Spyware / Malware / Virus Removal

[Resolved] inetinfo.exe crashes

21 min read

Looking for the outcome? Ask AI

CatByte

Post #16June 15, 2009, 1:35 PM UTC last edited June 16, 2009, 1:48 AM UTC

Hi

Please do the following:

IMPORTANT: Please allow ComboFix to update when it asks

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/inetinfo_exe_crashes_t103987.html&view=findpost&p=568248#entry568248

Collect::
c:\windows\inetinfo.exe
c:\windows\system32\MaxBSLoad.exe
c:\windows\system32\drivers\etc\networks.exe
C:\SysWin32.exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="-
"MaxBSLoad"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"inetinfo"=-

DDS::
uInternet Settings,ProxyOverride =

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

lin0056

Post #17June 16, 2009, 6:41 AM UTC

ComboFix 09-06-15.06 - 12LinNZ 16/06/2009 16:33.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.1977.1407 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\12linnz\Desktop\CFScript.txt
AV: Sophos Anti-Virus *On-access scanning disabled* (Updated) {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}

file zipped: C:\SysWin32.exe
file zipped: c:\windows\inetinfo.exe
file zipped: c:\windows\system32\drivers\etc\networks.exe
file zipped: c:\windows\system32\MaxBSLoad.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
C:\SysWin32.exe
c:\windows\ctfmon.exe
c:\windows\inetinfo.exe
c:\windows\system32\drivers\etc\networks.exe
c:\windows\system32\MaxBSLoad.exe
c:\windows\winlogon.exe

.
((((((((((((((((((((((((( Files Created from 2009-05-16 to 2009-06-16 )))))))))))))))))))))))))))))))
.

