft Games for Windows - LIVE Redistributable
RP133: 30/11/2009 9:30:10 PM - Removed Microsoft Games for Windows - LIVE Redistributable
RP134: 1/12/2009 11:33:55 PM - System Checkpoint
RP135: 2/12/2009 11:52:17 PM - System Checkpoint
RP136: 4/12/2009 12:39:38 AM - System Checkpoint
RP137: 4/12/2009 10:22:16 PM - Removed e-tax 2009
RP138: 6/12/2009 2:35:01 PM - System Checkpoint
RP139: 8/12/2009 11:57:28 PM - System Checkpoint
RP140: 10/12/2009 1:15:49 AM - System Checkpoint
RP141: 10/12/2009 5:59:49 PM - Software Distribution Service 3.0
RP142: 12/12/2009 7:25:34 PM - System Checkpoint
RP143: 14/12/2009 9:47:19 AM - System Checkpoint
RP144: 15/12/2009 11:26:51 PM - System Checkpoint
RP145: 18/12/2009 6:24:17 PM - System Checkpoint
RP146: 21/12/2009 12:12:54 PM - System Checkpoint
RP147: 24/12/2009 12:23:40 AM - System Checkpoint
RP148: 25/12/2009 4:51:43 PM - System Checkpoint
RP149: 26/12/2009 5:57:44 PM - System Checkpoint
RP150: 27/12/2009 9:48:14 PM - System Checkpoint
RP151: 30/12/2009 11:51:44 PM - System Checkpoint
RP152: 2/01/2010 8:04:56 PM - System Checkpoint
RP153: 4/01/2010 5:10:29 PM - System Checkpoint
RP154: 6/01/2010 8:51:07 PM - System Checkpoint
RP155: 7/01/2010 9:00:58 PM - System Checkpoint
RP156: 8/01/2010 9:51:10 PM - System Checkpoint
RP157: 10/01/2010 11:19:56 AM - System Checkpoint
RP158: 10/01/2010 8:41:08 PM - Software Distribution Service 3.0
RP159: 11/01/2010 8:51:03 PM - System Checkpoint
RP160: 13/01/2010 2:57:51 PM - System Checkpoint
RP161: 13/01/2010 10:24:54 PM - Software Distribution Service 3.0
RP162: 15/01/2010 6:15:33 PM - System Checkpoint
RP163: 16/01/2010 7:04:29 PM - System Checkpoint
RP164: 17/01/2010 9:13:19 PM - System Checkpoint
RP165: 19/01/2010 9:21:25 AM - System Checkpoint
RP166: 20/01/2010 8:12:55 PM - Software Distribution Service 3.0
RP167: 21/01/2010 11:34:35 PM - System Checkpoint
RP168: 22/01/2010 11:52:41 PM - System Checkpoint
RP169: 23/01/2010 3:00:16 AM - Software Distribution Service 3.0
RP170: 25/01/2010 11:44:23 PM - System Checkpoint
RP171: 28/01/2010 2:16:38 AM - System Checkpoint
RP172: 28/01/2010 4:52:56 PM - Software Distribution Service 3.0
RP173: 29/01/2010 10:55:27 AM - Installed HiJackThis
RP174: 30/01/2010 12:16:14 PM - System Checkpoint
RP175: 1/02/2010 12:07:55 AM - System Checkpoint
RP176: 5/02/2010 2:36:10 AM - System Checkpoint
RP177: 6/02/2010 3:12:29 AM - System Checkpoint
RP178: 7/02/2010 4:34:33 PM - System Checkpoint
RP179: 7/02/2010 7:17:20 PM - Removed CommentKahuna
RP180: 7/02/2010 7:18:30 PM - Removed Secret Spider Generator
RP181: 7/02/2010 7:18:54 PM - Removed SEO Elite 4.
RP182: 7/02/2010 7:19:06 PM - Uninstall ShortKeys Lite
RP183: 7/02/2010 7:20:04 PM - SiSoftware Sandra Lite
==== Installed Programs ======================
AAC Decoder
Ad Word Analyzer
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Photoshop 7.0
Ahead Nero Burning ROM
AI RoboForm (All Users)
Audacity 1.2.6
AutoUpdate
Belarc Advisor 8.1
Camtasia Studio 6
CCleaner
ClipName
ColorPic
Creative Audio Console
DirectoryBot
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
Dragon NaturallySpeaking 9
Driver Checker v2.7.3
Driver Magician 3.41
DVD Shrink 3.2
ERUNT 1.1j
Eudora
Facebook Plug-In
FirstDefense-ISR
Flash Movie Player 1.5
FLV Player 2.0 (build 25)
Folder Size for Windows
Foxit PDF Suite
H.264 Decoder
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
IAW20
Internet Download Manager
Ipswitch WS_FTP Pro
Java(TM) 6 Update 17
K-Lite Codec Pack 5.1.0 (Basic)
Kaspersky Internet Security 2009
Macro Express 3
Macromedia Dreamweaver MX
Macromedia Extension Manager
Macromedia Fireworks MX
Macromedia Flash MX
Magic Article Rewriter
Magic Article Submitter
Magic Tokens Database
Market Samurai
Maxtor Manager
Micro Niche Finder
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Games for Windows - LIVE
Microsoft Games for Windows - LIVE Redistributable
Microsoft Office Live Add-in 1.4
Microsoft Office XP Professional with FrontPage
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
mIRC
MKV Splitter
Mozilla Firefox (3.5.3)
MP4 Player
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NVIDIA Drivers
NVIDIA PhysX
OGA Notifier 2.0.0048.0
Ogg Codecs 0.81.15562
QuickTime Alternative 2.9.2
RAR Password Finder
Realtek High Definition Audio Driver
RSSBot
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Segoe UI
Skype web features
Skype 4.1
SocialBot
Spybot - Search & Destroy
Steam
SUPER © Version 2009.bld.36 (June 10, 2009)
Swiff Player 1.5
Synaptics Pointing Device Driver
The Action Machine
TomTom HOME 2.7.2.1825
TomTom HOME Visual Studio Merge Modules
Traffic Travis 3.1.11
Tudumo 1.1.1.56
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 8 (KB973874)
Update for Windows Internet Explorer 8 (KB975364)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows XP (KB943729)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.762
WebCompAnalyst
WebFldrs XP
WinDirStat 1.1.2
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Messenger
Windows Live Upload Tool
Windows Media Format 11 runtime
Windows Media Player 11
Windows PowerShell(TM) 1.0
Windows PowerShell(TM) 1.0 MUI pack
Windows Search 4.0
Windows XP Service Pack 3
WinRAR archiver
World of Warcraft
==== Event Viewer Messages From Past Week ========
7/02/2010 7:24:24 PM, error: Service Control Manager [7034] - The Micro Niche Finder Background Download Service service terminated unexpectedly. It has done this 1 time(s).
