Page 1 of 2 12 LastLast
Results 1 to 10 of 12

Thread: Search Rerouting Malware

  1. 2009-05-05, 23:44 #1
    ihatemalware
    ihatemalware is offline
    Junior Member
    Join Date
    May 2009
    Posts
    15

    Default Search Rerouting Malware

    Hi,

    I have a similar problem to many of the posts I've been reading online. Most of the Google search results that I click on redirects me to a completely random advertising website. I'm running Firefox on XP.

    I've ran Symantec anti-virus, Malwarebytes (after renaming the file...) and they found nothing. I downloaded Spybot but it won't open even after renaming the program. I also did Goored that I came across on a couple of threads. Still nothing...

    Please help!! Thanks!!


    HiJackThis Logfile:


    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\acs.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\00THotkey.exe
    C:\WINDOWS\system32\TFNF5.exe
    C:\WINDOWS\system32\TPWRTRAY.EXE
    C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
    C:\WINDOWS\System32\ezSP_Px.exe
    C:\Program Files\ltmoh\Ltmoh.exe
    C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
    C:\WINDOWS\system32\TDispVol.exe
    C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
    C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
    C:\toshiba\ivp\ism\pinger.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    C:\Program Files\Symantec AntiVirus\DoScan.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
    O2 - BHO: SnapToolbarHelper Class - {8600AC1E-BE58-4FFC-BD5D-F2A8EC38C838} - C:\Program Files\Snap Visual Search\snapbar.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Snap Visual Search - {EF56413F-9398-4DF5-BC88-6FC3B227D5C5} - C:\Program Files\Snap Visual Search\snapbar.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
    O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
    O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
    O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
    O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
    O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
    O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
    O4 - HKLM\..\Run: [TFncKy] TFncKy.exe /Type 03
    O4 - HKLM\..\Run: [TDispVol] TDispVol.exe
    O4 - HKLM\..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
    O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [AAWTray] C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    O4 - Global Startup: VPN Client.lnk = ?
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1190488614312
    O16 - DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} (CPlayFirstDoggieDashControl Object) - http://www.shockwave.com/content/dog...sh.1.0.0.6.cab
    O23 - Service: Proxim Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: Tmesbs32 (Tmesbs) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --
    End of file - 10303 bytes
  2. 2009-05-06, 15:13 #2
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi

    IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

    BitTorrent DNA


    I'd like you to read this thread.

    Please go to Control Panel > Add/Remove Programs and uninstall BitTorrent and DNA entries there.


    After that:


    Download DDS and save it to your desktop from here or here or here.
    Disable any script blocker, and then double click dds.scr to run the tool.
    • When done, DDS will open two (2) logs:
      1. DDS.txt
      2. Attach.txt
    • Save both reports to your desktop. Post them back to your topic.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
  3. 2009-05-06, 15:54 #3
    ihatemalware
    ihatemalware is offline
    Junior Member
    Join Date
    May 2009
    Posts
    15

    Default

    thanks so much for your help! here's the DDS log files:


    DDS (Ver_09-03-16.01) - NTFSx86
    Run by Katie Dong at 9:43:52.71 on Wed 05/06/2009
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.32 [GMT -4:00]

    AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated)

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\acs.exe
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\00THotkey.exe
    C:\WINDOWS\system32\TFNF5.exe
    C:\WINDOWS\system32\TPWRTRAY.EXE
    C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
    C:\WINDOWS\System32\ezSP_Px.exe
    C:\Program Files\ltmoh\Ltmoh.exe
    C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
    C:\WINDOWS\system32\TDispVol.exe
    C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
    C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
    C:\toshiba\ivp\ism\pinger.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Katie Dong\Desktop\dds.com

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/ig?hl=en
    uSearch Bar = hxxp://www.toshiba.com/search
    BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\acrobat\activex\AcroIEHelper.dll
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
    BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
    EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
    EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    uRun: [Aim6]
    mRun: [00THotkey] c:\windows\system32\00THotkey.exe
    mRun: [000StTHK] 000StTHK.exe
    mRun: [TFNF5] TFNF5.exe
    mRun: [Tpwrtray] TPWRTRAY.EXE
    mRun: [TosHKCW.exe] "c:\program files\toshiba\wireless hotkey\TosHKCW.exe"
    mRun: [ezShieldProtector for Px] c:\windows\system32\ezSP_Px.exe
    mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe
    mRun: [TFncKy] TFncKy.exe /Type 03
    mRun: [TcmTray]
    mRun: [TDispVol] TDispVol.exe
    mRun: [TMESBS.EXE] c:\program files\toshiba\tme3\TMESBS32.EXE /Client
    mRun: [<NO NAME>]
    mRun: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    mRun: [nwiz] nwiz.exe /installquiet
    mRun: [TouchED] c:\program files\toshiba\touched\TouchED.Exe
    mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
    mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
    mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
    mRun: [AAWTray] c:\program files\lavasoft\ad-aware 2007\AAWTray.exe
    mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    mRun: [IMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE
    mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
    mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
    mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\acrobat 6.0\distillr\acrotray.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{4c271126-c295-4828-a901-5910ae0c258b}\Icon3E5562ED7.ico
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1190488614312
    DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://www.shockwave.com/content/doggiedash/sis/DoggieDash.1.0.0.6.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
    Notify: NavLogon - c:\windows\system32\NavLogon.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\katied~1\applic~1\mozilla\firefox\profiles\p1rsz0ax.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en
    FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
    FF - plugin: c:\documents and settings\katie dong\application data\mozilla\firefox\profiles\p1rsz0ax.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
    FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
    FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

    ============= SERVICES / DRIVERS ===============

    R0 TVALDX;Toshiba ACPI-Based Value Added Logical Device Extension Driver;c:\windows\system32\drivers\TVALDX.SYS [2002-7-25 6082]
    R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]
    R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
    R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-11-21 192104]
    R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-11-21 169576]
    R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2007-3-14 1816768]
    R2 Tmesbs;Tmesbs32;c:\program files\toshiba\tme3\tmesbs32.exe [2002-8-5 77824]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-27 101936]
    R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090424.003\naveng.sys [2009-4-24 89104]
    R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090424.003\navex15.sys [2009-4-24 876144]
    S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2007-3-14 116416]
    S3 toslane;Toshiba BT-LANE;c:\windows\system32\drivers\tosrflan.sys [2002-2-7 25420]
    S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]

    =============== Created Last 30 ================

    2009-05-06 09:27 <DIR> --dsh--- c:\documents and settings\katie dong\IETldCache
    2009-05-06 09:20 <DIR> --d----- c:\windows\ie8updates
    2009-05-06 09:16 <DIR> -cd-h--- c:\windows\ie8
    2009-05-06 09:16 105,984 -c------ c:\windows\system32\dllcache\iecompat.dll
    2009-05-06 09:10 <DIR> --d----- c:\documents and settings\katie dong\Shared
    2009-05-06 09:10 <DIR> --d----- c:\documents and settings\katie dong\Incomplete
    2009-05-06 09:09 <DIR> --d----- c:\docume~1\katied~1\applic~1\LimeWire
    2009-05-06 09:08 410,984 a------- c:\windows\system32\deploytk.dll
    2009-05-06 09:04 <DIR> --d----- c:\docume~1\alluse~1\applic~1\acccore
    2009-05-06 09:03 <DIR> --d----- c:\program files\AIM6
    2009-05-05 17:03 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
    2009-05-05 16:57 <DIR> --d----- c:\program files\Spybot - Search & Destroy
    2009-05-05 16:51 <DIR> --d----- c:\program files\Trend Micro
    2009-05-05 13:40 <DIR> --d----- c:\docume~1\katied~1\applic~1\Malwarebytes
    2009-05-05 13:34 15,504 a------- c:\windows\system32\drivers\mbam.sys
    2009-05-05 13:34 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-05-05 13:34 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
    2009-05-05 13:34 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2009-04-16 13:50 284,160 -c------ c:\windows\system32\dllcache\pdh.dll
    2009-04-16 13:50 401,408 -c------ c:\windows\system32\dllcache\rpcss.dll
    2009-04-16 13:50 110,592 -c------ c:\windows\system32\dllcache\services.exe
    2009-04-16 13:50 473,600 -c------ c:\windows\system32\dllcache\fastprox.dll
    2009-04-16 13:50 227,840 -c------ c:\windows\system32\dllcache\wmiprvse.exe
    2009-04-16 13:50 453,120 -c------ c:\windows\system32\dllcache\wmiprvsd.dll
    2009-04-16 13:50 729,088 -c------ c:\windows\system32\dllcache\lsasrv.dll
    2009-04-16 13:50 617,472 -c------ c:\windows\system32\dllcache\advapi32.dll
    2009-04-16 13:50 714,752 -c------ c:\windows\system32\dllcache\ntdll.dll
    2009-04-16 13:49 2,560 -------- c:\windows\system32\xpsp4res.dll
    2009-04-16 13:49 1,203,922 -c------ c:\windows\system32\dllcache\sysmain.sdb
    2009-04-16 13:49 215,552 -c------ c:\windows\system32\dllcache\wordpad.exe
    2009-04-06 18:12 <DIR> --d----- c:\program files\iPod
    2009-04-06 18:11 <DIR> --d----- c:\program files\iTunes
    2009-04-06 18:11 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