2009-06-16 02:14 . 2009-06-16 02:15 ——– dc—-w- c:\documents and settings\All Users\AdobeTemp
2009-06-15 11:14 . 2009-06-15 11:14 ——– dc—-w- C:\_OTM
2009-06-14 12:20 . 2009-06-14 12:20 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Malwarebytes
2009-06-14 12:20 . 2009-05-26 03:20 40160 -c–a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-14 12:20 . 2009-06-14 12:20 ——– dc—-w- c:\program files\Malwarebytes' Anti-Malware
2009-06-14 12:20 . 2009-06-14 12:20 ——– dc—-w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-14 12:20 . 2009-05-26 03:19 19096 -c–a-w- c:\windows\system32\drivers\mbam.sys
2009-06-14 12:20 . 2009-06-14 12:20 ——– dc—-w- C:\Rooter$
2009-06-13 13:22 . 2009-06-14 07:44 ——– dc—-w- C:\finalburner
2009-06-13 13:08 . 2009-06-13 13:09 ——– dc—-w- c:\program files\FinalBurner
2009-06-13 12:20 . 2009-06-13 12:20 ——– dc—-w- c:\program files\Common Files\xing shared
2009-06-11 21:10 . 2009-06-11 21:10 ——– dc—-w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-06-10 13:09 . 2009-06-10 13:09 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Red Kawa
2009-06-09 22:59 . 2009-06-10 04:54 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Google
2009-06-09 22:59 . 2009-06-09 22:59 ——– dc—-w- c:\program files\Google
2009-06-09 22:55 . 2009-06-09 22:52 130104 -c–a-w- c:\windows\system32\sdccoinstaller.dll
2009-06-09 22:54 . 2009-06-09 22:54 ——– dc—-w- c:\program files\Common Files\Cisco Systems
2009-06-09 22:54 . 2009-06-09 22:52 23552 -c–a-w- c:\windows\system32\sophosboottasks.exe
2009-06-09 22:53 . 2009-06-09 22:54 ——– dc—-w- c:\documents and settings\All Users\Application Data\Sophos
2009-06-09 22:52 . 2009-06-09 22:52 14976 -c–a-w- c:\windows\system32\drivers\SophosBootDriver.sys
2009-06-09 22:52 . 2009-06-09 22:52 38528 -c–a-w- c:\windows\system32\drivers\savonaccessfilter.sys
2009-06-09 22:52 . 2009-06-09 22:52 110848 -c–a-w- c:\windows\system32\drivers\savonaccesscontrol.sys
2009-06-09 22:50 . 2009-06-09 22:54 ——– dc—-w- c:\program files\Sophos
2009-06-09 13:55 . 2009-06-09 13:55 664 -c–a-w- c:\windows\system32\d3d9caps.dat
2009-06-09 13:18 . 2009-06-09 13:18 ——– dc—-w- c:\program files\Regensoft
2009-06-09 13:18 . 2009-06-09 13:18 ——– dc—-w- c:\program files\Red Kawa
2009-06-09 07:39 . 2004-08-18 02:14 442368 -c–a-w- c:\windows\system32\vp6vfw.dll
2009-06-07 08:17 . 2009-06-07 10:39 ——– dc—-w- c:\program files\Universal Forum Poster
2009-06-07 08:17 . 2009-06-07 08:17 ——– dc—-w- c:\windows\Universal Forum Poster
2009-06-07 04:21 . 2009-06-07 04:21 ——– dc—-w- c:\documents and settings\12linnz\Application Data\WindowsApplication1
2009-06-07 04:02 . 2009-06-07 04:04 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Media Player Classic
2009-06-07 03:43 . 2009-06-08 00:31 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Deployment
2009-06-07 01:15 . 2009-06-07 01:15 ——– dc—-w- c:\documents and settings\12linnz\Application Data\CyberLink
2009-06-04 23:32 . 2009-06-13 12:20 ——– dc—-w- c:\program files\Common Files\Real
2009-06-04 23:31 . 2009-06-04 23:31 ——– dc—-w- c:\program files\Real
2009-06-03 01:12 . 2001-08-17 12:36 5632 -c–a-w- c:\windows\system32\ptpusb.dll
2009-06-03 01:12 . 2008-04-13 19:42 159232 -c–a-w- c:\windows\system32\ptpusd.dll
2009-06-03 01:12 . 2008-04-13 14:15 15104 -c–a-w- c:\windows\system32\drivers\usbscan.sys
2009-06-03 01:12 . 2008-04-13 14:15 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys
2009-06-01 09:32 . 2009-06-01 09:32 ——– dc—-w- c:\windows\system32\wbem\Repository
2009-06-01 09:18 . 2009-06-01 09:18 ——– dc—-w- c:\windows\LastGood(2)
2009-05-31 10:44 . 2009-05-31 10:44 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Uniblue
2009-05-29 02:21 . 2009-05-29 02:21 ——– dc—-w- c:\documents and settings\12linnz\Bluetooth Software
2009-05-28 06:34 . 2009-05-28 06:34 ——– dc—-w- c:\program files\LibUSB-Win32
2009-05-28 06:34 . 2007-03-20 01:33 28672 -c–a-w- c:\windows\system32\drivers\libusb0.sys
2009-05-28 06:34 . 2007-03-20 01:33 43520 -c–a-w- c:\windows\system32\libusb0.dll
2009-05-28 06:33 . 2009-06-03 02:04 ——– dc—-w- c:\program files\QuickFreedom
2009-05-26 05:10 . 2009-05-26 05:10 ——– dc—-w- c:\documents and settings\12linnz\Application Data\DivX
2009-05-25 04:32 . 2009-02-20 18:09 268288 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2009-05-25 04:32 . 2009-02-20 18:09 63488 -c—-w- c:\windows\system32\dllcache\icardie.dll
2009-05-25 04:32 . 2009-02-20 18:09 52224 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-05-25 04:32 . 2009-02-20 10:20 13824 -c—-w- c:\windows\system32\dllcache\ieudinit.exe
2009-05-25 04:32 . 2009-02-20 18:09 459264 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2009-05-25 04:32 . 2008-07-09 14:25 2455488 -c—-w- c:\windows\system32\dllcache\ieapfltr.dat
2009-05-25 04:32 . 2009-02-20 18:09 383488 -c—-w- c:\windows\system32\dllcache\ieapfltr.dll
2009-05-25 04:31 . 2009-02-20 18:09 6066176 -c—-w- c:\windows\system32\dllcache\ieframe.dll
2009-05-24 11:34 . 2009-05-24 11:34 ——– dc—-w- c:\windows\system32\Adobe
2009-05-23 10:00 . 2009-05-23 10:00 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Leadertech
2009-05-22 01:57 . 2005-01-03 06:43 4682 -c–a-w- c:\windows\system32\npptNT2.sys
2009-05-22 01:56 . 2009-05-22 01:56 ——– dc—-w- c:\program files\Common Files\INCA Shared
2009-05-21 12:23 . 2009-05-21 12:23 ——– dc—-w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-21 09:24 . 2009-06-13 22:59 ——– dc—-w- c:\program files\EA Sports
2009-05-21 09:07 . 2009-05-21 09:07 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Sophos
2009-05-21 08:57 . 2009-05-21 08:57 721904 —-a-w- c:\windows\system32\drivers\sptd.sys
2009-05-21 08:57 . 2009-05-21 08:57 ——– dc—-w- c:\documents and settings\12linnz\Application Data\DAEMON Tools Lite
2009-05-21 08:53 . 2009-05-21 08:53 ——– dc-h–w- c:\windows\PIF
2009-05-21 08:47 . 2009-06-04 11:38 ——– dc—-w- c:\documents and settings\12linnz\Application Data\LimeWire
2009-05-21 08:44 . 2009-05-21 08:44 ——– dc—-w- c:\program files\PowerISO
2009-05-21 08:44 . 2009-05-21 08:44 ——– dc—-w- c:\program files\LimeWire
2009-05-21 08:37 . 2009-05-21 10:08 ——– dc—-w- c:\program files\Messenger Plus! Live
2009-05-21 08:33 . 2009-05-21 08:33 ——– dc—-w- c:\program files\uTorrent
2009-05-21 08:33 . 2009-06-15 05:07 ——– dc—-w- c:\documents and settings\12linnz\Application Data\uTorrent
2009-05-21 08:33 . 2009-05-28 07:37 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Apple Computer
2009-05-21 08:33 . 2009-03-19 06:32 23400 -c–a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-05-21 08:33 . 2008-04-17 02:12 107368 -c–a-w- c:\windows\system32\GEARAspi.dll
2009-05-21 08:32 . 2009-05-21 08:32 ——– dc—-w- c:\program files\iPod
2009-05-21 08:32 . 2009-05-21 08:33 ——– dc—-w- c:\program files\iTunes
2009-05-21 08:32 . 2009-05-21 08:33 ——– dc—-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-21 08:32 . 2009-05-21 08:32 ——– dc—-w- c:\program files\Bonjour
2009-05-21 08:31 . 2009-05-21 08:32 ——– dc—-w- c:\program files\QuickTime
2009-05-21 08:31 . 2009-05-21 08:32 ——– dc—-w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-05-21 08:31 . 2009-05-21 08:31 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Apple
2009-05-21 08:31 . 2009-05-21 08:31 ——– dc—-w- c:\program files\Apple Software Update
2009-05-21 08:31 . 2009-03-26 05:23 36864 -c–a-w- c:\windows\system32\drivers\usbaapl.sys
2009-05-21 08:31 . 2009-03-26 05:23 1900544 -c–a-w- c:\windows\system32\usbaaplrc.dll
2009-05-21 08:31 . 2009-05-21 08:32 ——– dc—-w- c:\program files\Common Files\Apple
2009-05-21 08:31 . 2009-05-21 08:31 ——– dc—-w- c:\documents and settings\All Users\Application Data\Apple
2009-05-21 08:30 . 2009-05-21 08:33 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Apple Computer
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\DVD Decrypter
2009-05-21 08:12 . 2009-05-21 08:12 43602 -c–a-w- c:\windows\system32\xvid-uninstall.exe
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\AviSynth 2.5
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\Gabest
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\AutoGK
2009-05-21 08:00 . 2009-06-16 06:27 ——– dc—-w- c:\documents and settings\12linnz\Tracing
2009-05-21 07:59 . 2009-05-21 07:59 ——– dc—-w- c:\program files\Microsoft Silverlight
2009-05-21 07:58 . 2009-05-21 07:59 ——– dc—-w- c:\program files\Microsoft
2009-05-21 07:58 . 2009-05-21 07:58 ——– dc—-w- c:\program files\Windows Live SkyDrive
2009-05-21 07:57 . 2009-05-21 07:58 ——– dc—-w- c:\program files\Windows Live
2009-05-21 07:55 . 2009-05-21 07:55 ——– dc—-w- c:\program files\Common Files\Windows Live
2009-05-21 07:55 . 2009-06-02 10:32 105544 -c–a-w- c:\documents and settings\12linnz\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-21 07:46 . 2008-04-13 14:15 10368 -c–a-w- c:\windows\system32\drivers\hidusb.sys
2009-05-21 07:46 . 2008-04-13 14:15 10368 -c–a-w- c:\windows\system32\dllcache\hidusb.sys
2009-05-21 05:19 . 2009-05-21 05:19 ——– dc—-w- c:\program files\Combined Community Codec Pack
2009-05-21 05:19 . 2009-05-21 05:19 ——– dc—-w- c:\program files\CCleaner
2009-05-21 05:14 . 2009-05-21 05:14 0 -c–a-w- c:\windows\nsreg.dat
2009-05-21 05:14 . 2009-05-21 05:14 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Mozilla
2009-05-21 05:01 . 2009-05-21 05:01 152576 -c–a-w- c:\documents and settings\12linnz\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-21 04:59 . 2009-05-21 04:59 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Microsoft Help
2009-05-21 04:59 . 2009-06-01 09:32 ——– dc—-w- c:\documents and settings\saaa
2009-05-21 04:57 . 2009-03-21 14:06 989696 -c—-w- c:\windows\system32\dllcache\kernel32.dll
2009-05-21 04:57 . 2009-02-03 19:59 56832 -c—-w- c:\windows\system32\dllcache\secur32.dll
2009-05-21 04:57 . 2008-12-05 06:54 144896 -c—-w- c:\windows\system32\dllcache\schannel.dll
2009-05-21 04:57 . 2009-03-06 14:22 284160 -c—-w- c:\windows\system32\dllcache\pdh.dll
2009-05-21 04:57 . 2009-02-09 12:10 401408 -c—-w- c:\windows\system32\dllcache\rpcss.dll
2009-05-21 04:57 . 2009-02-09 12:10 729088 -c—-w- c:\windows\system32\dllcache\lsasrv.dll
2009-05-21 04:57 . 2009-02-09 12:10 714752 -c—-w- c:\windows\system32\dllcache\ntdll.dll
2009-05-21 04:57 . 2009-02-09 12:10 617472 -c—-w- c:\windows\system32\dllcache\advapi32.dll
2009-05-21 04:57 . 2009-02-09 12:10 473600 -c—-w- c:\windows\system32\dllcache\fastprox.dll
2009-05-21 04:57 . 2009-02-09 12:10 453120 -c—-w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-21 04:57 . 2009-02-06 11:11 110592 -c—-w- c:\windows\system32\dllcache\services.exe
2009-05-21 04:56 . 2008-06-12 14:23 66560 -c—-w- c:\windows\system32\dllcache\mtxclu.dll
2009-05-21 04:56 . 2008-06-17 19:02 8461312 -c—-w- c:\windows\system32\dllcache\shell32.dll
2009-05-21 04:55 . 2008-12-16 12:30 354304 -c—-w- c:\windows\system32\dllcache\winhttp.dll
2009-05-21 04:55 . 2008-10-23 12:36 286720 -c—-w- c:\windows\system32\dllcache\gdi32.dll
2009-05-21 04:14 . 2008-05-03 11:55 2560 -c—-w- c:\windows\system32\xpsp4res.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-16 06:18 . 2009-06-16 06:18 0 -c–a-w- c:\documents and settings\12linnz\.user-client.12linnz.12linnz.lock.tmp
2009-06-13 12:19 . 2003-02-20 17:42 348160 -c–a-w- c:\windows\system32\msvcr71.dll
2009-06-13 12:19 . 2003-03-18 09:14 499712 -c–a-w- c:\windows\system32\msvcp71.dll
2009-06-02 06:33 . 2008-10-24 01:29 ——– dc—-w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-06-02 06:31 . 2008-10-24 01:32 ——– dc—-w- c:\program files\Microsoft Works
2009-05-21 05:02 . 2008-11-05 00:35 ——– dc—-w- c:\program files\Java
2009-04-02 06:29 . 2009-04-02 06:29 75048 -c–a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-19 06:32 . 2009-03-19 06:32 23400 -c–a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-06-14_07.31.07 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-16 06:17 . 2009-06-16 06:17 16384 c:\windows\Temp\Perflib_Perfdata_440.dat
+ 2009-06-16 06:16 . 2009-06-16 06:16 16384 c:\windows\Temp\Perflib_Perfdata_2fc.dat
+ 2006-02-28 12:00 . 2009-06-16 06:21 85352 c:\windows\system32\perfc009.dat
- 2006-02-28 12:00 . 2009-06-14 07:09 85352 c:\windows\system32\perfc009.dat
- 2008-11-21 01:04 . 2009-05-22 08:57 25214 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\_SC_Distiller.exe
+ 2008-11-21 01:04 . 2009-06-16 02:12 25214 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\_SC_Distiller.exe
+ 2008-11-21 01:04 . 2009-06-16 02:12 36294 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\_SC_Acrobat_Standard.exe
+ 2008-11-21 01:04 . 2009-06-16 02:12 38926 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\_SC_Acrobat_3D.exe
+ 2008-11-21 01:04 . 2009-06-16 02:12 38926 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\_SC_Acrobat.exe
- 2008-11-21 01:04 . 2009-05-22 08:57 7278 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\_SC_ELEMENTS_DT.exe
+ 2008-11-21 01:04 . 2009-06-16 02:12 7278 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\_SC_ELEMENTS_DT.exe
+ 2006-02-28 12:00 . 2009-06-16 06:21 475516 c:\windows\system32\perfh009.dat
- 2006-02-28 12:00 . 2009-06-14 07:09 475516 c:\windows\system32\perfh009.dat
- 2008-11-21 01:04 . 2009-05-22 08:57 335872 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\SC_Designer_PFM.70DBED24_B579_40CB_AB0B_F1221A3E9EC5.exe
+ 2008-11-21 01:04 . 2009-06-16 02:12 335872 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\SC_Designer_PFM.70DBED24_B579_40CB_AB0B_F1221A3E9EC5.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="c:\program files\Realtek\Audio\InstallShield\AzMixerSel.exe" [2006-07-17 53248]
"ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2008-10-22 3680768]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1028096]
"IFXSPMGT"="c:\windows\system32\ifxspmgt.exe" [2007-07-23 677144]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"PLFSetL"="c:\windows\PLFSetL.exe" [2007-07-05 94208]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-04 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-04 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-04 141848]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-05-02 870920]
"PaperCut NG Client"="c:\program files\PaperCut NG Client\pc-client.exe" [2006-11-02 184320]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-13 198160]
"networks"="c:\windows\winlogon.exe" [BU]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-05-07 16862208]