7/02/2010 10:47:18 AM, error: Cdrom [11] - The driver detected a controller error on \Device\CdRom0.
5/02/2010 6:11:07 PM, error: NetBT [4321] - The name "MSHOME :1d" could not be registered on the Interface with IP address 192.168.0.199. The machine with the IP address 192.168.0.197 did not allow the name to be claimed by this machine.
31/01/2010 7:24:09 PM, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
==== End Of File ===========================
Thanks for the logs :)
Open notepad and copy/paste the text in the quotebox below into it:
Folder::
c:\documents and settings\Mr Amazing!\Application Data\uTorrent
DDS::
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
RegLockDel::
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}]
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{9cb42425-33d6-41b9-b4b3-ea4eed928279}]
Save this as
CFScript
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.
Uninstall vulnerable Flash versions by following instructions here (http://kb2.adobe.com/cps/141/tn_14157.html). Fresh version can be obtained here (http://get.adobe.com/flashplayer/).
Download ATF (Atribune Temp File) Cleaner© by Atribune (http://www.atribune.org/ccount/click.php?id=1) to your desktop.
Double-click ATF Cleaner.exe to open it
Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Click Exit on the Main menu to close the program.
Please run an online scan with Kaspersky Online Scanner (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) as instructed in the screenshot here (http://i275.photobucket.com/albums/jj285/Bleeping/KAS/KAS9.gif).
Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.
Thanks again,
I have followed your instructions however I could not run Kaspersky 7 online because I already have kaspersky 8 on my pc. Would you like me to update and run the pc version and provide a log?
I have completed the following:
1. copy code and run script on combofix. (log file below)
2. Uninstall flash
3. Reinstall latest flash
4. run ATF cleaner
5. Kaspersky online would not run because I already have kaspersky 8 on my system.
Please find below combofix log, fresh dds.txt log (I have assumed you do not need attach.txt this time?)
Logs:
ComboFix 10-02-06.02 - Mr Amazing! 08/02/2010 13:20:25.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2376 [GMT 11:00]
Running from: c:\documents and settings\Mr Amazing!\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Mr Amazing!\Desktop\CFScript.txt
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Mr Amazing!\Application Data\uTorrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\[NDS-ROMS]Collection of 569 English Games[Cole0561020].torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\05-Tamara Andreas - ALP.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\07-Steve Andreas - Self-Concept.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\7figurecode.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Affiliate Extreme.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Cashflow.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\ClickbankCode.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Commission Blueprint 2.0.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\CubeCart.v4.2.2._iAG_.Nulled.rar.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Derren Brown Ultimate Collection.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\desouza.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\dht.dat
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\dht.dat.old
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\FlashForward.S01E03.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\FlashForward.S01E04.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\FlashForward.S01E05.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\FlashForward.S01E06.HDTV.XviD-FEVER.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\FlashForward.S01E07.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\FlashForward.S01E08.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\FlashForward.S01E09.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\FlashForward.S01E10.PROPER.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Gilligan Stephen - Trance Camp 2005 engl.rar.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Insider Secrets.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Kevin Hogan - The Science of Influence.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Legend.of.the.Seeker.S02E01.PROPER.720p.HDTV.x264-ORENJi.mkv.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Legend.of.the.Seeker.S02E03.720p.HDTV.x264-2HD.mkv.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Live In North Carolina.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\My Coach.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\NLP practitioner set.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Outsource Method.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\PDFDomination.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\People Are Idiot - and I Can Prove It.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Project Minisite.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Prospect & Close to Millions.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\pua.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\resume.dat
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\resume.dat.old
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Robot.Chicken.S04E01.READNFO.PDTV.XviD-aAF.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Robot.Chicken.S04E02.PDTV.XviD-aAF.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Robot.Chicken.S04E03.REPACK.PDTV.XviD-aAF.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Robot.Chicken.S04E19.DSR.XviD-SYS.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\rss.dat
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\rss.dat.old
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Sanctuary.US.S01E09.HDTV.XviD-aAF.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Sanctuary.US.S01E10.HDTV.XviD-LOL.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Sanctuary.US.S01E11.Instinct.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Sanctuary.US.S01E12.HDTV.XVID-aAF.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Sanctuary.US.S01E13.HDTV.XVID-aAF.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Sanctuary.US.S01E13.WS.DSR.XviD-BiA.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Sanctuary.US.S02E01.End.of.Nights.Part.1.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Sanctuary.US.S02E02.720p.HDTV.x264-SiTV.mkv.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Sanctuary.US.S02E02.End.of.Nights.Part.2.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Sanctuary.US.S02E03.Eulogy.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Sanctuary.US.S02E04.HDTV.XviD-XII.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Sanctuary.US.S02E05.Pavor.Nocturnus.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Sanctuary.US.S02E06.Fragments.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Sanctuary.US.S02E07.Veritas.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\SearchMarketingElite.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\SEO Elite 4.0.20.0 Complete.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\settings.dat
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\settings.dat.old
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\SG2TheMovie.wmv.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\socialmediamoney.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Sony Sound Forge PRO 10.0 + KEYGEN [ h33t -- uglyduck ].torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Stargate.Universe.S01E03.Air.Part.3.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Stargate.Universe.S01E04.Darkness.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Stargate.Universe.S01E05.Light.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Stargate.Universe.S01E06.HDTV.XviD-XII.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Stargate.Universe.S01E07.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Stargate.Universe.S01E08.Time.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Stargate.Universe.S01E09.Life.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\stompervision.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Tellman Knudson - My First Emails.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E01.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E02.REPACK.720p.HDTV.x264-SYS.mkv.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E03.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E04.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E05.XviD-NoTV.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E06.HDTV.XviD-0TV.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E06.HDTV.XViD-DOT.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E08.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E09.HDTV.XViD-DOT.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E10.HDTV.XviD-XOR.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E11.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E12.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E13.HDTV.XviD-XOR.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E14.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E16.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E17.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E18.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E19.Last.Voyage.of.the.Jimmy.Carter.HDTV.XviD-FQM.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E20.HDTV.XviD-0TV.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E21.HDTV.XviD-NoTV.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Terminator.The.Sarah.Connor.Chronicles.S02E22.HDTV.XviD-2HD.avi.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\The Great Depression Ahead.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\The Internet Marketing Dream Coaching Program.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\utorrent.lng
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Wholesale Traffic System - Ryan Deiss - 12 CDs.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\YourFirst1000.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Zeitgeist.Addendum.DVDRip.XviD.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Zeitgeist.Final.Edition.DVDRip.XviD.torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Zumba - Sculpt & Tone [DVD].torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Zumba - Zumba Live! & Flat Abs [DVD].torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Zumba Fitness - Basics & 20-Minutes Express [DVDRIP-XVID].torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\Zumba Fitness - Cardio Party [DVDRIP XVID].torrent
c:\documents and settings\Mr Amazing!\Application Data\uTorrent\zumba.torrent
.