    ==================== Find3M ====================

    2009-03-20 14:50 3,358,720 a------- c:\windows\system32\GPhotos.scr
    2009-03-19 16:32 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
    2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
    2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
    2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
    2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
    2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
    2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
    2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll
    2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll
    2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe
    2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
    2009-03-06 10:22 284,160 a------- c:\windows\system32\pdh.dll
    2009-02-09 08:10 729,088 a------- c:\windows\system32\lsasrv.dll
    2009-02-09 08:10 714,752 a------- c:\windows\system32\ntdll.dll
    2009-02-09 08:10 617,472 a------- c:\windows\system32\advapi32.dll
    2009-02-09 08:10 401,408 a------- c:\windows\system32\rpcss.dll
    2009-02-09 07:13 1,846,784 a------- c:\windows\system32\win32k.sys
    2009-02-07 19:02 2,066,048 a------- c:\windows\system32\ntkrnlpa.exe
    2009-02-06 07:11 110,592 a------- c:\windows\system32\services.exe
    2009-02-06 07:08 2,189,056 a------- c:\windows\system32\ntoskrnl.exe
    2009-02-06 06:39 35,328 a------- c:\windows\system32\sc.exe
    2008-05-07 20:36 39,280 ac------ c:\docume~1\katied~1\applic~1\GDIPFONTCACHEV1.DAT
    2008-09-14 14:57 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091420080915\index.dat

    ============= FINISH: 9:44:42.74 ===============






    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-03-16.01)

    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume1
    Install Date: 9/22/2007 2:12:42 PM
    System Uptime: 5/6/2009 9:26:48 AM (0 hours ago)

    Motherboard: TOSHIBA | | Portable PC
    Processor: Mobile Intel(R) Pentium(R) 4 - M CPU 2.20GHz | uFC-PGA Socket | 2192/100mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 56 GiB total, 29.146 GiB free.
    D: is CDROM ()

    ==== Disabled Device Manager Items =============

    Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
    Description: Cisco Systems VPN Adapter
    Device ID: ROOT\NET\0000
    Manufacturer: Cisco Systems
    Name: Cisco Systems VPN Adapter
    PNP Device ID: ROOT\NET\0000
    Service: CVirtA

    ==== System Restore Points ===================

    RP306: 2/3/2009 9:20:22 PM - System Checkpoint
    RP307: 2/6/2009 1:24:21 PM - System Checkpoint
    RP308: 2/7/2009 2:00:43 PM - System Checkpoint
    RP309: 2/9/2009 1:53:32 PM - System Checkpoint
    RP310: 2/11/2009 3:37:26 PM - System Checkpoint
    RP311: 2/12/2009 12:03:34 AM - Software Distribution Service 3.0
    RP312: 2/13/2009 3:26:53 PM - System Checkpoint
    RP313: 2/14/2009 4:37:47 PM - System Checkpoint
    RP314: 2/15/2009 5:21:02 PM - System Checkpoint
    RP315: 2/16/2009 6:04:26 PM - System Checkpoint
    RP316: 2/18/2009 1:12:09 PM - System Checkpoint
    RP317: 2/19/2009 6:48:08 PM - System Checkpoint
    RP318: 2/20/2009 7:17:48 PM - System Checkpoint
    RP319: 2/21/2009 8:24:22 PM - System Checkpoint
    RP320: 2/22/2009 10:08:56 PM - System Checkpoint
    RP321: 2/23/2009 10:19:44 PM - System Checkpoint
    RP322: 2/25/2009 7:41:31 PM - System Checkpoint
    RP323: 2/25/2009 10:34:05 PM - Software Distribution Service 3.0
    RP324: 2/27/2009 5:06:43 PM - System Checkpoint
    RP325: 2/28/2009 6:39:41 PM - System Checkpoint
    RP326: 3/2/2009 11:12:58 AM - System Checkpoint
    RP327: 3/3/2009 3:56:11 PM - System Checkpoint
    RP328: 3/4/2009 5:32:48 PM - System Checkpoint
    RP329: 3/6/2009 1:21:32 PM - System Checkpoint
    RP330: 3/7/2009 2:45:53 PM - System Checkpoint
    RP331: 3/8/2009 4:35:24 PM - System Checkpoint
    RP332: 3/9/2009 4:36:03 PM - System Checkpoint
    RP333: 3/10/2009 6:25:58 PM - System Checkpoint
    RP334: 3/11/2009 7:53:52 PM - Software Distribution Service 3.0
    RP335: 3/13/2009 6:18:22 AM - System Checkpoint
    RP336: 3/14/2009 11:56:12 AM - System Checkpoint
    RP337: 3/15/2009 5:51:29 PM - System Checkpoint
    RP338: 3/16/2009 7:25:54 PM - System Checkpoint
    RP339: 3/16/2009 11:25:34 PM - Software Distribution Service 3.0
    RP340: 3/18/2009 9:17:11 PM - System Checkpoint
    RP341: 3/19/2009 9:58:06 PM - System Checkpoint
    RP342: 3/21/2009 1:44:06 PM - System Checkpoint
    RP343: 3/22/2009 3:19:09 PM - System Checkpoint
    RP344: 3/23/2009 8:36:46 PM - System Checkpoint
    RP345: 3/24/2009 9:39:10 PM - System Checkpoint
    RP346: 3/25/2009 10:27:27 PM - System Checkpoint
    RP347: 3/27/2009 1:28:24 PM - System Checkpoint
    RP348: 3/28/2009 8:29:57 PM - System Checkpoint
    RP349: 3/30/2009 2:44:09 PM - System Checkpoint
    RP350: 3/31/2009 7:18:37 PM - System Checkpoint
    RP351: 4/1/2009 8:00:54 PM - System Checkpoint
    RP352: 4/2/2009 8:05:08 PM - System Checkpoint
    RP353: 4/3/2009 8:42:04 PM - System Checkpoint
    RP354: 4/5/2009 3:32:44 PM - System Checkpoint
    RP355: 4/6/2009 6:46:03 PM - System Checkpoint
    RP356: 4/7/2009 7:38:23 PM - System Checkpoint
    RP357: 4/8/2009 8:15:14 PM - System Checkpoint
    RP358: 4/10/2009 11:37:39 AM - System Checkpoint
    RP359: 4/12/2009 9:27:49 PM - System Checkpoint
    RP360: 4/14/2009 9:05:56 PM - System Checkpoint
    RP361: 4/15/2009 10:20:35 PM - System Checkpoint
    RP362: 4/17/2009 10:13:14 AM - Software Distribution Service 3.0
    RP363: 4/18/2009 10:38:04 AM - System Checkpoint
    RP364: 4/19/2009 1:52:13 PM - System Checkpoint
    RP365: 4/20/2009 1:54:54 PM - System Checkpoint
    RP366: 4/21/2009 3:39:20 PM - System Checkpoint
    RP367: 4/22/2009 6:29:17 PM - System Checkpoint
    RP368: 4/23/2009 10:01:05 PM - System Checkpoint
    RP369: 4/24/2009 10:23:38 PM - System Checkpoint
    RP370: 4/27/2009 7:58:56 PM - System Checkpoint
    RP371: 4/30/2009 4:55:57 PM - System Checkpoint
    RP372: 5/1/2009 8:08:38 PM - System Checkpoint
    RP373: 5/2/2009 8:57:33 PM - System Checkpoint