[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
"ctfmon"="c:\windows\ctfmon.exe" [BU]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
AutoUpdate Monitor.lnk - c:\program files\Sophos\AutoUpdate\ALMon.exe [2009-1-28 245760]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-9-11 576104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2008-10-22 03:39 3076096 —-a-w- c:\program files\Acer\Acer Bio Protection\WinNotify.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0pgdfgsvc C 1\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]
@="service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\EA Sports\\FIFA Online 2\\FF2Client.exe"=
"c:\\Program Files\\EA Sports\\Madden NFL 08\\Updater.exe"=
"c:\\Program Files\\EA Sports\\FIFA 09\\FIFA09.exe"=

R0 AlfaFF;AlfaFF File System mini-filter;c:\windows\system32\drivers\AlfaFF.sys [22/10/2008 1:39 PM 43184]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [24/07/2007 7:59 AM 38816]
R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [10/06/2009 8:52 AM 110848]
R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [10/06/2009 8:52 AM 38528]
R2 FPSensor;LTT-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\drivers\FPSensor.sys [22/10/2008 1:39 PM 20352]
R2 IGBASVC;iGroupTec Service;c:\program files\Acer\Acer Bio Protection\BASVC.exe [22/10/2008 1:39 PM 3481600]
R2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\Sophos\Sophos Anti-Virus\SAVAdminService.exe [10/06/2009 8:52 AM 80936]
R2 SAVService;Sophos Anti-Virus;c:\program files\Sophos\Sophos Anti-Virus\SavService.exe [10/06/2009 8:52 AM 98304]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [24/07/2007 7:59 AM 41216]
R3 ITEIRDA;ITE Infrared Device Driver;c:\windows\system32\drivers\ITEirda.sys [22/10/2008 1:59 PM 24576]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.1;c:\windows\system32\drivers\libusb0.sys [28/05/2009 4:34 PM 28672]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15/08/2008 4:46 AM 284016]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service –> c:\windows\system32\GameMon.des -service [?]
S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [10/06/2009 8:52 AM 14976]

— Other Services/Drivers In Memory —

*Deregistered* - dump_wmimmc
.
Contents of the 'Scheduled Tasks' folder

2009-06-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 02:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://intranet.cgs.vic.edu.au
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-16 16:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Sophos Message Router]
"ImagePath"="\"c:\program files\Sophos\Remote Management System\RouterNT.exe\" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,d5,b8,a1,a9,7e,
87,6a,94,e2,63,26,f1,3f,c8,ff,68,df,94,86,26,a5,12,0f,c0,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,71,1a,61,44,db,
a8,82,97,6a,9c,d6,61,af,45,84,18,83,7b,73,fe,35,7f,b9,26,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,47,40,97,61,c4,
c9,a5,79,ff,7c,85,e0,43,d4,0e,fe,21,4d,f0,17,f6,e7,28,88,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,a3,17,83,07,a1,
83,8c,66,86,8c,21,01,be,91,eb,e7,0e,78,df,c8,9b,41,00,e2,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,97,2c,97,8b,a4,
1d,07,01,f5,1d,4d,73,a8,13,5c,05,20,5d,a8,2f,c8,f1,7c,ec,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:50,93,e5,ab,ec,6a,4e,ab,24,86,c7,1b,af,
30,21,d9,df,20,58,62,78,6b,cf,c8,5d,e6,b2,f6,ed,49,0d,ba,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,52,78,a1,7b,1a,
5c,ba,51,fb,a7,78,e6,12,2f,9a,ea,d5,67,83,e0,bf,40,66,d3,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,71,46,b7,8f,9c,
88,cf,5c,01,3a,48,fc,e8,04,4a,f1,90,cc,56,9e,a7,3b,4a,9a,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:b2,46,9a,e2,1b,fe,1b,94,e0,3d,bd,d0,c7,
c8,8d,aa,f6,0f,4e,58,98,5b,89,c9,67,07,14,4c,8f,87,0d,9a,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,a6,b2,47,1f,90,
b6,4a,42,3d,ce,ea,26,2d,45,aa,78,73,ef,c4,29,16,3b,93,0d,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,c5,95,af,cf,7c,
50,87,ac,2a,b7,cc,b5,b9,7f,41,e7,46,1e,1f,67,d1,64,b3,dd,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,b0,19,c8,08,c2,
74,8d,60,6c,43,2d,1e,aa,22,2f,9c,2c,76,91,5e,93,cf,2a,25,6c,43,2d,1e,aa,22,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1124)
c:\program files\Acer\Acer Bio Protection\CompPtc.dll
c:\program files\Acer\Acer Bio Protection\CustomRes.dll
c:\windows\system32\NBMatS1SDK.DLL
c:\program files\Acer\Acer Bio Protection\WinNotify.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'lsass.exe'(1180)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(3712)
c:\windows\system32\btmmhook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-06-16 16:38
ComboFix-quarantined-files.txt 2009-06-16 06:38
ComboFix2.txt 2009-06-15 13:09
ComboFix3.txt 2009-06-14 07:34

Pre-Run: 91,444,682,752 bytes free
Post-Run: 91,440,181,248 bytes free

362 — E O F — 2009-06-03 01:15
Upload was successful

CatByte

Post #18June 16, 2009, 9:13 AM UTC last edited June 16, 2009, 9:14 AM UTC

Hi, Please run DDS once more so I can make sure you are clean, then we can begin the clean up of tools. Please advise, in detail, how your computer is running now and if there are any out standing issues.