((((((((((((((((((((((((( Files Created from 2010-01-08 to 2010-02-08 )))))))))))))))))))))))))))))))
.
2010-02-06 23:46 . 2010-02-06 23:46 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink
2010-02-06 23:46 . 2010-02-06 23:46 -------- d-----w- c:\program files\DVD Shrink
2010-01-29 11:40 . 2010-01-29 11:42 -------- d-----w- c:\documents and settings\Mr Amazing!\Application Data\XnView
2010-01-29 00:35 . 2010-01-29 00:35 50354 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Facebook\uninstall.exe
2010-01-29 00:35 . 2010-01-29 00:35 -------- d-----w- c:\documents and settings\Mr Amazing!\Application Data\Facebook
2010-01-28 23:55 . 2010-01-28 23:55 388096 ----a-r- c:\documents and settings\Mr Amazing!\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-28 23:55 . 2010-01-28 23:55 -------- d-----w- c:\program files\TrendMicro
2010-01-28 23:53 . 2010-01-28 23:53 -------- d-----w- c:\program files\ERUNT
2010-01-28 22:27 . 2010-01-28 22:27 -------- d-----w- c:\documents and settings\Mr Amazing!\Application Data\AVG8
2010-01-28 06:36 . 2010-01-28 06:36 -------- d-----w- c:\documents and settings\Mr Amazing!\Local Settings\Application Data\Help
2010-01-28 06:33 . 2010-02-07 08:17 -------- d-----w- c:\program files\ARPR
2010-01-28 05:58 . 2010-01-28 05:58 -------- d-----w- c:\program files\Information Packaging
2010-01-28 05:57 . 2010-01-28 05:57 -------- d-----w- c:\documents and settings\Mr Amazing!\WINDOWS
2010-01-27 03:21 . 2010-01-27 03:21 847040 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Facebook\axfbootloader.dll
2010-01-27 03:20 . 2010-01-27 03:20 5578752 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Facebook\npfbplugin_1_0_1.dll
2010-01-21 23:12 . 2010-01-21 23:12 -------- d-----w- c:\program files\Thinkmo
2010-01-10 10:09 . 2010-01-10 10:09 659456 ----a-w- c:\windows\system32\NETw5c32.dll
2010-01-10 10:09 . 2010-01-10 10:09 3626112 ----a-w- c:\windows\system32\drivers\NETw5x32.sys
2010-01-10 10:09 . 2010-01-10 10:09 2756608 ----a-w- c:\windows\system32\NETw5r32.dll
2010-01-10 10:09 . 2010-01-10 10:09 229376 ----a-w- c:\windows\system32\nvmccs.dll
2010-01-10 10:03 . 2008-12-03 06:40 81408 ----a-w- c:\windows\system32\devcon_x64.exe
2010-01-10 10:03 . 2002-11-14 11:32 55808 ----a-w- c:\windows\system32\devcon.exe
2010-01-10 09:40 . 2009-11-21 15:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-08 02:23 . 2009-09-23 12:24 -------- d-----w- c:\documents and settings\Mr Amazing!\Application Data\DMCache
2010-02-07 08:23 . 2009-10-19 06:18 -------- d-----w- c:\program files\XSite Pro
2010-02-07 08:22 . 2009-11-30 07:21 -------- d-----w- c:\program files\Steam
2010-02-07 08:18 . 2009-10-17 10:46 -------- d-----w- c:\program files\Neuro-Programmer 2 Professional
2010-02-07 08:17 . 2009-11-21 10:18 -------- d-----w- c:\program files\CommentKahuna
2010-02-06 23:22 . 2009-09-07 06:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Kaspersky Lab
2010-02-06 13:28 . 2009-09-07 06:04 8564 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-02-06 13:28 . 2009-09-07 06:04 18819616 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-06 13:28 . 2009-09-07 06:04 152300 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-06 13:28 . 2009-09-07 06:04 1269792 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-01-29 11:49 . 2009-10-15 12:24 1315 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\SAS7_000.DAT
2010-01-28 23:51 . 2009-09-08 01:56 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-28 23:49 . 2009-09-08 01:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-01-21 10:48 . 2009-11-12 06:58 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-13 03:36 . 2010-01-03 02:59 -------- d-----w- c:\program files\World of Warcraft
2010-01-10 11:44 . 2009-09-19 16:53 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-01-10 11:43 . 2009-09-19 16:53 38784 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-10 11:43 . 2009-09-19 16:53 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-10 10:04 . 2009-09-07 13:52 -------- d-----w- c:\program files\Driver Checker
2010-01-06 11:45 . 2010-01-06 11:45 -------- d-----w- c:\program files\CCleaner
2010-01-05 08:43 . 2010-01-05 08:43 76555 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\IDM\DwnlData\Mr Amazing!\SetupWebCompAnalyst_713\SetupWebCompAnalyst.exe
2010-01-03 05:49 . 2010-01-03 05:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2010-01-03 04:04 . 2010-01-03 02:56 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-01-03 02:54 . 2010-01-03 02:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard
2010-01-02 13:37 . 2009-09-23 12:24 -------- d-----w- c:\documents and settings\Mr Amazing!\Application Data\IDM
2009-12-30 10:33 . 2009-12-30 09:28 -------- d-----w- c:\program files\WebCompAnalyst
2009-12-28 11:32 . 2009-12-28 11:31 -------- d-----w- c:\program files\Instant Article Wizard 2.0
2009-12-21 19:14 . 2006-02-28 12:00 916480 ------w- c:\windows\system32\wininet.dll
2009-12-20 23:17 . 2009-12-20 23:17 -------- d-----w- c:\program files\Common Files\SWF Studio
2009-12-20 23:17 . 2009-12-20 23:17 -------- d-----w- c:\program files\The Action Machine
2009-12-15 10:39 . 2009-12-15 10:38 -------- d-----w- c:\program files\Clipname