    ==== Installed Programs ======================

    Adobe Acrobat 6.0 Professional
    Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
    Adobe Flash Player 10 Plugin
    Adobe Flash Player 9 ActiveX
    Adobe Help Center 1.0
    Adobe Photoshop CS2
    Adobe Reader 8.1.2
    Adobe Reader 8.1.2 Security Update 1 (KB403742)
    Adobe Shockwave Player
    Adobe Stock Photos 1.0
    AIM 6
    Apple Mobile Device Support
    Apple Software Update
    AutoUpdate
    BlitzMail
    Bluetooth Stack for Windows by Toshiba
    Cisco Systems VPN Client 5.0.03.0530
    Comcast High-Speed Internet Install Wizard
    Compatibility Pack for the 2007 Office system
    Critical Update for Windows Media Player 11 (KB959772)
    DivX Codec
    DivX Converter
    DivX Player
    DivX Web Player
    Drag'n Drop CD
    HijackThis 2.0.2
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB952287)
    Intel(R) PRO Ethernet Adapter and Software
    InterVideo WinDVD 4
    iTunes
    Java(TM) 6 Update 13
    Java(TM) 6 Update 2
    LiveReg (Symantec Corporation)
    LiveUpdate 3.1 (Symantec Corporation)
    Malwarebytes' Anti-Malware
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office XP Professional with FrontPage
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft VC9 runtime libraries
    Mozilla Firefox (3.0.10)
    Network Device Switch 3
    NVIDIA Windows 2000/XP Display Drivers
    ORiNOCO 802.11 Wireless Client
    Picasa 3
    QuickTime
    RealPlayer
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Windows Internet Explorer 7 (KB937143)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB939653)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows Media Player 9 (KB936782)
    Security Update for Windows XP (KB923561)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB938464-v2)
    Security Update for Windows XP (KB938464)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB946648)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB950974)
    Security Update for Windows XP (KB951066)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951376)
    Security Update for Windows XP (KB951698)
    Security Update for Windows XP (KB951748)
    Security Update for Windows XP (KB952004)
    Security Update for Windows XP (KB952954)
    Security Update for Windows XP (KB953839)
    Security Update for Windows XP (KB954211)
    Security Update for Windows XP (KB954459)
    Security Update for Windows XP (KB954600)
    Security Update for Windows XP (KB955069)
    Security Update for Windows XP (KB956391)
    Security Update for Windows XP (KB956572)
    Security Update for Windows XP (KB956802)
    Security Update for Windows XP (KB956803)
    Security Update for Windows XP (KB956841)
    Security Update for Windows XP (KB957095)
    Security Update for Windows XP (KB957097)
    Security Update for Windows XP (KB958644)
    Security Update for Windows XP (KB958687)
    Security Update for Windows XP (KB958690)
    Security Update for Windows XP (KB959426)
    Security Update for Windows XP (KB960225)
    Security Update for Windows XP (KB960715)
    Security Update for Windows XP (KB960803)
    Security Update for Windows XP (KB961373)
    Spybot - Search & Destroy
    Symantec AntiVirus
    Synaptics TouchPad
    Toshiba Access
    TOSHIBA Console
    TOSHIBA Controls
    Toshiba Hotkey Utility for Display Devices
    TOSHIBA MEDIA PLAYER V1.7
    TOSHIBA Mobile Extension3 for Windows XP V3.27.00.XP
    TOSHIBA Power Saver
    TOSHIBA Satellite Demo
    TOSHIBA Software Modem
    Toshiba Software Upgrades
    Toshiba System Stability Program
    Toshiba Tbiosdrv Driver
    TOSHIBA TouchPad On/Off Utility V2.03.00
    TOSHIBA Utilities
    Toshiba WinXP Registration
    Update for Windows Internet Explorer 8 (KB968220)
    Update for Windows XP (KB951072-v2)
    Update for Windows XP (KB951978)
    Update for Windows XP (KB955839)
    Update for Windows XP (KB967715)
    WebFldrs XP
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Internet Explorer 7
    Windows Internet Explorer 8
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Service Pack 3
    Wireless Hotkey
    YAMAHA AC-XG WDM

    ==== Event Viewer Messages From Past Week ========

    5/6/2009 9:03:38 AM, error: SideBySide [59] - Resolve Partial Assembly failed for Microsoft.VC90.CRT. Reference error message: The referenced assembly is not installed on your system. .
    5/6/2009 9:03:38 AM, error: SideBySide [59] - Generate Activation Context failed for C:\DOCUME~1\KATIED~1\LOCALS~1\Temp\AIM_69~1.4\imappver.dll. Reference error message: The operation completed successfully. .
    5/6/2009 9:03:38 AM, error: SideBySide [32] - Dependent Assembly Microsoft.VC90.CRT could not be found and Last Error was The referenced assembly is not installed on your system.
    5/5/2009 3:58:21 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
    5/5/2009 1:42:41 PM, error: E100B [4] - Adapter Intel(R) PRO/100 VE Network Connection: Adapter Link Down
    5/5/2009 1:18:44 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD eeCtrl Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SAVRT SAVRTPEL SPBBCDrv SYMTDI Tcpip
    5/5/2009 1:18:44 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
    5/5/2009 1:18:44 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
    5/5/2009 1:18:44 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    5/5/2009 1:18:44 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBT service which failed to start because of the following error: A device attached to the system is not functioning.
    5/5/2009 1:18:44 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    5/5/2009 1:18:44 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    5/5/2009 1:17:55 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    5/5/2009 1:17:52 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    5/5/2009 1:07:46 PM, error: Service Control Manager [7034] - The Cisco Systems, Inc. VPN Service service terminated unexpectedly. It has done this 1 time(s).
    5/4/2009 6:54:13 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
    5/4/2009 3:30:21 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
    5/3/2009 2:44:42 PM, error: Service Control Manager [7031] - The Symantec AntiVirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 10000 milliseconds: Restart the service.

    ==== End Of File ===========================
  4. 2009-05-06, 16:45 #4
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi again,



    Please visit this webpage for download links, and instructions for running ComboFix tool:

    http://www.bleepingcomputer.com/comb...o-use-combofix

    Please ensure you read this guide carefully and install the Recovery Console first.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should see a blue screen prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
      Remember to re-enable them afterwards.

    2. Click Yes to allow ComboFix to continue scanning for malware.


    When the tool is finished, it will produce a report for you.

    Please include the following reports for further review, and so we may continue cleansing the system:

    C:\ComboFix.txt
    New dds.txt log.

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
  5. 2009-05-06, 18:44 #5
    ihatemalware
    ihatemalware is offline
    Junior Member
    Join Date
    May 2009
    Posts
    15

    Default

    Just finished running combofix, here are the reports you requested. Thanks!!



    ComboFix 09-05-05.04 - Katie Dong 05/06/2009 12:28.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.212 [GMT -4:00]
    Running from: c:\documents and settings\Katie Dong\Desktop\ComboFix.exe
    AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\drivers\gxvxchrqaomkkltimrnyqvxenkrjomlwxyuod.sys
    c:\windows\system32\drivers\gxvxcxtudjnoejkdaysmkoloaqhgeppppbrsi.sys
    c:\windows\system32\gxvxccounter
    c:\windows\system32\gxvxcktuirqpxexypekyaptgppfsqppyaseun.dll

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_gxvxcserv.sys


    ((((((((((((((((((((((((( Files Created from 2009-04-06 to 2009-05-06 )))))))))))))))))))))))))))))))
    .