lin0056

Post #19June 16, 2009, 10:48 AM UTC

I have run DDS with the log below and the "Attach.txt" attached. Also, viewing hidden folders works now. DDS Log: DDS (Ver_09-05-14.01) - NTFSx86 Run by [removed] at 20:45:58.76 on Tue 16/06/2009 Internet Explorer: 7.0.5730.13 Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.1977.1278 [GMT 10:00] AV: Sophos Anti-Virus *On-access scanning disabled* (Updated) {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe svchost.exe svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\ifxspmgt.exe C:\WINDOWS\system32\IFXTCS.exe C:\Program Files\Acer\Acer Bio Protection\BASVC.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\WINDOWS\system32\IfxPsdSv.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe C:\Program Files\Sophos\AutoUpdate\ALsvc.exe C:\Program Files\Sophos\Remote Management System\RouterNT.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\igfxsrvc.exe C:\PROGRA~1\LAUNCH~1\LManager.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\igfxext.exe C:\Program Files\Infineon\Security Platform Software\PSDrt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Infineon\Security Platform Software\SpTna.exe C:\Program Files\Sophos\AutoUpdate\ALMon.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\WINDOWS\explorer.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\12linnz\Desktop\dds.pif ============== Pseudo HJT Report =============== uStart Page = hxxp://intranet.cgs.vic.edu.au BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: Sophos Web Content Scanner: {39ea7695-b3f2-4c44-a4bc-297ada8fd235} - c:\program files\sophos\sophos anti-virus\SophosBHO.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [RTHDCPL] RTHDCPL.EXE mRun: [AzMixerSel] c:\program files\realtek\audio\installshield\AzMixerSel.exe mRun: [ZPdtWzdVitaKey MC3000] "c:\program files\acer\acer bio protection\PdtWzd.exe" show mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [IFXSPMGT] c:\windows\system32\ifxspmgt.exe /NotifyLogon mRun: [PLFSetI] c:\windows\PLFSetI.exe mRun: [PLFSetL] c:\windows\PLFSetL.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [LManager] c:\progra~1\launch~1\LManager.exe mRun: [PaperCut NG Client] c:\program files\papercut ng client\pc-client.exe /silent mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [networks] c:\windows\winlogon.exe uExplorerRun: [ctfmon] c:\windows\ctfmon.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autoup~1.lnk - c:\program files\sophos\autoupdate\ALMon.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000 IE: Send to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab Notify: AWinNotifyVitaKey MC3000 - c:\program files\acer\acer bio protection\WinNotify.dll Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\12linnz\applic~1\mozilla\firefox\profiles\nc3mmks4.default\ FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll FF - plugin: c:\program files\microsoft\office live\npOLW.dll ============= SERVICES / DRIVERS =============== R0 AlfaFF;AlfaFF File System mini-filter;c:\windows\system32\drivers\AlfaFF.sys [2008-10-22 43184] R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [2007-7-24 38816] R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [2009-6-10 110848] R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [2009-6-10 38528] R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};c:\program files\cyberlink\powerdvd\000.fcl [2008-11-20 13560] R2 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2007-9-25 574808] R2 FPSensor;LTT-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\drivers\FPSensor.sys [2008-10-22 20352] R2 IGBASVC;iGroupTec Service;c:\program files\acer\acer bio protection\BASVC.exe [2008-10-22 3481600] R2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\sophos\sophos anti-virus\SAVAdminService.exe [2009-6-10 80936] R2 SAVService;Sophos Anti-Virus;c:\program files\sophos\sophos anti-virus\SavService.exe [2009-6-10 98304] R2 Sophos Agent;Sophos Agent;c:\program files\sophos\remote management system\ManagementAgentNT.exe [2009-6-10 266240] R2 Sophos AutoUpdate Service;Sophos AutoUpdate Service;c:\program files\sophos\autoupdate\ALsvc.exe [2009-1-28 172032] R2 Sophos Message Router;Sophos Message Router;c:\program files\sophos\remote management system\RouterNT.exe [2009-6-10 794624] R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2007-7-24 41216] R3 ITEIRDA;ITE Infrared Device Driver;c:\windows\system32\drivers\ITEirda.sys [2008-10-22 24576] R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.1;c:\windows\system32\drivers\libusb0.sys [2009-5-28 28672] S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\common files\adobe\adobe version cue cs4\server\bin\VersionCueCS4.exe [2008-8-15 284016] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service –> c:\windows\system32\GameMon.des -service [?] S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [2009-6-10 14976] ============== File Associations =============== txtfile=c:\windows\system32\drivers\etc\networks.exe %1 =============== Created Last 30 ================ 2009-06-16 12:14 -cd—– c:\documents and settings\all users\AdobeTemp 2009-06-15 21:14 -cd—– C:\_OTM 2009-06-14 22:20 -cd—– c:\docume~1\12linnz\applic~1\Malwarebytes 2009-06-14 22:20 40,160 ac—— c:\windows\system32\drivers\mbamswissarmy.sys 2009-06-14 22:20 19,096 ac—— c:\windows\system32\drivers\mbam.sys 2009-06-14 22:20 -cd—– c:\program files\Malwarebytes' Anti-Malware 2009-06-14 22:20 -cd—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2009-06-14 22:20 -cd—– C:\Rooter$ 2009-06-14 17:11 acdshr– C:\cmdcons 2009-06-14 17:08 161,792 ac—— c:\windows\SWREG.exe 2009-06-14 17:08 155,136 ac—— c:\windows\PEV.exe 2009-06-14 17:08 98,816 ac—— c:\windows\sed.exe 2009-06-13 23:22 -cd—– C:\finalburner 2009-06-13 23:08 -cd—– c:\program files\FinalBurner 2009-06-13 22:20 -cd—– c:\program files\common files\xing shared 2009-06-11 17:23 57,856 ac—— c:\windows\system32\MSWINSCK.OCX 2009-06-10 23:09 -cd—– c:\docume~1\12linnz\applic~1\Red Kawa 2009-06-10 08:55 130,104 ac—— c:\windows\system32\sdccoinstaller.dll 2009-06-10 08:54 -cd—– c:\program files\common files\Cisco Systems 2009-06-10 08:54 23,552 ac—— c:\windows\system32\sophosboottasks.exe 2009-06-10 08:53 -cd—– c:\docume~1\alluse~1\applic~1\Sophos 2009-06-10 08:52 14,976 ac—— c:\windows\system32\drivers\SophosBootDriver.sys 2009-06-10 08:52 38,528 ac—— c:\windows\system32\drivers\savonaccessfilter.sys 2009-06-10 08:52 110,848 ac—— c:\windows\system32\drivers\savonaccesscontrol.sys 2009-06-10 08:50 -cd—– c:\program files\Sophos 2009-06-09 23:55 664 ac—— c:\windows\system32\d3d9caps.dat 2009-06-09 23:18 -cd—– c:\program files\Regensoft 2009-06-09 23:18 -cd—– c:\program files\Red Kawa 2009-06-09 21:43 -cd—– c:\windows\system32\appmgmt 2009-06-09 17:39 442,368 ac—— c:\windows\system32\vp6vfw.dll 2009-06-07 18:17 -cd—– c:\windows\Universal Forum Poster 2009-06-07 18:17 -cd—– c:\program files\Universal Forum Poster 2009-06-07 14:21 -cd—– c:\docume~1\12linnz\applic~1\WindowsApplication1 2009-06-05 09:32 -cd—– c:\program files\common files\Real 2009-06-03 11:12 1,089,593 -c—— c:\windows\system32\dllcache\ntprint.cat 2009-06-03 11:12 5,632 ac—— c:\windows\system32\ptpusb.dll 2009-06-03 11:12 159,232 ac—— c:\windows\system32\ptpusd.dll 2009-06-03 11:12 15,104 ac—— c:\windows\system32\drivers\usbscan.sys 2009-06-03 11:12 15,104 ac—— c:\windows\system32\dllcache\usbscan.sys 2009-06-01 19:32 -cd—– c:\windows\system32\wbem\Repository 2009-06-01 19:18 -cd—– c:\windows\LastGood(2) 2009-05-31 20:44 -cd—– c:\docume~1\12linnz\applic~1\Uniblue 2009-05-29 12:21 -cd—– c:\documents and settings\12linnz\Bluetooth Software 2009-05-28 16:34 43,520 ac—— c:\windows\system32\libusb0.dll 2009-05-28 16:34 28,672 ac—— c:\windows\system32\drivers\libusb0.sys 2009-05-28 16:34 -cd—– c:\program files\LibUSB-Win32 2009-05-28 16:33 933,888 ac—— c:\windows\system32\SENXPCTL.OCX 2009-05-28 16:33 212,240 ac—— c:\windows\system32\RICHTX32.OCX 2009-05-28 16:33 65,536 ac—— c:\windows\system32\device.OCX 2009-05-28 16:33 32,768 ac—— c:\windows\system32\Bar.OCX 2009-05-28 16:33 -cd—– c:\program files\QuickFreedom 2009-05-25 14:32 177,152 -c—— c:\windows\system32\dllcache\msctfime.ime 2009-05-25 14:32 268,288 -c—— c:\windows\system32\dllcache\iertutil.dll 2009-05-25 14:32 63,488 -c—— c:\windows\system32\dllcache\icardie.dll 2009-05-25 14:32 52,224 -c—— c:\windows\system32\dllcache\msfeedsbs.dll 2009-05-25 14:32 13,824 -c—— c:\windows\system32\dllcache\ieudinit.exe 2009-05-25 14:32 459,264 -c—— c:\windows\system32\dllcache\msfeeds.dll 2009-05-25 14:32 991,232 -c—— c:\windows\system32\dllcache\ieframe.dll.mui 2009-05-25 14:32 2,455,488 -c—— c:\windows\system32\dllcache\ieapfltr.dat 2009-05-25 14:32 383,488 -c—— c:\windows\system32\dllcache\ieapfltr.dll 2009-05-25 14:31 6,066,176 -c—— c:\windows\system32\dllcache\ieframe.dll 2009-05-24 21:34 -cd—– c:\windows\system32\Adobe 2009-05-22 13:08 484 ac—— c:\windows\FOE2.ini 2009-05-22 12:00 2,735,133 ac—— c:\windows\system32\GameMon.des 2009-05-22 11:57 5,174 ac—— c:\windows\system32\nppt9x.vxd 2009-05-22 11:57 4,682 ac—— c:\windows\system32\npptNT2.sys 2009-05-22 11:56 -cd—– c:\program files\common files\INCA Shared 2009-05-21 22:23 -cd—– c:\docume~1\alluse~1\applic~1\Messenger Plus! 2009-05-21 19:24 -cd—– c:\program files\EA Sports 2009-05-21 18:57 721,904 a——- c:\windows\system32\drivers\sptd.sys 2009-05-21 18:57 -cd—– c:\docume~1\12linnz\applic~1\DAEMON Tools Lite 2009-05-21 18:53 -cd-h— c:\windows\PIF 2009-05-21 18:47 -cd—– c:\docume~1\12linnz\applic~1\LimeWire 2009-05-21 18:44 -cd—– c:\program files\PowerISO 2009-05-21 18:44 -cd—– c:\program files\LimeWire 2009-05-21 18:37 -cd—– c:\program files\Messenger Plus! Live 2009-05-21 18:33 -cd—– c:\program files\uTorrent 2009-05-21 18:33 -cd—– c:\docume~1\12linnz\applic~1\uTorrent 2009-05-21 18:33 107,368 ac—— c:\windows\system32\GEARAspi.dll 2009-05-21 18:33 23,400 ac—— c:\windows\system32\drivers\GEARAspiWDM.sys 2009-05-21 18:32 -cd—– c:\program files\iPod 2009-05-21 18:32 -cd—– c:\program files\iTunes 2009-05-21 18:32 -cd—– c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-05-21 18:32 -cd—– c:\program files\Bonjour 2009-05-21 18:31 1,900,544 ac—— c:\windows\system32\usbaaplrc.dll 2009-05-21 18:31 36,864 ac—— c:\windows\system32\drivers\usbaapl.sys 2009-05-21 18:12 -cd—– c:\program files\DVD Decrypter 2009-05-21 18:12 43,602 ac—— c:\windows\system32\xvid-uninstall.exe 2009-05-21 18:12 -cd—– c:\program files\AviSynth 2.5 2009-05-21 18:12 -cd—– c:\program files\AutoGK 2009-05-21 18:00 -cd—– c:\documents and settings\12linnz\Tracing 2009-05-21 17:58 -cd—– c:\program files\Microsoft 2009-05-21 17:58 -cd—– c:\program files\Windows Live SkyDrive 2009-05-21 17:55 -cd—– c:\program files\common files\Windows Live 2009-05-21 17:46 10,368 ac—— c:\windows\system32\drivers\hidusb.sys 2009-05-21 17:46 10,368 ac—— c:\windows\system32\dllcache\hidusb.sys 2009-05-21 15:19 -cd—– c:\program files\Combined Community Codec Pack 2009-05-21 15:19 -cd—– c:\program files\CCleaner 2009-05-21 14:57 989,696 -c—— c:\windows\system32\dllcache\kernel32.dll 2009-05-21 14:57 56,832 -c—— c:\windows\system32\dllcache\secur32.dll 2009-05-21 14:57 144,896 -c—— c:\windows\system32\dllcache\schannel.dll 2009-05-21 14:57 401,408 -c—— c:\windows\system32\dllcache\rpcss.dll 2009-05-21 14:57 284,160 -c—— c:\windows\system32\dllcache\pdh.dll 2009-05-21 14:57 729,088 -c—— c:\windows\system32\dllcache\lsasrv.dll 2009-05-21 14:57 714,752 -c—— c:\windows\system32\dllcache\ntdll.dll 2009-05-21 14:57 617,472 -c—— c:\windows\system32\dllcache\advapi32.dll 2009-05-21 14:57 473,600 -c—— c:\windows\system32\dllcache\fastprox.dll 2009-05-21 14:57 453,120 -c—— c:\windows\system32\dllcache\wmiprvsd.dll 2009-05-21 14:57 110,592 -c—— c:\windows\system32\dllcache\services.exe 2009-05-21 14:56 66,560 -c—— c:\windows\system32\dllcache\mtxclu.dll 2009-05-21 14:56 8,461,312 -c—— c:\windows\system32\dllcache\shell32.dll 2009-05-21 14:55 354,304 -c—— c:\windows\system32\dllcache\winhttp.dll 2009-05-21 14:55 286,720 -c—— c:\windows\system32\dllcache\gdi32.dll 2009-05-21 14:14 2,560 -c—— c:\windows\system32\xpsp4res.dll 2009-05-21 14:13 -cd—– c:\docume~1\12linnz\applic~1\Infineon 2009-05-21 14:10 -cd—– c:\documents and settings\12linnz 2009-05-21 12:21 4,444 ac—— c:\windows\system32\pid.PNF ==================== Find3M ==================== 2009-06-13 22:19 348,160 ac—— c:\windows\system32\msvcr71.dll 2009-06-13 22:19 499,712 ac—— c:\windows\system32\msvcp71.dll ============= FINISH: 20:46:08.81 ===============