2009-12-14 03:04 . 2009-10-20 12:41 -------- d-----w- c:\documents and settings\Mr Amazing!\Application Data\IBP
2009-12-12 11:20 . 2009-12-12 11:20 -------- d-----w- c:\program files\WinDirStat
2009-11-30 07:02 . 2009-11-30 07:02 171144 ----a-w- c:\windows\system32\xliveinstall.dll
2009-11-30 07:02 . 2009-11-30 07:02 72840 ----a-w- c:\windows\system32\xliveinstallhost.exe
2009-11-21 15:51 . 2006-02-28 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-19 00:48 . 2009-11-28 08:37 872960 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Mozilla\Firefox\Profiles\h12bidcd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2009-11-19 00:48 . 2009-11-28 08:37 43008 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Mozilla\Firefox\Profiles\h12bidcd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-11-19 00:48 . 2009-11-28 08:37 340480 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Mozilla\Firefox\Profiles\h12bidcd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-11-19 00:48 . 2009-11-28 08:37 346624 ----a-w- c:\documents and settings\Mr Amazing!\Application Data\Mozilla\Firefox\Profiles\h12bidcd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2009-11-12 08:17 . 2009-11-12 08:17 2311 ----a-w- c:\documents and settings\All Users\Application Data\xml146.tmp
2009-11-12 08:17 . 2009-11-12 08:17 13382 ----a-w- c:\documents and settings\All Users\Application Data\xml145.tmp
2009-11-12 08:17 . 2009-11-12 08:17 8757 ----a-w- c:\documents and settings\All Users\Application Data\xml144.tmp
2009-11-12 07:11 . 2009-11-12 07:11 76416 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-07-14 00:16 . 2009-07-14 00:16 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-07-14 00:16 . 2009-07-14 00:16 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2006-05-03 09:06 . 2009-09-17 22:33 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47 . 2009-09-17 22:33 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30 . 2009-09-17 22:33 216064 --sh--r- c:\windows\system32\nbDX.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tudumo"="c:\program files\Thinkmo\Tudumo\Tudumo.exe" [2009-04-15 589824]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-13 815104]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-09-07 208616]
"SPIRun"="SPIRun.dll" [2006-11-29 8704]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-10 13680640]
"nwiz"="nwiz.exe" [2007-11-15 1626112]
"ISR_MONITOR"="c:\$isr\$APP\ISRMonitor.exe" [2005-11-03 65536]
"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 169264]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"DNS7reminder"="c:\program files\Nuance\NaturallySpeaking9\Ereg\Ereg.exe" [2007-03-18 259624]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2005-02-16 221184]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-10 86016]
"RTHDCPL"="RTHDCPL.EXE" [2009-09-07 17508864]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Mr Amazing!\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Qualcomm\Eudora2\EuShlExt.dll" [2004-03-22 86016]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ShortKeys Lite.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\ShortKeys Lite.lnk
backup=c:\windows\pss\ShortKeys Lite.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
2005-02-16 05:15 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MP4 Player]
2007-09-19 13:00 639488 ----a-w- c:\program files\MP4 Player\Mp4Player.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
2003-07-12 15:49 155648 ----a-w- c:\windows\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-24 22:03 210472 ----a-w- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2009-12-02 02:37 1217808 ----a-w- c:\program files\Steam\steam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-10 17:17 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2009-08-27 15:05 247144 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"SerialNumber"="A109A-K13-3ZXD-BAP5-TE"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Foxit Software\\PDF Editor\\PDFEdit.exe"=
"c:\\Program Files\\Macromedia\\Fireworks MX\\Fireworks.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe"=
"c:\\Program Files\\Koe\\Magic Article Submitter\\Magic Article Submitter.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Steam\\steam.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0-enUS-downloader.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [29/01/2008 6:29 PM 33808]
R0 Rss;Rss;c:\windows\system32\drivers\rss.sys [15/07/2005 11:55 AM 15791]
R2 ISRService;FirstDefense-ISR Service;c:\$isr\0\ISRService.exe [12/09/2009 2:48 PM 139264]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [28/08/2009 2:05 AM 92008]
R3 ITECIR;ITE EC CIR Driver (PMC);c:\windows\system32\drivers\ITECIR.sys [9/05/2008 12:18 AM 7808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [13/03/2008 7:02 PM 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [30/04/2008 6:06 PM 24592]
R3 t3;SB Xtreme Audio Notebook;c:\windows\system32\drivers\t3.sys [8/09/2009 9:55 PM 742936]
R3 t3filt;t3filt;c:\windows\system32\drivers\t3filt.sys [8/09/2009 9:55 PM 1803136]
S2 Micro Niche Finder Background Download Service;Micro Niche Finder Background Download Service;c:\program files\Micro Niche Finder2\srvany.exe [16/10/2009 12:32 AM 8192]
.