    2009-05-06 13:27 . 2009-05-06 13:27 -------- d-sh--w c:\documents and settings\Katie Dong\IETldCache
    2009-05-06 13:20 . 2009-05-06 13:20 -------- d-----w c:\windows\ie8updates
    2009-05-06 13:16 . 2009-05-06 13:18 -------- dc-h--w c:\windows\ie8
    2009-05-06 13:16 . 2009-02-28 04:55 105984 -c----w c:\windows\system32\dllcache\iecompat.dll
    2009-05-06 13:10 . 2009-05-06 13:10 -------- d-----w c:\documents and settings\Katie Dong\Shared
    2009-05-06 13:10 . 2009-05-06 13:11 -------- d-----w c:\documents and settings\Katie Dong\Incomplete
    2009-05-06 13:09 . 2009-05-06 13:10 -------- d-----w c:\documents and settings\Katie Dong\Application Data\LimeWire
    2009-05-06 13:08 . 2009-05-06 13:07 410984 ----a-w c:\windows\system32\deploytk.dll
    2009-05-06 13:05 . 2009-05-06 13:05 -------- d-----w c:\documents and settings\Katie Dong\Application Data\acccore
    2009-05-06 13:04 . 2009-05-06 13:04 -------- d-----w c:\documents and settings\Katie Dong\Local Settings\Application Data\AOL OCP
    2009-05-06 13:04 . 2009-05-06 13:04 -------- d-----w c:\documents and settings\Katie Dong\Local Settings\Application Data\AOL
    2009-05-06 13:04 . 2009-05-06 13:04 -------- d-----w c:\documents and settings\All Users\Application Data\acccore
    2009-05-06 13:03 . 2009-05-06 13:04 -------- d-----w c:\program files\AIM6
    2009-05-05 21:03 . 2009-05-05 21:38 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-05-05 20:57 . 2009-05-05 21:24 -------- d-----w c:\program files\Spybot - Search & Destroy
    2009-05-05 20:51 . 2009-05-05 20:51 -------- d-----w c:\program files\Trend Micro
    2009-05-05 17:40 . 2009-05-05 17:40 -------- d-----w c:\documents and settings\Katie Dong\Application Data\Malwarebytes
    2009-05-05 17:34 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
    2009-05-05 17:34 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
    2009-05-05 17:34 . 2009-05-05 17:34 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-05-05 17:34 . 2009-05-05 20:05 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
    2009-04-16 17:50 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
    2009-04-16 17:50 . 2009-02-09 12:10 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
    2009-04-16 17:50 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe
    2009-04-16 17:50 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
    2009-04-16 17:50 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
    2009-04-16 17:50 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
    2009-04-16 17:50 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll
    2009-04-16 17:50 . 2009-02-09 12:10 617472 -c----w c:\windows\system32\dllcache\advapi32.dll
    2009-04-16 17:50 . 2009-02-09 12:10 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
    2009-04-16 17:49 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
    2009-04-16 17:49 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
    2009-04-06 22:12 . 2009-04-06 22:12 -------- d-----w c:\program files\iPod
    2009-04-06 22:11 . 2009-04-06 22:14 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    2009-04-06 22:11 . 2009-04-06 22:14 -------- d-----w c:\program files\iTunes

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-05-06 16:27 . 2007-09-22 22:33 -------- d-----w c:\program files\Symantec AntiVirus
    2009-05-06 13:07 . 2007-09-22 21:48 -------- d-----w c:\program files\Java
    2009-05-06 13:03 . 2007-09-22 21:17 -------- d-----w c:\program files\Common Files\AOL
    2009-04-06 22:12 . 2007-09-22 22:01 -------- d-----w c:\program files\Common Files\Apple
    2009-03-23 21:59 . 2007-09-22 22:02 -------- d-----w c:\program files\QuickTime
    2009-03-20 18:50 . 2009-03-20 18:50 3358720 ----a-w c:\windows\system32\GPhotos.scr
    2009-03-19 20:32 . 2008-01-29 16:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
    2009-03-08 08:34 . 2002-03-05 16:56 914944 ----a-w c:\windows\system32\wininet.dll
    2009-03-08 08:34 . 2002-07-23 23:24 43008 ----a-w c:\windows\system32\licmgr10.dll
    2009-03-08 08:33 . 2002-07-23 23:23 18944 ----a-w c:\windows\system32\corpol.dll
    2009-03-08 08:33 . 2002-02-26 21:58 420352 ----a-w c:\windows\system32\vbscript.dll
    2009-03-08 08:32 . 2002-07-23 23:23 72704 ----a-w c:\windows\system32\admparse.dll
    2009-03-08 08:32 . 2002-07-23 23:24 71680 ----a-w c:\windows\system32\iesetup.dll
    2009-03-08 08:31 . 2002-07-23 23:24 34816 ----a-w c:\windows\system32\imgutil.dll
    2009-03-08 08:31 . 2002-07-23 23:24 48128 ----a-w c:\windows\system32\mshtmler.dll
    2009-03-08 08:31 . 2002-07-23 23:24 45568 ----a-w c:\windows\system32\mshta.exe
    2009-03-08 08:22 . 2002-07-23 23:24 156160 ----a-w c:\windows\system32\msls31.dll
    2009-03-06 14:22 . 2002-07-23 23:24 284160 ----a-w c:\windows\system32\pdh.dll
    2009-02-09 12:10 . 2002-07-23 23:24 729088 ----a-w c:\windows\system32\lsasrv.dll
    2009-02-09 12:10 . 2007-09-22 19:34 401408 ----a-w c:\windows\system32\rpcss.dll
    2009-02-09 12:10 . 2002-07-23 23:24 714752 ----a-w c:\windows\system32\ntdll.dll
    2009-02-09 12:10 . 2002-07-23 23:23 617472 ----a-w c:\windows\system32\advapi32.dll
    2009-02-09 11:13 . 2002-07-23 23:25 1846784 ----a-w c:\windows\system32\win32k.sys
    2009-02-07 23:02 . 2001-08-17 13:48 2066048 ----a-w c:\windows\system32\ntkrnlpa.exe
    2009-02-06 11:11 . 2002-07-23 23:24 110592 ----a-w c:\windows\system32\services.exe
    2009-02-06 11:08 . 2002-07-23 23:24 2189056 ----a-w c:\windows\system32\ntoskrnl.exe
    2009-02-06 10:39 . 2002-07-23 23:24 35328 ----a-w c:\windows\system32\sc.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="NvQTwk" [X]
    "00THotkey"="c:\windows\System32\00THotkey.exe" [2002-04-16 01:35 249856]
    "TosHKCW.exe"="c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2002-01-23 49152]
    "ezShieldProtector for Px"="c:\windows\System32\ezSP_Px.exe" [2002-08-20 40960]
    "LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2002-05-31 163840]
    "TMESBS.EXE"="c:\program files\TOSHIBA\TME3\TMESBS32.EXE" [2002-08-02 77824]
    "TouchED"="c:\program files\TOSHIBA\TouchED\TouchED.Exe" [2002-07-09 126976]
    "Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2001-11-14 147456]
    "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2002-08-16 126976]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2002-08-16 557056]
    "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-11-22 52840]
    "vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2007-03-15 125632]
    "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
    "IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2001-08-18 44032]
    "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
    "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
    "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-12-07 185872]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-06 148888]
    "000StTHK"="000StTHK.exe" - c:\windows\system32\000StTHK.exe [2001-06-24 03:28 24576]
    "TFNF5"="TFNF5.exe" - c:\windows\system32\TFNF5.exe [2002-06-26 73728]
    "Tpwrtray"="TPWRTRAY.EXE" - c:\windows\system32\TPWRTRAY.EXE [2002-03-20 217088]
    "TFncKy"="TFncKy.exe" [BU]
    "TDispVol"="TDispVol.exe" - c:\windows\system32\TDispVol.exe [2002-03-02 98304]
    "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2002-08-15 438272]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-4-7 217190]
    VPN Client.lnk - c:\windows\Installer\{4C271126-C295-4828-A901-5910AE0C258B}\Icon3E5562ED7.ico [2008-10-13 6144]