Attachments:

📎Attach.txt

CatByte

Post #20June 16, 2009, 1:37 PM UTC

Hi,

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

File::
c:\windows\winlogon.exe

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"networks"=-
[HKEY_CURRENT_USER\software\microsoft\windows\Currentversion\policies\explorer\Run]
"ctfmon"=-

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Please advise if you are still getting the error messages or are there any further issues with your machine.

Advise if you can open your saved text documents with notepad.

lin0056

Post #21June 16, 2009, 1:51 PM UTC

I am having no errors and I can view saved text documents in notepad.
I seem to be free of this malware, can you confirm this?
Log:

ComboFix 09-06-15.07 - 12LinNZ 16/06/2009 23:42.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.61.1033.18.1977.1263 [GMT 10:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\12linnz\Desktop\CFScript.txt
AV: Sophos Anti-Virus *On-access scanning disabled* (Updated) {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}

FILE ::
"c:\windows\winlogon.exe"
.

((((((((((((((((((((((((( Files Created from 2009-05-16 to 2009-06-16 )))))))))))))))))))))))))))))))
.

2009-06-16 02:14 . 2009-06-16 02:15 ——– dc—-w- c:\documents and settings\All Users\AdobeTemp
2009-06-15 11:14 . 2009-06-15 11:14 ——– dc—-w- C:\_OTM
2009-06-14 12:20 . 2009-06-14 12:20 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Malwarebytes
2009-06-14 12:20 . 2009-05-26 03:20 40160 -c–a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-14 12:20 . 2009-06-14 12:20 ——– dc—-w- c:\program files\Malwarebytes' Anti-Malware
2009-06-14 12:20 . 2009-06-14 12:20 ——– dc—-w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-14 12:20 . 2009-05-26 03:19 19096 -c–a-w- c:\windows\system32\drivers\mbam.sys
2009-06-14 12:20 . 2009-06-14 12:20 ——– dc—-w- C:\Rooter$
2009-06-13 13:22 . 2009-06-14 07:44 ——– dc—-w- C:\finalburner
2009-06-13 13:08 . 2009-06-13 13:09 ——– dc—-w- c:\program files\FinalBurner
2009-06-13 12:20 . 2009-06-13 12:20 ——– dc—-w- c:\program files\Common Files\xing shared
2009-06-11 21:10 . 2009-06-11 21:10 ——– dc—-w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-06-10 13:09 . 2009-06-10 13:09 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Red Kawa
2009-06-09 22:59 . 2009-06-10 04:54 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Google
2009-06-09 22:59 . 2009-06-09 22:59 ——– dc—-w- c:\program files\Google
2009-06-09 22:55 . 2009-06-09 22:52 130104 -c–a-w- c:\windows\system32\sdccoinstaller.dll
2009-06-09 22:54 . 2009-06-09 22:54 ——– dc—-w- c:\program files\Common Files\Cisco Systems
2009-06-09 22:54 . 2009-06-09 22:52 23552 -c–a-w- c:\windows\system32\sophosboottasks.exe
2009-06-09 22:53 . 2009-06-09 22:54 ——– dc—-w- c:\documents and settings\All Users\Application Data\Sophos
2009-06-09 22:52 . 2009-06-09 22:52 14976 -c–a-w- c:\windows\system32\drivers\SophosBootDriver.sys
2009-06-09 22:52 . 2009-06-09 22:52 38528 -c–a-w- c:\windows\system32\drivers\savonaccessfilter.sys
2009-06-09 22:52 . 2009-06-09 22:52 110848 -c–a-w- c:\windows\system32\drivers\savonaccesscontrol.sys
2009-06-09 22:50 . 2009-06-09 22:54 ——– dc—-w- c:\program files\Sophos
2009-06-09 13:55 . 2009-06-09 13:55 664 -c–a-w- c:\windows\system32\d3d9caps.dat
2009-06-09 13:18 . 2009-06-09 13:18 ——– dc—-w- c:\program files\Regensoft
2009-06-09 13:18 . 2009-06-09 13:18 ——– dc—-w- c:\program files\Red Kawa
2009-06-09 07:39 . 2004-08-18 02:14 442368 -c–a-w- c:\windows\system32\vp6vfw.dll
2009-06-07 08:17 . 2009-06-07 10:39 ——– dc—-w- c:\program files\Universal Forum Poster
2009-06-07 08:17 . 2009-06-07 08:17 ——– dc—-w- c:\windows\Universal Forum Poster
2009-06-07 04:21 . 2009-06-07 04:21 ——– dc—-w- c:\documents and settings\12linnz\Application Data\WindowsApplication1
2009-06-07 04:02 . 2009-06-07 04:04 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Media Player Classic
2009-06-07 03:43 . 2009-06-08 00:31 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Deployment
2009-06-07 01:15 . 2009-06-07 01:15 ——– dc—-w- c:\documents and settings\12linnz\Application Data\CyberLink
2009-06-04 23:32 . 2009-06-13 12:20 ——– dc—-w- c:\program files\Common Files\Real
2009-06-04 23:31 . 2009-06-04 23:31 ——– dc—-w- c:\program files\Real
2009-06-03 01:12 . 2001-08-17 12:36 5632 -c–a-w- c:\windows\system32\ptpusb.dll
2009-06-03 01:12 . 2008-04-13 19:42 159232 -c–a-w- c:\windows\system32\ptpusd.dll
2009-06-03 01:12 . 2008-04-13 14:15 15104 -c–a-w- c:\windows\system32\drivers\usbscan.sys
2009-06-03 01:12 . 2008-04-13 14:15 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys
2009-06-01 09:32 . 2009-06-01 09:32 ——– dc—-w- c:\windows\system32\wbem\Repository
2009-06-01 09:18 . 2009-06-01 09:18 ——– dc—-w- c:\windows\LastGood(2)
2009-05-31 10:44 . 2009-05-31 10:44 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Uniblue
2009-05-29 02:21 . 2009-05-29 02:21 ——– dc—-w- c:\documents and settings\12linnz\Bluetooth Software
2009-05-28 06:34 . 2009-05-28 06:34 ——– dc—-w- c:\program files\LibUSB-Win32
2009-05-28 06:34 . 2007-03-20 01:33 28672 -c–a-w- c:\windows\system32\drivers\libusb0.sys
2009-05-28 06:34 . 2007-03-20 01:33 43520 -c–a-w- c:\windows\system32\libusb0.dll
2009-05-28 06:33 . 2009-06-03 02:04 ——– dc—-w- c:\program files\QuickFreedom
2009-05-26 05:10 . 2009-05-26 05:10 ——– dc—-w- c:\documents and settings\12linnz\Application Data\DivX
2009-05-25 04:32 . 2009-02-20 18:09 268288 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2009-05-25 04:32 . 2009-02-20 18:09 63488 -c—-w- c:\windows\system32\dllcache\icardie.dll
2009-05-25 04:32 . 2009-02-20 18:09 52224 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-05-25 04:32 . 2009-02-20 10:20 13824 -c—-w- c:\windows\system32\dllcache\ieudinit.exe
2009-05-25 04:32 . 2009-02-20 18:09 459264 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2009-05-25 04:32 . 2008-07-09 14:25 2455488 -c—-w- c:\windows\system32\dllcache\ieapfltr.dat
2009-05-25 04:32 . 2009-02-20 18:09 383488 -c—-w- c:\windows\system32\dllcache\ieapfltr.dll
2009-05-25 04:31 . 2009-02-20 18:09 6066176 -c—-w- c:\windows\system32\dllcache\ieframe.dll
2009-05-24 11:34 . 2009-05-24 11:34 ——– dc—-w- c:\windows\system32\Adobe
2009-05-23 10:00 . 2009-05-23 10:00 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Leadertech
2009-05-22 01:57 . 2005-01-03 06:43 4682 -c–a-w- c:\windows\system32\npptNT2.sys
2009-05-22 01:56 . 2009-05-22 01:56 ——– dc—-w- c:\program files\Common Files\INCA Shared
2009-05-21 12:23 . 2009-05-21 12:23 ——– dc—-w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-05-21 09:24 . 2009-06-13 22:59 ——– dc—-w- c:\program files\EA Sports
2009-05-21 09:07 . 2009-05-21 09:07 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Sophos
2009-05-21 08:57 . 2009-05-21 08:57 721904 —-a-w- c:\windows\system32\drivers\sptd.sys
2009-05-21 08:57 . 2009-05-21 08:57 ——– dc—-w- c:\documents and settings\12linnz\Application Data\DAEMON Tools Lite
2009-05-21 08:53 . 2009-05-21 08:53 ——– dc-h–w- c:\windows\PIF
2009-05-21 08:47 . 2009-06-04 11:38 ——– dc—-w- c:\documents and settings\12linnz\Application Data\LimeWire
2009-05-21 08:44 . 2009-05-21 08:44 ——– dc—-w- c:\program files\PowerISO
2009-05-21 08:44 . 2009-05-21 08:44 ——– dc—-w- c:\program files\LimeWire
2009-05-21 08:37 . 2009-05-21 10:08 ——– dc—-w- c:\program files\Messenger Plus! Live
2009-05-21 08:33 . 2009-05-21 08:33 ——– dc—-w- c:\program files\uTorrent
2009-05-21 08:33 . 2009-06-15 05:07 ——– dc—-w- c:\documents and settings\12linnz\Application Data\uTorrent
2009-05-21 08:33 . 2009-05-28 07:37 ——– dc—-w- c:\documents and settings\12linnz\Application Data\Apple Computer
2009-05-21 08:33 . 2009-03-19 06:32 23400 -c–a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-05-21 08:33 . 2008-04-17 02:12 107368 -c–a-w- c:\windows\system32\GEARAspi.dll
2009-05-21 08:32 . 2009-05-21 08:32 ——– dc—-w- c:\program files\iPod
2009-05-21 08:32 . 2009-05-21 08:33 ——– dc—-w- c:\program files\iTunes
2009-05-21 08:32 . 2009-05-21 08:33 ——– dc—-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-21 08:32 . 2009-05-21 08:32 ——– dc—-w- c:\program files\Bonjour
2009-05-21 08:31 . 2009-05-21 08:32 ——– dc—-w- c:\program files\QuickTime