Contents of the 'Scheduled Tasks' folder
2010-02-06 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 05:07]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/webhp
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: Download all links with IDM - c:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - c:\program files\Internet Download Manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
FF - ProfilePath - c:\documents and settings\Mr Amazing!\Application Data\Mozilla\Firefox\Profiles\h12bidcd.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp
FF - component: c:\documents and settings\Mr Amazing!\Application Data\IDM\idmmzcc3\components\idmmzcc.dll
FF - component: c:\documents and settings\Mr Amazing!\Application Data\Mozilla\Firefox\Profiles\h12bidcd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\program files\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\Mr Amazing!\Application Data\Facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-08 13:23
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2010-02-08 13:24:39
ComboFix-quarantined-files.txt 2010-02-08 02:24
ComboFix2.txt 2010-02-07 08:33
Pre-Run: 69,125,906,432 bytes free
Post-Run: 69,101,449,216 bytes free
- - End Of File - - E7EB4B147722FE96D8DDA594A29EF9FA
************************
DDS (Ver_09-12-01.01) - NTFSx86
Run by Mr Amazing! at 13:42:37.26 on Mon 08/02/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2137 [GMT 11:00]
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Internet Security *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Thinkmo\Tudumo\Tudumo.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
svchost.exe
svchost.exe
C:\Program Files\FolderSize\FolderSizeSvc.exe
C:\$ISR\0\ISRService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Micro Niche Finder2\bggoogle.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Notepad2\Notepad2.exe
C:\Program Files\Notepad2\Notepad2.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Mr Amazing!\Desktop\dds.scr
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.google.com/webhp
BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - c:\program files\kaspersky lab\kaspersky internet security 2009\ievkbd.dll
BHO: WsftpBrowserHelper Class: {601ed020-fb6c-11d3-87d8-0050da59922b} - c:\program files\ipswitch\ws_ftp pro\wsbho2k0.dll
BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
uRun: [Tudumo] c:\program files\thinkmo\tudumo\Tudumo.exe startup
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [AVP] "c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe"
mRun: [SPIRun] Rundll32 SPIRun.dll,RunDLLEntry
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [ISR_MONITOR] c:\$isr\$app\ISRMonitor.exe
mRun: [mxomssmenu] "c:\program files\maxtor\onetouch status\maxmenumgr.exe"
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [DNS7reminder] "c:\program files\nuance\naturallyspeaking9\ereg\ereg.exe" -r "c:\documents and settings\all users\application data\nuance\naturallyspeaking9\Ereg.ini
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\isuspm.exe -startup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [RTHDCPL] RTHDCPL.EXE
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\mramaz~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\internet download manager\IEGetVL.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - {85E0B171-04FA-11D1-B7DA-00A0C90348D6} - c:\program files\kaspersky lab\kaspersky internet security 2009\SCIEPlgn.dll
Trusted Zone: com.tw\asia.msi
Trusted Zone: com.tw\global.msi
Trusted Zone: com.tw\www.msi
DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} - hxxp://liveupdate.msi.com.tw/autobios/LOnline/install.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: klogon - c:\windows\system32\klogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Eudora's Shell Extension: {edb0e980-90bd-11d4-8599-0008c7d3b6f8} - c:\program files\qualcomm\eudora2\EuShlExt.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
Hosts: 127.0.0.1 www.spywareinfo.com
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\mramaz~1\applic~1\mozilla\firefox\profiles\h12bidcd.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp
FF - component: c:\documents and settings\mr amazing!\application data\idm\idmmzcc3\components\idmmzcc.dll
FF - component: c:\documents and settings\mr amazing!\application data\mozilla\firefox\profiles\h12bidcd.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\program files\siber systems\ai roboform\firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\mr amazing!\application data\facebook\npfbplugin_1_0_1.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
============= SERVICES / DRIVERS ===============
R0 kl1;Kl1;c:\windows\system32\drivers\kl1.sys [2008-7-21 121872]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-1-29 33808]
R0 Rss;Rss;c:\windows\system32\drivers\rss.sys [2005-7-15 15791]
R1 KLIF;Kaspersky Lab Driver;c:\windows\system32\drivers\klif.sys [2009-9-7 226832]
R2 ISRService;FirstDefense-ISR Service;c:\$isr\0\ISRService.exe [2009-9-12 139264]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-8-28 92008]
R3 ITECIR;ITE EC CIR Driver (PMC);c:\windows\system32\drivers\ITECIR.sys [2008-5-9 7808]
R3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\drivers\klfltdev.sys [2008-3-13 26640]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-4-30 24592]