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\WINDOWS\\Blitz\\WinNotif.exe"=
    "c:\\Program Files\\AIM6\\aim6.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    R0 TVALDX;Toshiba ACPI-Based Value Added Logical Device Extension Driver;c:\windows\system32\drivers\TVALDX.SYS [7/25/2002 1:54 PM 6082]
    R2 Tmesbs;Tmesbs32;c:\program files\Toshiba\TME3\tmesbs32.exe [8/5/2002 7:10 PM 77824]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/27/2009 9:10 PM 101936]
    S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [3/14/2007 10:48 PM 116416]
    S3 toslane;Toshiba BT-LANE;c:\windows\system32\drivers\tosrflan.sys [2/7/2002 7:24 PM 25420]

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
    .
    Contents of the 'Scheduled Tasks' folder

    2009-05-04 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-Aim6 - (no file)
    HKLM-Run-AAWTray - c:\program files\Lavasoft\Ad-Aware 2007\AAWTray.exe
    HKLM-Run-TcmTray - (no file)


    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/ig?hl=en
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://www.shockwave.com/content/doggiedash/sis/DoggieDash.1.0.0.6.cab
    FF - ProfilePath - c:\documents and settings\Katie Dong\Application Data\Mozilla\Firefox\Profiles\p1rsz0ax.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en
    FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
    FF - plugin: c:\documents and settings\Katie Dong\Application Data\Mozilla\Firefox\Profiles\p1rsz0ax.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
    FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-05-06 12:32
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(944)
    c:\windows\system32\athgina.dll
    c:\windows\system32\athcfg11.dll
    c:\windows\system32\athcfg11Res.dll
    .
    Completion time: 2009-05-06 12:35
    ComboFix-quarantined-files.txt 2009-05-06 16:34

    Pre-Run: 31,291,203,584 bytes free
    Post-Run: 32,754,552,832 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

    194 --- E O F --- 2009-04-17 14:22



    DDS (Ver_09-03-16.01) - NTFSx86
    Run by Katie Dong at 12:41:46.34 on Wed 05/06/2009
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.30 [GMT -4:00]

    AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\acs.exe
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Katie Dong\Desktop\dds.com

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/ig?hl=en
    BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\acrobat\activex\AcroIEHelper.dll
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
    BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
    EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
    EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
    mRun: [00THotkey] c:\windows\system32\00THotkey.exe
    mRun: [000StTHK] 000StTHK.exe
    mRun: [TFNF5] TFNF5.exe
    mRun: [Tpwrtray] TPWRTRAY.EXE
    mRun: [TosHKCW.exe] "c:\program files\toshiba\wireless hotkey\TosHKCW.exe"
    mRun: [ezShieldProtector for Px] c:\windows\system32\ezSP_Px.exe
    mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe
    mRun: [TFncKy] TFncKy.exe /Type 03
    mRun: [TDispVol] TDispVol.exe
    mRun: [TMESBS.EXE] c:\program files\toshiba\tme3\TMESBS32.EXE /Client
    mRun: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    mRun: [nwiz] nwiz.exe /installquiet
    mRun: [TouchED] c:\program files\toshiba\touched\TouchED.Exe
    mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
    mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
    mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
    mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    mRun: [IMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE
    mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
    mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
    mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\acrobat 6.0\distillr\acrotray.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{4c271126-c295-4828-a901-5910ae0c258b}\Icon3E5562ED7.ico
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1190488614312
    DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://www.shockwave.com/content/doggiedash/sis/DoggieDash.1.0.0.6.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
    Notify: NavLogon - c:\windows\system32\NavLogon.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\katied~1\applic~1\mozilla\firefox\profiles\p1rsz0ax.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en
    FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
    FF - plugin: c:\documents and settings\katie dong\application data\mozilla\firefox\profiles\p1rsz0ax.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

    ============= SERVICES / DRIVERS ===============

    R0 TVALDX;Toshiba ACPI-Based Value Added Logical Device Extension Driver;c:\windows\system32\drivers\TVALDX.SYS [2002-7-25 6082]
    R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]
    R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
    R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-11-21 192104]
    R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-11-21 169576]
    R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2007-3-14 1816768]
    R2 Tmesbs;Tmesbs32;c:\program files\toshiba\tme3\tmesbs32.exe [2002-8-5 77824]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-27 101936]
    R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090424.003\naveng.sys [2009-4-24 89104]
    R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090424.003\navex15.sys [2009-4-24 876144]
    S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2007-3-14 116416]
    S3 toslane;Toshiba BT-LANE;c:\windows\system32\drivers\tosrflan.sys [2002-2-7 25420]
    S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]

    =============== Created Last 30 ================

    2009-05-06 12:16 <DIR> a-dshr-- C:\cmdcons
    2009-05-06 12:15 161,792 a------- c:\windows\SWREG.exe
    2009-05-06 12:15 98,816 a------- c:\windows\sed.exe
    2009-05-06 12:15 <DIR> --d----- C:\ComboFix
    2009-05-06 09:27 <DIR> --dsh--- c:\documents and settings\katie dong\IETldCache
    2009-05-06 09:20 <DIR> --d----- c:\windows\ie8updates
    2009-05-06 09:16 <DIR> -cd-h--- c:\windows\ie8
    2009-05-06 09:16 105,984 -c------ c:\windows\system32\dllcache\iecompat.dll
    2009-05-06 09:10 <DIR> --d----- c:\documents and settings\katie dong\Shared
    2009-05-06 09:10 <DIR> --d----- c:\documents and settings\katie dong\Incomplete
    2009-05-06 09:09 <DIR> --d----- c:\docume~1\katied~1\applic~1\LimeWire
    2009-05-06 09:08 410,984 a------- c:\windows\system32\deploytk.dll
    2009-05-06 09:04 <DIR> --d----- c:\docume~1\alluse~1\applic~1\acccore
    2009-05-06 09:03 <DIR> --d----- c:\program files\AIM6
    2009-05-05 17:03 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
    2009-05-05 16:57 <DIR> --d----- c:\program files\Spybot - Search & Destroy
    2009-05-05 16:51 <DIR> --d----- c:\program files\Trend Micro
    2009-05-05 13:40 <DIR> --d----- c:\docume~1\katied~1\applic~1\Malwarebytes
    2009-05-05 13:34 15,504 a------- c:\windows\system32\drivers\mbam.sys
    2009-05-05 13:34 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-05-05 13:34 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
    2009-05-05 13:34 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2009-04-16 13:50 284,160 -c------ c:\windows\system32\dllcache\pdh.dll
    2009-04-16 13:50 401,408 -c------ c:\windows\system32\dllcache\rpcss.dll
    2009-04-16 13:50 110,592 -c------ c:\windows\system32\dllcache\services.exe
    2009-04-16 13:50 473,600 -c------ c:\windows\system32\dllcache\fastprox.dll
    2009-04-16 13:50 227,840 -c------ c:\windows\system32\dllcache\wmiprvse.exe
    2009-04-16 13:50 453,120 -c------ c:\windows\system32\dllcache\wmiprvsd.dll
    2009-04-16 13:50 729,088 -c------ c:\windows\system32\dllcache\lsasrv.dll
    2009-04-16 13:50 617,472 -c------ c:\windows\system32\dllcache\advapi32.dll
    2009-04-16 13:50 714,752 -c------ c:\windows\system32\dllcache\ntdll.dll
    2009-04-16 13:49 2,560 -------- c:\windows\system32\xpsp4res.dll
    2009-04-16 13:49 1,203,922 -c------ c:\windows\system32\dllcache\sysmain.sdb
    2009-04-16 13:49 215,552 -c------ c:\windows\system32\dllcache\wordpad.exe
    2009-04-06 18:12 <DIR> --d----- c:\program files\iPod
    2009-04-06 18:11 <DIR> --d----- c:\program files\iTunes
    2009-04-06 18:11 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