2009-05-21 08:31 . 2009-05-21 08:32 ——– dc—-w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-05-21 08:31 . 2009-05-21 08:31 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Apple
2009-05-21 08:31 . 2009-05-21 08:31 ——– dc—-w- c:\program files\Apple Software Update
2009-05-21 08:31 . 2009-03-26 05:23 36864 -c–a-w- c:\windows\system32\drivers\usbaapl.sys
2009-05-21 08:31 . 2009-03-26 05:23 1900544 -c–a-w- c:\windows\system32\usbaaplrc.dll
2009-05-21 08:31 . 2009-05-21 08:32 ——– dc—-w- c:\program files\Common Files\Apple
2009-05-21 08:31 . 2009-05-21 08:31 ——– dc—-w- c:\documents and settings\All Users\Application Data\Apple
2009-05-21 08:30 . 2009-05-21 08:33 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Apple Computer
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\DVD Decrypter
2009-05-21 08:12 . 2009-05-21 08:12 43602 -c–a-w- c:\windows\system32\xvid-uninstall.exe
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\AviSynth 2.5
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\Gabest
2009-05-21 08:12 . 2009-05-21 08:12 ——– dc—-w- c:\program files\AutoGK
2009-05-21 08:00 . 2009-06-16 06:44 ——– dc—-w- c:\documents and settings\12linnz\Tracing
2009-05-21 07:59 . 2009-05-21 07:59 ——– dc—-w- c:\program files\Microsoft Silverlight
2009-05-21 07:58 . 2009-05-21 07:59 ——– dc—-w- c:\program files\Microsoft
2009-05-21 07:58 . 2009-05-21 07:58 ——– dc—-w- c:\program files\Windows Live SkyDrive
2009-05-21 07:57 . 2009-05-21 07:58 ——– dc—-w- c:\program files\Windows Live
2009-05-21 07:55 . 2009-05-21 07:55 ——– dc—-w- c:\program files\Common Files\Windows Live
2009-05-21 07:55 . 2009-06-02 10:32 105544 -c–a-w- c:\documents and settings\12linnz\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-21 07:46 . 2008-04-13 14:15 10368 -c–a-w- c:\windows\system32\drivers\hidusb.sys
2009-05-21 07:46 . 2008-04-13 14:15 10368 -c–a-w- c:\windows\system32\dllcache\hidusb.sys
2009-05-21 05:19 . 2009-05-21 05:19 ——– dc—-w- c:\program files\Combined Community Codec Pack
2009-05-21 05:19 . 2009-05-21 05:19 ——– dc—-w- c:\program files\CCleaner
2009-05-21 05:14 . 2009-05-21 05:14 0 -c–a-w- c:\windows\nsreg.dat
2009-05-21 05:14 . 2009-05-21 05:14 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Mozilla
2009-05-21 05:01 . 2009-05-21 05:01 152576 -c–a-w- c:\documents and settings\12linnz\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-21 04:59 . 2009-05-21 04:59 ——– dc—-w- c:\documents and settings\12linnz\Local Settings\Application Data\Microsoft Help
2009-05-21 04:59 . 2009-06-01 09:32 ——– dc—-w- c:\documents and settings\saaa
2009-05-21 04:57 . 2009-03-21 14:06 989696 -c—-w- c:\windows\system32\dllcache\kernel32.dll
2009-05-21 04:57 . 2009-02-03 19:59 56832 -c—-w- c:\windows\system32\dllcache\secur32.dll
2009-05-21 04:57 . 2008-12-05 06:54 144896 -c—-w- c:\windows\system32\dllcache\schannel.dll
2009-05-21 04:57 . 2009-03-06 14:22 284160 -c—-w- c:\windows\system32\dllcache\pdh.dll
2009-05-21 04:57 . 2009-02-09 12:10 401408 -c—-w- c:\windows\system32\dllcache\rpcss.dll
2009-05-21 04:57 . 2009-02-09 12:10 729088 -c—-w- c:\windows\system32\dllcache\lsasrv.dll
2009-05-21 04:57 . 2009-02-09 12:10 714752 -c—-w- c:\windows\system32\dllcache\ntdll.dll
2009-05-21 04:57 . 2009-02-09 12:10 617472 -c—-w- c:\windows\system32\dllcache\advapi32.dll
2009-05-21 04:57 . 2009-02-09 12:10 473600 -c—-w- c:\windows\system32\dllcache\fastprox.dll
2009-05-21 04:57 . 2009-02-09 12:10 453120 -c—-w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-21 04:57 . 2009-02-06 11:11 110592 -c—-w- c:\windows\system32\dllcache\services.exe
2009-05-21 04:56 . 2008-06-12 14:23 66560 -c—-w- c:\windows\system32\dllcache\mtxclu.dll
2009-05-21 04:56 . 2008-06-17 19:02 8461312 -c—-w- c:\windows\system32\dllcache\shell32.dll
2009-05-21 04:55 . 2008-12-16 12:30 354304 -c—-w- c:\windows\system32\dllcache\winhttp.dll
2009-05-21 04:55 . 2008-10-23 12:36 286720 -c—-w- c:\windows\system32\dllcache\gdi32.dll
2009-05-21 04:14 . 2008-05-03 11:55 2560 -c—-w- c:\windows\system32\xpsp4res.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-16 06:18 . 2009-06-16 06:18 0 -c–a-w- c:\documents and settings\12linnz\.user-client.12linnz.12linnz.lock.tmp
2009-06-13 12:19 . 2003-02-20 17:42 348160 -c–a-w- c:\windows\system32\msvcr71.dll
2009-06-13 12:19 . 2003-03-18 09:14 499712 -c–a-w- c:\windows\system32\msvcp71.dll
2009-06-02 06:33 . 2008-10-24 01:29 ——– dc—-w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-06-02 06:31 . 2008-10-24 01:32 ——– dc—-w- c:\program files\Microsoft Works
2009-05-21 05:02 . 2008-11-05 00:35 ——– dc—-w- c:\program files\Java
2009-04-02 06:29 . 2009-04-02 06:29 75048 -c–a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-03-19 06:32 . 2009-03-19 06:32 23400 -c–a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-06-14_07.31.07 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-16 06:17 . 2009-06-16 06:17 16384 c:\windows\Temp\Perflib_Perfdata_440.dat
+ 2009-06-16 06:16 . 2009-06-16 06:16 16384 c:\windows\Temp\Perflib_Perfdata_2fc.dat
+ 2006-02-28 12:00 . 2009-06-16 06:21 85352 c:\windows\system32\perfc009.dat
- 2006-02-28 12:00 . 2009-06-14 07:09 85352 c:\windows\system32\perfc009.dat
- 2008-11-21 01:04 . 2009-05-22 08:57 25214 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\_SC_Distiller.exe
+ 2008-11-21 01:04 . 2009-06-16 02:12 25214 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\_SC_Distiller.exe
+ 2008-11-21 01:04 . 2009-06-16 02:12 36294 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\_SC_Acrobat_Standard.exe
+ 2008-11-21 01:04 . 2009-06-16 02:12 38926 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\_SC_Acrobat_3D.exe
+ 2008-11-21 01:04 . 2009-06-16 02:12 38926 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\_SC_Acrobat.exe
- 2008-11-21 01:04 . 2009-05-22 08:57 7278 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\_SC_ELEMENTS_DT.exe
+ 2008-11-21 01:04 . 2009-06-16 02:12 7278 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\_SC_ELEMENTS_DT.exe
+ 2006-02-28 12:00 . 2009-06-16 06:21 475516 c:\windows\system32\perfh009.dat
- 2006-02-28 12:00 . 2009-06-14 07:09 475516 c:\windows\system32\perfh009.dat
- 2008-11-21 01:04 . 2009-05-22 08:57 335872 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\SC_Designer_PFM.70DBED24_B579_40CB_AB0B_F1221A3E9EC5.exe
+ 2008-11-21 01:04 . 2009-06-16 02:12 335872 c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000004}\SC_Designer_PFM.70DBED24_B579_40CB_AB0B_F1221A3E9EC5.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="c:\program files\Realtek\Audio\InstallShield\AzMixerSel.exe" [2006-07-17 53248]
"ZPdtWzdVitaKey MC3000"="c:\program files\Acer\Acer Bio Protection\PdtWzd.exe" [2008-10-22 3680768]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1028096]
"IFXSPMGT"="c:\windows\system32\ifxspmgt.exe" [2007-07-23 677144]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"PLFSetL"="c:\windows\PLFSetL.exe" [2007-07-05 94208]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-04 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-04 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-04 141848]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-05-02 870920]
"PaperCut NG Client"="c:\program files\PaperCut NG Client\pc-client.exe" [2006-11-02 184320]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-06-13 198160]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-05-07 16862208]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
AutoUpdate Monitor.lnk - c:\program files\Sophos\AutoUpdate\ALMon.exe [2009-1-28 245760]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-9-11 576104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\AWinNotifyVitaKey MC3000]
2008-10-22 03:39 3076096 —-a-w- c:\program files\Acer\Acer Bio Protection\WinNotify.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0pgdfgsvc C 1\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]
@="service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\EA Sports\\FIFA Online 2\\FF2Client.exe"=
"c:\\Program Files\\EA Sports\\Madden NFL 08\\Updater.exe"=
"c:\\Program Files\\EA Sports\\FIFA 09\\FIFA09.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