R3 t3;SB Xtreme Audio Notebook;c:\windows\system32\drivers\t3.sys [2009-9-8 742936]
R3 t3filt;t3filt;c:\windows\system32\drivers\t3filt.sys [2009-9-8 1803136]
S2 AVP;Kaspersky Internet Security;c:\program files\kaspersky lab\kaspersky internet security 2009\avp.exe [2008-11-11 208616]
S2 Micro Niche Finder Background Download Service;Micro Niche Finder Background Download Service;c:\program files\micro niche finder2\srvany.exe [2009-10-16 8192]
=============== Created Last 30 ================
2010-02-07 08:11:54 0 d-sha-r- C:\cmdcons
2010-02-07 08:11:04 77312 ----a-w- c:\windows\MBR.exe
2010-02-07 08:11:04 261632 ----a-w- c:\windows\PEV.exe
2010-02-07 08:11:03 98816 ----a-w- c:\windows\sed.exe
2010-02-07 08:11:03 161792 ----a-w- c:\windows\SWREG.exe
2010-02-06 23:46:49 0 d-----w- c:\program files\DVD Shrink
2010-01-29 11:40:00 0 d-----w- c:\docume~1\mramaz~1\applic~1\XnView
2010-01-29 00:35:35 0 d-----w- c:\docume~1\mramaz~1\applic~1\Facebook
2010-01-28 23:55:28 0 d-----w- c:\program files\TrendMicro
2010-01-28 22:27:23 0 d-----w- c:\docume~1\mramaz~1\applic~1\AVG8
2010-01-28 06:33:42 0 d-----w- c:\program files\ARPR
2010-01-28 06:33:33 854 ----a-w- c:\windows\ARPR.INI
2010-01-28 06:03:03 54 ----a-w- c:\windows\rar_crck.ini
2010-01-28 05:58:59 0 d-----w- c:\program files\Information Packaging
2010-01-28 05:57:59 0 d-----w- c:\documents and settings\mr amazing!\WINDOWS
2010-01-21 23:12:46 0 d-----w- c:\program files\Thinkmo
2010-01-10 14:08:11 18832 ----a-w- c:\docume~1\mramaz~1\applic~1\GDIPFONTCACHEV1.DAT
2010-01-10 10:09:56 659456 ----a-w- c:\windows\system32\NETw5c32.dll
2010-01-10 10:09:56 3626112 ----a-w- c:\windows\system32\drivers\NETw5x32.sys
2010-01-10 10:09:56 2756608 ----a-w- c:\windows\system32\NETw5r32.dll
2010-01-10 10:09:22 229376 ----a-w- c:\windows\system32\nvmccs.dll
2010-01-10 10:03:24 81408 ----a-w- c:\windows\system32\devcon_x64.exe
2010-01-10 10:03:24 55808 ----a-w- c:\windows\system32\devcon.exe
2010-01-10 09:40:54 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
==================== Find3M ====================
2010-02-06 13:28:47 8564 --sha-w- c:\windows\system32\drivers\fidbox2.idx
2010-02-06 13:28:47 18819616 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-06 13:28:47 152300 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-06 13:28:47 1269792 --sha-w- c:\windows\system32\drivers\fidbox2.dat
2010-01-29 11:49:00 1315 ----a-w- c:\docume~1\mramaz~1\applic~1\SAS7_000.DAT
2009-12-21 19:14:05 916480 ------w- c:\windows\system32\wininet.dll
2009-11-30 07:02:40 171144 ----a-w- c:\windows\system32\xliveinstall.dll
2009-11-30 07:02:38 72840 ----a-w- c:\windows\system32\xliveinstallhost.exe
2006-05-03 09:06:54 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 10:47:16 31232 --sh--r- c:\windows\system32\msfDX.dll
2008-03-16 12:30:52 216064 --sh--r- c:\windows\system32\nbDX.dll
============= FINISH: 13:42:51.78 ===============
I have followed your instructions however I could not run Kaspersky 7 online because I already have kaspersky 8 on my pc. Would you like me to update and run the pc version and provide a log?
Hi,
Yes, please update and run your Kaspersky workstation version :)
Thanks, I am running the scan now, and will post the log when I get up in the morning (it usually takes a while).
Here's the log:
Full Scan: completed 10/02/2010 2:53:12 AM (events: 9, objects: 958612, time: 03:30:25)
25/01/2010 8:51:49 PM Task completed
25/01/2010 8:51:49 PM Deleted: Backdoor.MSIL.IrcBot.aj C:\Documents and Settings\Mr Amazing!\Desktop\AutoPligg 3.1 Final\Application\Meebey.SmartIrc4net.dll
25/01/2010 8:51:45 PM Detected: Backdoor.MSIL.IrcBot.aj C:\Documents and Settings\Mr Amazing!\Desktop\AutoPligg 3.1 Final\Application\Meebey.SmartIrc4net.dll
25/01/2010 8:51:45 PM Untreated: Backdoor.MSIL.IrcBot.aj C:\Documents and Settings\Mr Amazing!\Desktop\AutoPligg 3.1 Final\Application\Meebey.SmartIrc4net.dll Postponed
25/01/2010 8:51:45 PM Detected: Backdoor.MSIL.IrcBot.aj C:\Documents and Settings\Mr Amazing!\Desktop\AutoPligg 3.1 Final\Application\Meebey.SmartIrc4net.dll
25/01/2010 8:51:44 PM Task started
Full Scan: completed 10/02/2010 2:53:12 AM (events: 9, objects: 958612, time: 03:30:25)
25/01/2010 8:54:53 PM Task completed
25/01/2010 8:54:53 PM Deleted: Backdoor.MSIL.IrcBot.aj C:\Documents and Settings\Mr Amazing!\Desktop\New Folder\AutoPligg 3.1 Final\AutoPligg 3.1 Final\Application\Meebey.SmartIrc4net.dll
25/01/2010 8:54:51 PM Detected: Backdoor.MSIL.IrcBot.aj C:\Documents and Settings\Mr Amazing!\Desktop\New Folder\AutoPligg 3.1 Final\AutoPligg 3.1 Final\Application\Meebey.SmartIrc4net.dll
25/01/2010 8:54:50 PM Untreated: Backdoor.MSIL.IrcBot.aj C:\Documents and Settings\Mr Amazing!\Desktop\New Folder\AutoPligg 3.1 Final\AutoPligg 3.1 Final\Application\Meebey.SmartIrc4net.dll Postponed
25/01/2010 8:54:50 PM Detected: Backdoor.MSIL.IrcBot.aj C:\Documents and Settings\Mr Amazing!\Desktop\New Folder\AutoPligg 3.1 Final\AutoPligg 3.1 Final\Application\Meebey.SmartIrc4net.dll
25/01/2010 8:54:48 PM Task started
Full Scan: completed 10/02/2010 2:53:12 AM (events: 9, objects: 958612, time: 03:30:25)
25/01/2010 8:57:32 PM Task completed
25/01/2010 8:57:32 PM Task started
Full Scan: completed 10/02/2010 2:53:12 AM (events: 9, objects: 958612, time: 03:30:25)
27/01/2010 7:02:32 PM Task completed