    ==================== Find3M ====================

    2009-03-20 14:50 3,358,720 a------- c:\windows\system32\GPhotos.scr
    2009-03-19 16:32 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
    2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
    2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
    2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
    2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
    2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
    2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
    2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll
    2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll
    2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe
    2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
    2009-03-06 10:22 284,160 a------- c:\windows\system32\pdh.dll
    2009-02-09 08:10 729,088 a------- c:\windows\system32\lsasrv.dll
    2009-02-09 08:10 714,752 a------- c:\windows\system32\ntdll.dll
    2009-02-09 08:10 617,472 a------- c:\windows\system32\advapi32.dll
    2009-02-09 08:10 401,408 a------- c:\windows\system32\rpcss.dll
    2009-02-09 07:13 1,846,784 a------- c:\windows\system32\win32k.sys
    2009-02-07 19:02 2,066,048 a------- c:\windows\system32\ntkrnlpa.exe
    2009-02-06 07:11 110,592 a------- c:\windows\system32\services.exe
    2009-02-06 07:08 2,189,056 a------- c:\windows\system32\ntoskrnl.exe
    2009-02-06 06:39 35,328 a------- c:\windows\system32\sc.exe
    2008-05-07 20:36 39,280 ac------ c:\docume~1\katied~1\applic~1\GDIPFONTCACHEV1.DAT
    2008-09-14 14:57 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091420080915\index.dat

    ============= FINISH: 12:42:20.83 ===============
  6. 2009-05-06, 18:49 #6
    ihatemalware
    ihatemalware is offline
    Junior Member
    Join Date
    May 2009
    Posts
    15

    Default

    hmm i just did some random google searches and clicked around for a bit. haven't been redirected yet... AMAZING!!!!

    this may be the happiest day of my life!
  7. 2009-05-07, 17:23 #7
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Good to hear that symptoms are disappearing However, there're still some steps to take.



    Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:
    • Run Spybot-S&D in Advanced Mode
    • If it is not already set to do this, go to the Mode menu
      select
      Advanced Mode
    • On the left hand side, click on Tools
    • Then click on the Resident icon in the list
    • Uncheck
      Resident TeaTimer
       and OK any prompts.
    • Restart your computer



    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    Folder::
c:\documents and settings\Katie Dong\Application Data\LimeWire

DDS::
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=-

    Save this as
    CFScript

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.



    Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
    Then post the resultant log.


    Combofix should never take more that 20 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    If that happened we want to know, and also what process you had to end.


    Uninstall old Adobe Reader versions and get the latest one here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader!


    Uninstall Java(TM) 6 Update 2 and Adobe Flash Player 9 ActiveX.



    Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

    Double-click ATF Cleaner.exe to open it

    Under Main choose:
    Windows Temp
    Current User Temp
    All Users Temp
    Cookies
    Temporary Internet Files
    Prefetch
    Java Cache
    *The other boxes are optional*
    Then click the Empty Selected button.

    If you use Firefox:
    Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    If you use Opera:
    Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    Click Exit on the Main menu to close the program.


    Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.


    Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
  8. 2009-05-07, 21:47 #8
    ihatemalware
    ihatemalware is offline
    Junior Member
    Join Date
    May 2009
    Posts
    15

    Default

    i got through all the steps except Kaspersky online scanner. i started it before i left home this morning, came back 4 hours later and it was still updating slowly... this computer is old but is generally not that slow and i've pretty fast cable connection... i gave up and stopped it for now. is there a problem...?
  9. 2009-05-08, 15:56 #9
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    i got through all the steps except Kaspersky online scanner. i started it before i left home this morning, came back 4 hours later and it was still updating slowly
    Hi

    Do you mean that it was updating or scanning? Scanning may take quite a long time if there's lots of files on hard drive and if it hasn't been defragmented lately. Antivirus protection running background may also slow down the process.

    If it was updating then program should had given some error message if it couldn't connect the server.

    If Kaspersky online scanner still doesn't run then let's try ESET online scanner.


    * Go here to run an online scanner from ESET.
    • Note: You will need to use Internet explorer for this scan
    • Tick the box next to YES, I accept the Terms of Use.
    • Click Start
    • When asked, allow the activex control to install
    • Click Start
    • Make sure that the option Remove found threats is UNchecked and the option Scan unwanted applications is checkmarked.
    • Click Scan
    • Wait for the scan to finish
    • Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
    • Copy and paste that log as a reply to this topic, along with other logs requested for in previous post.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
  10. 2009-05-09, 00:36 #10
    ihatemalware
    ihatemalware is offline
    Junior Member
    Join Date
    May 2009
    Posts
    15

    Default

    kasperksy was still really slow (updating, not scanning), so i ran ESET instead.

    here are the logs: ESET, ComboFix, DDS. in that order.


    ESETSmartInstaller@High as CAB hook log:
    OnlineScanner.ocx - registred OK
    Language set:1033
    # version=3
    # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
    # OnlineScanner.ocx=1.0.0.5286
    # api_version=3.0.2
    # EOSSerial=
    # end=finished
    # remove_checked=false
    # archives_checked=false
    # unwanted_checked=true
    # unsafe_checked=false
    # antistealth_checked=true
    # utc_time=2009-05-08 10:23:49
    # local_time=2009-05-08 06:23:49 (-0500, Eastern Daylight Time)
    # country="United States"
    # osver=5.1.2600 NT Service Pack 3
    # conflict_mask=8
    # scanned=63039
    # found=0
    # cleaned=0
    # scan_time=6174




    ComboFix 09-05-06.08 - Katie Dong 05/07/2009 11:44.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.126 [GMT -4:00]
    Running from: c:\documents and settings\Katie Dong\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Katie Dong\Desktop\CFScript.txt
    AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated)
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Katie Dong\Application Data\LimeWire
    c:\documents and settings\Katie Dong\Application Data\LimeWire\414splashfree.png
    c:\documents and settings\Katie Dong\Application Data\LimeWire\createtimes.cache
    c:\documents and settings\Katie Dong\Application Data\LimeWire\fileurns.cache
    c:\documents and settings\Katie Dong\Application Data\LimeWire\gnutella.net
    c:\documents and settings\Katie Dong\Application Data\LimeWire\installation.props
    c:\documents and settings\Katie Dong\Application Data\LimeWire\library.dat
    c:\documents and settings\Katie Dong\Application Data\LimeWire\limewire.props
    c:\documents and settings\Katie Dong\Application Data\LimeWire\mojito.props
    c:\documents and settings\Katie Dong\Application Data\LimeWire\questions.props
    c:\documents and settings\Katie Dong\Application Data\LimeWire\responses.cache
    c:\documents and settings\Katie Dong\Application Data\LimeWire\simpp.xml
    c:\documents and settings\Katie Dong\Application Data\LimeWire\spam.dat
    c:\documents and settings\Katie Dong\Application Data\LimeWire\tables.props
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme.lwtp
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\01_star.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\02_star.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\03_star.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\04_star.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\05_star.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\chat.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\forward_dn.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\forward_up.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\kill.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\kill_on.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\logo.png
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\notsearching.png
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\pause_dn.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\pause_up.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\play_dn.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\play_up.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\question.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\rewind_dn.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\rewind_up.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\searching.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\splash.png
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\splashpro.png
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\stop_dn.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\stop_up.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\theme.txt
    c:\documents and settings\Katie Dong\Application Data\LimeWire\themes\windows_theme\warning.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\version.xml
    c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\data\delete_me
    c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\misc\application.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\misc\audio.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\misc\document.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\misc\image.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\misc\video.gif
    c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\schemas\application.xsd
    c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\schemas\audio.xsd
    c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\schemas\document.xsd
    c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\schemas\image.xsd
    c:\documents and settings\Katie Dong\Application Data\LimeWire\xml\schemas\video.xsd

    .
    ((((((((((((((((((((((((( Files Created from 2009-04-07 to 2009-05-07 )))))))))))))))))))))))))))))))
    .