R0 AlfaFF;AlfaFF File System mini-filter;c:\windows\system32\drivers\AlfaFF.sys [22/10/2008 1:39 PM 43184]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [24/07/2007 7:59 AM 38816]
R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [10/06/2009 8:52 AM 110848]
R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [10/06/2009 8:52 AM 38528]
R2 FPSensor;LTT-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\drivers\FPSensor.sys [22/10/2008 1:39 PM 20352]
R2 IGBASVC;iGroupTec Service;c:\program files\Acer\Acer Bio Protection\BASVC.exe [22/10/2008 1:39 PM 3481600]
R2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\Sophos\Sophos Anti-Virus\SAVAdminService.exe [10/06/2009 8:52 AM 80936]
R2 SAVService;Sophos Anti-Virus;c:\program files\Sophos\Sophos Anti-Virus\SavService.exe [10/06/2009 8:52 AM 98304]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [24/07/2007 7:59 AM 41216]
R3 ITEIRDA;ITE Infrared Device Driver;c:\windows\system32\drivers\ITEirda.sys [22/10/2008 1:59 PM 24576]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.12.1;c:\windows\system32\drivers\libusb0.sys [28/05/2009 4:34 PM 28672]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15/08/2008 4:46 AM 284016]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service –> c:\windows\system32\GameMon.des -service [?]
S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [10/06/2009 8:52 AM 14976]