27/01/2010 7:00:26 PM Task started
Full Scan: completed 10/02/2010 2:53:12 AM (events: 9, objects: 958612, time: 03:30:25)
28/01/2010 1:48:12 AM Task completed
28/01/2010 1:48:12 AM Deleted: Trojan-Spy.Win32.Agent.bcvk C:\Program Files\qualcomm\Eudora1\attach\vty-0229.rar/ViTALiTY\install.exe
28/01/2010 1:48:12 AM Detected: Trojan-Spy.Win32.Agent.bcvk C:\Program Files\qualcomm\Eudora1\attach\vty-0229.rar/ViTALiTY\install.exe/PE_Patch.UPX/UPX
28/01/2010 1:30:29 AM Detected: http://www.viruslist.com/en/advisories/23655 C:\Program Files\Secret Spider Generator\msxml4.dll
28/01/2010 1:29:10 AM Detected: http://www.viruslist.com/en/advisories/14104 C:\Program Files\qualcomm\eudora2\eudora.exe
28/01/2010 1:27:42 AM Untreated: Trojan-Spy.Win32.Agent.bcvk C:\Program Files\qualcomm\Eudora1\attach\vty-0229.rar/ViTALiTY\install.exe/PE_Patch.UPX/UPX Postponed
28/01/2010 1:27:41 AM Detected: Trojan-Spy.Win32.Agent.bcvk C:\Program Files\qualcomm\Eudora1\attach\vty-0229.rar/ViTALiTY\install.exe/PE_Patch.UPX/UPX
27/01/2010 10:05:42 PM Detected: http://www.viruslist.com/en/advisories/14104 C:\Program Files\qualcomm\Eudora1\Eudora.exe
27/01/2010 8:35:34 PM Untreated: Backdoor.MSIL.IrcBot.aj C:\Documents and Settings\Mr Amazing!\My Documents\Downloads\AutoPligg_3.1_Final_2.rar/AutoPligg 3.1 Final\AutoPligg 3.1 Final\Application\Meebey.SmartIrc4net.dll Postponed
27/01/2010 8:35:34 PM Detected: Backdoor.MSIL.IrcBot.aj C:\Documents and Settings\Mr Amazing!\My Documents\Downloads\AutoPligg_3.1_Final_2.rar/AutoPligg 3.1 Final\AutoPligg 3.1 Final\Application\Meebey.SmartIrc4net.dll
27/01/2010 8:35:32 PM Untreated: Backdoor.MSIL.IrcBot.aj C:\Documents and Settings\Mr Amazing!\My Documents\Downloads\AutoPligg_3.1_Final.rar/AutoPligg 3.1 Final\AutoPligg 3.1 Final\Application\Meebey.SmartIrc4net.dll Postponed
27/01/2010 8:35:32 PM Detected: Backdoor.MSIL.IrcBot.aj C:\Documents and Settings\Mr Amazing!\My Documents\Downloads\AutoPligg_3.1_Final.rar/AutoPligg 3.1 Final\AutoPligg 3.1 Final\Application\Meebey.SmartIrc4net.dll
27/01/2010 8:34:16 PM Detected: http://www.viruslist.com/en/advisories/37699 C:\Program Files\Mozilla Firefox\firefox.exe
27/01/2010 8:29:08 PM Detected: http://www.viruslist.com/en/advisories/34036 C:\Program Files\Foxit Software\Foxit Reader\Foxit Reader.exe
27/01/2010 8:26:09 PM Detected: http://www.viruslist.com/en/advisories/37563 C:\Program Files\Adobe\Photoshop 7.0\MPS.dll
27/01/2010 8:22:41 PM Untreated: Trojan-Downloader.Win32.AutoIt.jr C:\Documents and Settings\Mr Amazing!\My Documents\APPLICATIONS\Updated Portable USB Software Pack For 512MB Stick Gold Edtn\Portable Kaspersky Antivirus 7.0.0.120.zip/Portable Kaspersky Antivirus 7.0.0.120/Portable Kaspersky Antivirus 7.0.0.120.exe/PKAV7.exe Postponed
27/01/2010 8:22:41 PM Detected: Trojan-Downloader.Win32.AutoIt.jr C:\Documents and Settings\Mr Amazing!\My Documents\APPLICATIONS\Updated Portable USB Software Pack For 512MB Stick Gold Edtn\Portable Kaspersky Antivirus 7.0.0.120.zip/Portable Kaspersky Antivirus 7.0.0.120/Portable Kaspersky Antivirus 7.0.0.120.exe/PKAV7.exe
27/01/2010 8:22:24 PM Untreated: Constructor.Win32.Joiner.fg C:\Documents and Settings\Mr Amazing!\My Documents\APPLICATIONS\Updated Portable USB Software Pack For 512MB Stick Gold Edtn\Portable Google Earth Pro v4.1.7.zip/Portable Google Earth Pro v4.1.7/Google Earth Pro 4.1.7087.exe Postponed
27/01/2010 8:22:24 PM Detected: Constructor.Win32.Joiner.fg C:\Documents and Settings\Mr Amazing!\My Documents\APPLICATIONS\Updated Portable USB Software Pack For 512MB Stick Gold Edtn\Portable Google Earth Pro v4.1.7.zip/Portable Google Earth Pro v4.1.7/Google Earth Pro 4.1.7087.exe
27/01/2010 7:38:44 PM Untreated: Trojan-Spy.Win32.Agent.bcvk C:\Documents and Settings\Mr Amazing!\Desktop\Old Desktop\applications\vty-0229.rar/ViTALiTY\install.exe/PE_Patch.UPX/UPX Postponed
27/01/2010 7:38:44 PM Detected: Trojan-Spy.Win32.Agent.bcvk C:\Documents and Settings\Mr Amazing!\Desktop\Old Desktop\applications\vty-0229.rar/ViTALiTY\install.exe/PE_Patch.UPX/UPX
27/01/2010 7:04:45 PM Detected: http://www.viruslist.com/en/advisories/37699 C:\Program Files\Mozilla Firefox\firefox.exe
27/01/2010 7:04:45 PM Detected: http://www.viruslist.com/en/advisories/14104 C:\Program Files\qualcomm\eudora2\eudora.exe
27/01/2010 7:04:33 PM Detected: http://www.viruslist.com/en/advisories/37699 C:\Program Files\Mozilla Firefox\firefox.exe
27/01/2010 7:04:32 PM Task started
Full Scan: completed 10/02/2010 2:53:12 AM (events: 9, objects: 958612, time: 03:30:25)
9/02/2010 11:22:47 PM Task started
9/02/2010 11:22:51 PM Detected: http://www.viruslist.com/en/advisories/37699 C:\Program Files\Mozilla Firefox\firefox.exe
9/02/2010 11:24:04 PM Detected: http://www.viruslist.com/en/advisories/37699 C:\Program Files\Mozilla Firefox\firefox.exe
9/02/2010 11:24:07 PM Detected: http://www.viruslist.com/en/advisories/14104 C:\Program Files\qualcomm\eudora2\eudora.exe
10/02/2010 12:42:15 AM Detected: http://www.viruslist.com/en/advisories/34036 C:\Program Files\Foxit Software\Foxit Reader\Foxit Reader.exe
10/02/2010 12:46:23 AM Detected: http://www.viruslist.com/en/advisories/37699 C:\Program Files\Mozilla Firefox\firefox.exe
10/02/2010 12:47:32 AM Detected: http://www.viruslist.com/en/advisories/14104 C:\Program Files\qualcomm\Eudora1\Eudora.exe
10/02/2010 2:35:53 AM Detected: http://www.viruslist.com/en/advisories/14104 C:\Program Files\qualcomm\eudora2\eudora.exe
10/02/2010 2:53:12 AM Task completed
Hi,
Delete these folders (if still found):
C:\Documents and Settings\Mr Amazing!\Desktop\AutoPligg 3.1 Final
C:\Documents and Settings\Mr Amazing!\Desktop\New Folder\AutoPligg 3.1 Final
and these files (if still found):
C:\Program Files\qualcomm\Eudora1\attach\vty-0229.rar
C:\Documents and Settings\Mr Amazing!\My Documents\Downloads\AutoPligg_3.1_Final_2.rar
C:\Documents and Settings\Mr Amazing!\My Documents\APPLICATIONS\Updated Portable USB Software Pack For 512MB Stick Gold Edtn\Portable Kaspersky Antivirus 7.0.0.120.zip
C:\Documents and Settings\Mr Amazing!\My Documents\APPLICATIONS\Updated Portable USB Software Pack For 512MB Stick Gold Edtn\Portable Google Earth Pro v4.1.7.zip
C:\Documents and Settings\Mr Amazing!\Desktop\Old Desktop\applications\vty-0229.rar
There're also some vulnerable programs in your system. Update these (or uninstall those you don't need anymore):
Adobe Photoshop
Eudora
Firefox
Foxit Reader
Secret Spider Generator
How is the system running now?
Hi,
Delete these folders (if still found):
C:\Documents and Settings\Mr Amazing!\Desktop\AutoPligg 3.1 Final
C:\Documents and Settings\Mr Amazing!\Desktop\New Folder\AutoPligg 3.1 Final
and these files (if still found):
C:\Program Files\qualcomm\Eudora1\attach\vty-0229.rar
C:\Documents and Settings\Mr Amazing!\My Documents\Downloads\AutoPligg_3.1_Final_2.rar
C:\Documents and Settings\Mr Amazing!\My Documents\APPLICATIONS\Updated Portable USB Software Pack For 512MB Stick Gold Edtn\Portable Kaspersky Antivirus 7.0.0.120.zip
C:\Documents and Settings\Mr Amazing!\My Documents\APPLICATIONS\Updated Portable USB Software Pack For 512MB Stick Gold Edtn\Portable Google Earth Pro v4.1.7.zip
C:\Documents and Settings\Mr Amazing!\Desktop\Old Desktop\applications\vty-0229.rar
There're also some vulnerable programs in your system. Update these (or uninstall those you don't need anymore):
Adobe Photoshop
Eudora
Firefox
Foxit Reader
Secret Spider Generator
How is the system running now?
Thanks Blade,
The system is running much better now thanks to your help.
I've updated most of the software you've suggested, and uninstalled others.
I've also deleted the files you've indicated. Many of them were not there. I've either already deleted them or some of the scans must have done the job.
Thank you so much for your help. The problem I was concerned about is no longer present... and I'm sure many others I was not aware of too!
Do you have any further advice?
Thank you!
You're welcome :)
THESE STEPS ARE VERY IMPORTANT
Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.
1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
2. Reboot.
3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis
Now lets uninstall ComboFix:
Click START then RUN
Now copy-paste Combofix /uninstall in the runbox and click OK
Please download OTC (http://oldtimer.geekstogo.com/OTC.exe) and save it to desktop.
Double-click OTC.exe.
Click the CleanUp! button.
Select Yes when the
Begin cleanup Process?
prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.
Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.
UPDATING WINDOWS AND INTERNET EXPLORER
IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site (http://windowsupdate.microsoft.com/) to get the critical updates.
If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.
Make your Internet Explorer more secure
This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.
hosts file:
Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate webpages. We can customize a hosts file so that it blocks certain webpages. However, it can slow down certain computers. This is why using a hosts file is optional!!
Download it here (http://www.mvps.org/winhelp2002/hosts.htm). Make sure you read the instructions on how to install the hosts file. There is a good tutorial here (http://www.bleepingcomputer.com/forums/tutorial51.html)
If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
Click the start button (at the lower left hand corner of your screen) Click run In the dialog box, type services.msc hit enter, then locate dns client Highlight it, then double-click it. On the dropdown box, change the setting from automatic to manual. Click ok
Run Secunia vulnerability check here (http://secunia.com/vulnerability_scanning/online/) and fix its findings.
Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Once again, please post and tell me how things are going with your system... problems etc.
Have a great day,
Blade :cool:
I think everything's clean and clear now.
I've updated all my software (that I can think of!) and done all windows updates too.
Ran the cleans, uninstalls you suggested in your last post and also followed the steps for the host file too.
Thank you so much for your help Blade. I know you don't get paid for your work but you've done me a fantastic service this week mate.
Sometimes I consider learning more about the spyware removal techniques you guys use. But honestly, I don't think I can fathom the depth of your knowledge!
Thanks again for everything.
Take care,
Scrampy
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help. :)
Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than four days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.