    2009-05-06 16:48 . 2009-05-06 16:48 -------- d-sh--w c:\documents and settings\Katie Dong\PrivacIE
    2009-05-06 13:27 . 2009-05-06 13:27 -------- d-sh--w c:\documents and settings\Katie Dong\IETldCache
    2009-05-06 13:20 . 2009-05-06 13:20 -------- d-----w c:\windows\ie8updates
    2009-05-06 13:16 . 2009-05-06 13:18 -------- dc-h--w c:\windows\ie8
    2009-05-06 13:16 . 2009-02-28 04:55 105984 -c----w c:\windows\system32\dllcache\iecompat.dll
    2009-05-06 13:10 . 2009-05-06 13:10 -------- d-----w c:\documents and settings\Katie Dong\Shared
    2009-05-06 13:10 . 2009-05-06 13:11 -------- d-----w c:\documents and settings\Katie Dong\Incomplete
    2009-05-06 13:08 . 2009-05-06 13:07 410984 ----a-w c:\windows\system32\deploytk.dll
    2009-05-06 13:05 . 2009-05-06 13:05 -------- d-----w c:\documents and settings\Katie Dong\Application Data\acccore
    2009-05-06 13:04 . 2009-05-06 13:04 -------- d-----w c:\documents and settings\Katie Dong\Local Settings\Application Data\AOL OCP
    2009-05-06 13:04 . 2009-05-06 13:04 -------- d-----w c:\documents and settings\Katie Dong\Local Settings\Application Data\AOL
    2009-05-06 13:04 . 2009-05-06 13:04 -------- d-----w c:\documents and settings\All Users\Application Data\acccore
    2009-05-06 13:03 . 2009-05-06 13:04 -------- d-----w c:\program files\AIM6
    2009-05-05 21:03 . 2009-05-05 21:38 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-05-05 20:57 . 2009-05-05 21:24 -------- d-----w c:\program files\Spybot - Search & Destroy
    2009-05-05 20:51 . 2009-05-05 20:51 -------- d-----w c:\program files\Trend Micro
    2009-05-05 17:40 . 2009-05-05 17:40 -------- d-----w c:\documents and settings\Katie Dong\Application Data\Malwarebytes
    2009-05-05 17:34 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
    2009-05-05 17:34 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
    2009-05-05 17:34 . 2009-05-05 17:34 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-05-05 17:34 . 2009-05-05 20:05 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
    2009-04-16 17:50 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
    2009-04-16 17:50 . 2009-02-09 12:10 401408 -c----w c:\windows\system32\dllcache\rpcss.dll
    2009-04-16 17:50 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe
    2009-04-16 17:50 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll
    2009-04-16 17:50 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
    2009-04-16 17:50 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
    2009-04-16 17:50 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll
    2009-04-16 17:50 . 2009-02-09 12:10 617472 -c----w c:\windows\system32\dllcache\advapi32.dll
    2009-04-16 17:50 . 2009-02-09 12:10 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
    2009-04-16 17:49 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
    2009-04-16 17:49 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-05-07 15:42 . 2007-09-22 22:33 -------- d-----w c:\program files\Symantec AntiVirus
    2009-05-06 13:07 . 2007-09-22 21:48 -------- d-----w c:\program files\Java
    2009-05-06 13:03 . 2007-09-22 21:17 -------- d-----w c:\program files\Common Files\AOL
    2009-04-06 22:14 . 2009-04-06 22:11 -------- d-----w c:\program files\iTunes
    2009-04-06 22:12 . 2009-04-06 22:12 -------- d-----w c:\program files\iPod
    2009-04-06 22:12 . 2007-09-22 22:01 -------- d-----w c:\program files\Common Files\Apple
    2009-03-23 21:59 . 2007-09-22 22:02 -------- d-----w c:\program files\QuickTime
    2009-03-20 18:50 . 2009-03-20 18:50 3358720 ----a-w c:\windows\system32\GPhotos.scr
    2009-03-19 20:32 . 2008-01-29 16:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
    2009-03-08 08:34 . 2002-03-05 16:56 914944 ----a-w c:\windows\system32\wininet.dll
    2009-03-08 08:34 . 2002-07-23 23:24 43008 ----a-w c:\windows\system32\licmgr10.dll
    2009-03-08 08:33 . 2002-07-23 23:23 18944 ----a-w c:\windows\system32\corpol.dll
    2009-03-08 08:33 . 2002-02-26 21:58 420352 ----a-w c:\windows\system32\vbscript.dll
    2009-03-08 08:32 . 2002-07-23 23:23 72704 ----a-w c:\windows\system32\admparse.dll
    2009-03-08 08:32 . 2002-07-23 23:24 71680 ----a-w c:\windows\system32\iesetup.dll
    2009-03-08 08:31 . 2002-07-23 23:24 34816 ----a-w c:\windows\system32\imgutil.dll
    2009-03-08 08:31 . 2002-07-23 23:24 48128 ----a-w c:\windows\system32\mshtmler.dll
    2009-03-08 08:31 . 2002-07-23 23:24 45568 ----a-w c:\windows\system32\mshta.exe
    2009-03-08 08:22 . 2002-07-23 23:24 156160 ----a-w c:\windows\system32\msls31.dll
    2009-03-06 14:22 . 2002-07-23 23:24 284160 ----a-w c:\windows\system32\pdh.dll
    2009-02-09 12:10 . 2002-07-23 23:24 729088 ----a-w c:\windows\system32\lsasrv.dll
    2009-02-09 12:10 . 2007-09-22 19:34 401408 ----a-w c:\windows\system32\rpcss.dll
    2009-02-09 12:10 . 2002-07-23 23:24 714752 ----a-w c:\windows\system32\ntdll.dll
    2009-02-09 12:10 . 2002-07-23 23:23 617472 ----a-w c:\windows\system32\advapi32.dll
    2009-02-09 11:13 . 2002-07-23 23:25 1846784 ----a-w c:\windows\system32\win32k.sys
    2009-02-07 23:02 . 2001-08-17 13:48 2066048 ----a-w c:\windows\system32\ntkrnlpa.exe
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-05-06_16.32.28 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-05-07 15:37 . 2009-05-07 15:37 16384 c:\windows\Temp\Perflib_Perfdata_118.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="NvQTwk" [X]
    "00THotkey"="c:\windows\System32\00THotkey.exe" [2002-04-16 01:35 249856]
    "TosHKCW.exe"="c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2002-01-23 49152]
    "ezShieldProtector for Px"="c:\windows\System32\ezSP_Px.exe" [2002-08-20 40960]
    "LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2002-05-31 163840]
    "TMESBS.EXE"="c:\program files\TOSHIBA\TME3\TMESBS32.EXE" [2002-08-02 77824]
    "TouchED"="c:\program files\TOSHIBA\TouchED\TouchED.Exe" [2002-07-09 126976]
    "Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2001-11-14 147456]
    "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2002-08-16 126976]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2002-08-16 557056]
    "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-11-22 52840]
    "vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2007-03-15 125632]
    "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
    "IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2001-08-18 44032]
    "MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
    "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
    "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-12-07 185872]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-06 148888]
    "000StTHK"="000StTHK.exe" - c:\windows\system32\000StTHK.exe [2001-06-24 03:28 24576]
    "TFNF5"="TFNF5.exe" - c:\windows\system32\TFNF5.exe [2002-06-26 73728]
    "TFncKy"="TFncKy.exe" [BU]
    "TDispVol"="TDispVol.exe" - c:\windows\system32\TDispVol.exe [2002-03-02 98304]
    "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2002-08-15 438272]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-4-7 217190]
    VPN Client.lnk - c:\windows\Installer\{4C271126-C295-4828-A901-5910AE0C258B}\Icon3E5562ED7.ico [2008-10-13 6144]

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\WINDOWS\\Blitz\\WinNotif.exe"=
    "c:\\Program Files\\AIM6\\aim6.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    R0 TVALDX;Toshiba ACPI-Based Value Added Logical Device Extension Driver;c:\windows\system32\drivers\TVALDX.SYS [7/25/2002 1:54 PM 6082]
    R2 Tmesbs;Tmesbs32;c:\program files\Toshiba\TME3\tmesbs32.exe [8/5/2002 7:10 PM 77824]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/27/2009 9:10 PM 101936]
    S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [3/14/2007 10:48 PM 116416]
    S3 toslane;Toshiba BT-LANE;c:\windows\system32\drivers\tosrflan.sys [2/7/2002 7:24 PM 25420]

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
    .
    Contents of the 'Scheduled Tasks' folder