— Other Services/Drivers In Memory —

*Deregistered* - dump_wmimmc
.
Contents of the 'Scheduled Tasks' folder

2009-06-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 02:34]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://intranet.cgs.vic.edu.au
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-16 23:45
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Sophos Message Router]
"ImagePath"="\"c:\program files\Sophos\Remote Management System\RouterNT.exe\" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4c74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,d5,b8,a1,a9,7e,
87,6a,94,e2,63,26,f1,3f,c8,ff,68,df,94,86,26,a5,12,0f,c0,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,71,1a,61,44,db,
a8,82,97,6a,9c,d6,61,af,45,84,18,83,7b,73,fe,35,7f,b9,26,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:7a,45,05,fd,91,e8,6f,31,47,40,97,61,c4,
c9,a5,79,ff,7c,85,e0,43,d4,0e,fe,21,4d,f0,17,f6,e7,28,88,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,a3,17,83,07,a1,
83,8c,66,86,8c,21,01,be,91,eb,e7,0e,78,df,c8,9b,41,00,e2,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,97,2c,97,8b,a4,
1d,07,01,f5,1d,4d,73,a8,13,5c,05,20,5d,a8,2f,c8,f1,7c,ec,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:50,93,e5,ab,ec,6a,4e,ab,24,86,c7,1b,af,
30,21,d9,df,20,58,62,78,6b,cf,c8,5d,e6,b2,f6,ed,49,0d,ba,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,52,78,a1,7b,1a,
5c,ba,51,fb,a7,78,e6,12,2f,9a,ea,d5,67,83,e0,bf,40,66,d3,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,71,46,b7,8f,9c,
88,cf,5c,01,3a,48,fc,e8,04,4a,f1,90,cc,56,9e,a7,3b,4a,9a,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:b2,46,9a,e2,1b,fe,1b,94,e0,3d,bd,d0,c7,
c8,8d,aa,f6,0f,4e,58,98,5b,89,c9,67,07,14,4c,8f,87,0d,9a,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,a6,b2,47,1f,90,
b6,4a,42,3d,ce,ea,26,2d,45,aa,78,73,ef,c4,29,16,3b,93,0d,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,c5,95,af,cf,7c,
50,87,ac,2a,b7,cc,b5,b9,7f,41,e7,46,1e,1f,67,d1,64,b3,dd,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,b0,19,c8,08,c2,
74,8d,60,6c,43,2d,1e,aa,22,2f,9c,2c,76,91,5e,93,cf,2a,25,6c,43,2d,1e,aa,22,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1124)
c:\program files\Acer\Acer Bio Protection\CompPtc.dll
c:\program files\Acer\Acer Bio Protection\CustomRes.dll
c:\windows\system32\NBMatS1SDK.DLL
c:\program files\Acer\Acer Bio Protection\WinNotify.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\windows\system32\igfxdev.dll

- - - - - - - > 'lsass.exe'(1180)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(1064)
c:\windows\system32\btmmhook.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-06-16 23:47
ComboFix-quarantined-files.txt 2009-06-16 13:47
ComboFix2.txt 2009-06-16 06:39
ComboFix3.txt 2009-06-15 13:09
ComboFix4.txt 2009-06-14 07:34

Pre-Run: 91,391,086,592 bytes free
Post-Run: 91,385,737,216 bytes free

350 — E O F — 2009-06-03 01:15

CatByte

Post #22June 16, 2009, 2:23 PM UTC

Hi,

Yes that log looks good.

now we need to clean up our tools

Please do the following:

Your java is out of date:

Java™ 6 Update 13 can be updated from the Java control panel
Go to Start > Control Panel (Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now.
An update should begin; follow the prompts.

NEXT

Follow these steps to uninstall Combofix

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

Should you wish to contribute to the ongoing development of ComboFix, donations are being accepted via PayPal.

Next

Download ToolsCleaner2 to your desktop and run it ( by de A.Rothstein & Dj Quiou )

Click the Pt. Restauration button and press OK to the prompts.
Click the Corbeille button and press OK to the prompt.
Click the Fichiers temp button and press OK to the prompt.
Click the Recherche button and let it run ( it may look like it freezes but let it continue )
Once it is done click the Suppression button and let it remove anything it finds.
Close the program

Next

Below I have included a number of recommendations for how to protect your computer against malware infections.

Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox and IE
For Firefox, I highly recommend this additional add-on to keep your PC even more secure.
- NoScript - for blocking ads and other potential website attacks
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
Please read these useful guides How did I get infected in the first place?
PC Safety and Security–What Do I Need?

miekiemoes' Prevention topic.

Thank you for your patience, and performing all of the procedures requested.

Lastly: I have spent considerable time and effort in cleaning your machine for you. I would ask you reconsider you attitute towards file sharing as no doubt that contributed to your situation. Never mind the legalities of the issue, that is where malware writers find the most success in spreading their malicious code. Worth considering.

Please respond to this thread one more time so we can mark this thread as resolved.

lin0056

Post #23June 17, 2009, 6:37 AM UTC

I will definitely consider removing my P2P programs. - I updated Java - I uninstalled ComboFix - I ran ToolsCleaner2 - I ran Windows Update - I followed your advice and made Internet Explorer more secure - I downloaded and installed NoScript for Firefox I had some errors though; When I tried to click on the "Fichiers temp" button in ToolsCleaner2, it had an error (52 or 53). When I tried to click on the "Recherche" button in ToolsCleaner2, it had an error (52 or 53) Other than that, my computer seems to be running fine. Thanks for all your help!

CatByte

Post #24June 17, 2009, 8:52 AM UTC

Ok, any tools left to clean up? It could be none were remaining, that's why it threw up the error. If there are any unwanted folders or tools left on your desktop from what we have done, just delete them manually. You are quite welcome. Stay safe

CatByte

Post #25June 20, 2009, 1:54 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] inetinfo.exe crashes

✨ Ask AI

Ask AI