    2009-05-04 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/ig?hl=en
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://www.shockwave.com/content/doggiedash/sis/DoggieDash.1.0.0.6.cab
    FF - ProfilePath - c:\documents and settings\Katie Dong\Application Data\Mozilla\Firefox\Profiles\p1rsz0ax.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en
    FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
    FF - plugin: c:\documents and settings\Katie Dong\Application Data\Mozilla\Firefox\Profiles\p1rsz0ax.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
    FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-05-07 11:48
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(944)
    c:\windows\system32\athgina.dll
    c:\windows\system32\athcfg11.dll
    c:\windows\system32\athcfg11Res.dll
    .
    Completion time: 2009-05-07 11:52
    ComboFix-quarantined-files.txt 2009-05-07 15:51
    ComboFix2.txt 2009-05-06 16:35

    Pre-Run: 32,699,383,808 bytes free
    Post-Run: 32,698,560,512 bytes free

    228 --- E O F --- 2009-04-17 14:22





    DDS (Ver_09-03-16.01) - NTFSx86
    Run by Katie Dong at 18:31:33.11 on Fri 05/08/2009
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.126 [GMT -4:00]

    AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated)

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    svchost.exe
    svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\acs.exe
    svchost.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\System32\00THotkey.exe
    C:\WINDOWS\system32\TFNF5.exe
    C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
    C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
    C:\WINDOWS\System32\ezSP_Px.exe
    C:\Program Files\ltmoh\Ltmoh.exe
    C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
    C:\WINDOWS\system32\TDispVol.exe
    C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
    C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\toshiba\ivp\ism\ivpsvmgr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Katie Dong\Desktop\dds.com

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/ig?hl=en
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
    BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll
    BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
    BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
    EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
    EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [00THotkey] c:\windows\system32\00THotkey.exe
    mRun: [000StTHK] 000StTHK.exe
    mRun: [TFNF5] TFNF5.exe
    mRun: [TosHKCW.exe] "c:\program files\toshiba\wireless hotkey\TosHKCW.exe"
    mRun: [ezShieldProtector for Px] c:\windows\system32\ezSP_Px.exe
    mRun: [LtMoh] c:\program files\ltmoh\Ltmoh.exe
    mRun: [TFncKy] TFncKy.exe /Type 03
    mRun: [TDispVol] TDispVol.exe
    mRun: [TMESBS.EXE] c:\program files\toshiba\tme3\TMESBS32.EXE /Client
    mRun: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
    mRun: [nwiz] nwiz.exe /installquiet
    mRun: [TouchED] c:\program files\toshiba\touched\TouchED.Exe
    mRun: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
    mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
    mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
    mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
    mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
    mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    mRun: [IMEKRMIG6.1] c:\windows\ime\imkr6_1\IMEKRMIG.EXE
    mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC
    mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
    mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
    mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\acrobat 6.0\distillr\acrotray.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\vpncli~1.lnk - c:\windows\installer\{4c271126-c295-4828-a901-5910ae0c258b}\Icon3E5562ED7.ico
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
    IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
    DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1190488614312
    DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} - hxxp://www.shockwave.com/content/doggiedash/sis/DoggieDash.1.0.0.6.cab
    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos-beta/OnlineScanner.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
    Notify: NavLogon - c:\windows\system32\NavLogon.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\katied~1\applic~1\mozilla\firefox\profiles\p1rsz0ax.default\
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en
    FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll
    FF - plugin: c:\documents and settings\katie dong\application data\mozilla\firefox\profiles\p1rsz0ax.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

    ============= SERVICES / DRIVERS ===============

    R0 TVALDX;Toshiba ACPI-Based Value Added Logical Device Extension Driver;c:\windows\system32\drivers\TVALDX.SYS [2002-7-25 6082]
    R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]
    R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-27 101936]
    R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090424.003\naveng.sys [2009-4-24 89104]
    R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090424.003\navex15.sys [2009-4-24 876144]
    S3 toslane;Toshiba BT-LANE;c:\windows\system32\drivers\tosrflan.sys [2002-2-7 25420]
    S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]

    =============== Created Last 30 ================

    2009-05-08 16:37 <DIR> --d----- c:\program files\ESET
    2009-05-06 12:48 <DIR> --dsh--- c:\documents and settings\katie dong\PrivacIE
    2009-05-06 12:16 <DIR> a-dshr-- C:\cmdcons
    2009-05-06 12:15 161,792 a------- c:\windows\SWREG.exe
    2009-05-06 12:15 98,816 a------- c:\windows\sed.exe
    2009-05-06 09:27 <DIR> --dsh--- c:\documents and settings\katie dong\IETldCache
    2009-05-06 09:20 <DIR> --d----- c:\windows\ie8updates
    2009-05-06 09:16 <DIR> -cd-h--- c:\windows\ie8
    2009-05-06 09:16 105,984 -c------ c:\windows\system32\dllcache\iecompat.dll
    2009-05-06 09:10 <DIR> --d----- c:\documents and settings\katie dong\Shared
    2009-05-06 09:10 <DIR> --d----- c:\documents and settings\katie dong\Incomplete
    2009-05-06 09:08 410,984 a------- c:\windows\system32\deploytk.dll
    2009-05-06 09:04 <DIR> --d----- c:\docume~1\alluse~1\applic~1\acccore
    2009-05-06 09:03 <DIR> --d----- c:\program files\AIM6
    2009-05-05 17:03 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
    2009-05-05 16:57 <DIR> --d----- c:\program files\Spybot - Search & Destroy
    2009-05-05 16:51 <DIR> --d----- c:\program files\Trend Micro
    2009-05-05 13:40 <DIR> --d----- c:\docume~1\katied~1\applic~1\Malwarebytes
    2009-05-05 13:34 15,504 a------- c:\windows\system32\drivers\mbam.sys
    2009-05-05 13:34 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-05-05 13:34 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
    2009-05-05 13:34 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
    2009-04-16 13:50 284,160 -c------ c:\windows\system32\dllcache\pdh.dll
    2009-04-16 13:50 401,408 -c------ c:\windows\system32\dllcache\rpcss.dll
    2009-04-16 13:50 110,592 -c------ c:\windows\system32\dllcache\services.exe
    2009-04-16 13:50 473,600 -c------ c:\windows\system32\dllcache\fastprox.dll
    2009-04-16 13:50 227,840 -c------ c:\windows\system32\dllcache\wmiprvse.exe
    2009-04-16 13:50 453,120 -c------ c:\windows\system32\dllcache\wmiprvsd.dll
    2009-04-16 13:50 729,088 -c------ c:\windows\system32\dllcache\lsasrv.dll
    2009-04-16 13:50 617,472 -c------ c:\windows\system32\dllcache\advapi32.dll
    2009-04-16 13:50 714,752 -c------ c:\windows\system32\dllcache\ntdll.dll
    2009-04-16 13:49 2,560 -------- c:\windows\system32\xpsp4res.dll
    2009-04-16 13:49 1,203,922 -c------ c:\windows\system32\dllcache\sysmain.sdb
    2009-04-16 13:49 215,552 -c------ c:\windows\system32\dllcache\wordpad.exe

    ==================== Find3M ====================

    2009-03-20 14:50 3,358,720 a------- c:\windows\system32\GPhotos.scr
    2009-03-19 16:32 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
    2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
    2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
    2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
    2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
    2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
    2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
    2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll
    2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll
    2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe
    2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
    2009-03-06 10:22 284,160 a------- c:\windows\system32\pdh.dll
    2009-02-09 08:10 729,088 a------- c:\windows\system32\lsasrv.dll
    2009-02-09 08:10 714,752 a------- c:\windows\system32\ntdll.dll
    2009-02-09 08:10 617,472 a------- c:\windows\system32\advapi32.dll
    2009-02-09 08:10 401,408 a------- c:\windows\system32\rpcss.dll
    2009-02-09 07:13 1,846,784 a------- c:\windows\system32\win32k.sys
    2009-02-07 19:02 2,066,048 a------- c:\windows\system32\ntkrnlpa.exe
    2008-05-07 20:36 39,280 ac------ c:\docume~1\katied~1\applic~1\GDIPFONTCACHEV1.DAT
    2008-09-14 14:57 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091420080915\index.dat

    ============= FINISH: 18:33:03.43 ===============
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules