What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Trojan win32 TDSS on my machine

43 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have Trojan win32.TDSS viruses on my home machine. I've run Spybot Search and Destroy, and Ad Aware and Defender, and Malware Bites, and Spybot and Malware find the Trojans but can't seem to eliminate them. There are 2 that always show up, no matter what. Even my anti-virus Mcafee program finds them but can't get rid of them.




I've run Hijack This, and the Log follows:



Scan saved at 10:38:22 PM, on 8/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4pnp.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\PROGRA~1\VISION~1\ONETOU~2.EXE
C:\WINDOWS\system32\NVAREM.EXE
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Microsoft Location Finder\LocationFinder.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\3com\Connection Assistant\bin\mpbtn.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\System32\3Com_DMI\3CDMINIC.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMemCrdMgr.exe
C:\Program Files\Analog Devices\SoundMAX\smagent.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\x10nets.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Defraggler\Defraggler.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/explore.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Ask.com Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Ask.com Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\Smax4pnp.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~1\ONETOU~2.EXE
O4 - HKLM\..\Run: [NVIDIA Remote Control Panel] "NVAREM.EXE" /S /Q /R /L /A1 /B0 /C0 /D2 /E0
O4 - HKLM\..\Run: [MimBoot] "C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [PDUiP6000DMon] "C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe"
O4 - HKLM\..\Run: [PDUiP6000DTskbr] "C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe"
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WINSCHEDULER] "C:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Ad-Watch] "C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [PPWebCap] "C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe"
O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe"
O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [PPWebCap] "C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe" (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe" (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" (User '?')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User '?')
O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User '?')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user')
O4 - S-1-5-21-1715567821-602162358-682003330-1004 Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User '?')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: NaturalColorLoad.lnk = C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O4 - Global Startup: 3Com Connection Assistant.lnk = C:\Program Files\3com\Connection Assistant\bin\matcli.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Search - ?p=ZUfox000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Rick Deno\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupd806.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
O16 - DPF: {59131903-4A33-40D5-80C2-5242DD365AB3} - http://www.swissquake.ch/chumbalum-soft/fi…3DViewerOCX.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINDOWS\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Update Service (gupdate1c9a5ad82bf7822) (gupdate1c9a5ad82bf7822) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Canon PIXMA iP6000D Memory Card Manager (PDUiP6000DMemCrdMgr) - CANON INC. - C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMemCrdMgr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\smagent.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\WINDOWS\system32\x10nets.exe

–
End of file - 16857 bytes


Please help remove these for me!

Rick
Post #2
Due, in part, to the large numbers of HJT logs being posted, there are four things that you need to be aware of.

1) If you have already posted this log at another forum, you need to post here that you have done so and this topic will be closed.
Multiple posting not only ties up valuable resources, but could also result is some unpleasant side-effects for your system if you follow two sets of instructions at the same time.
If, during research, an identical log is identified at another forum, this thread will be closed.

2) If you don't post a meaningful reply to any of my posts within five days, this thread will be closed. Due to limited free time I can only have so many open threads at any one time and if yours isn't active, somebody else's will be.
If, by omission, the thread hasn't be closed after five days and you post, it will just serve as a reminder to me to close it.
Please note that "I just dropped in to say Hi!" isn't a meaningful reply!

3) Malware removal is a tricky business, and malware writers don't tend to worry about the damage their creations do, so it is advisable to back-up all important files BEFORE we start. Although most cases have a successful conclusion, on occasion things don't go according to plan and it is better to be prepared for the worst.

4) Back-ups can get lost or damaged, so make two if the files are that important to you!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pay a visit to the Kaspersky Online Scanner 7 - I.E. is preferred for this scan.
  • Read the Information panel and then click Accept.
  • Allow the ActiveX download if necessary.
  • Both the anti-virus engine and database will need to be downloaded, which may take a little time.
  • Once this has been completed, select My Computer from the Scan section on the left hand side.
  • Put the kettle on!
  • Although it is recommended by Kaspersky that you should disable your anti-virus scanner before starting this scan, it should work OK with it still active - it does on my PC.
    Although you may find the scan speed increases if you carry out this step, I never like to disable my resident scanner while online, so I don't.
  • When the scan has completed, click View scan report at the bottom.
  • Click Save Report As…
  • Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
  • Click Save and pick a location for the file - the Desktop is always handy.
Copy and paste the report into your next reply along with a fresh HJT log, run in Normal Mode, and a description of how your PC is behaving.

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download Sec-Info2.zip from here and save it to your Desktop. You will need to extract the file.

Right click on the zipped folder and from the menu that appears, click on Extract All…
In the 'Extraction Wizard' window that opens, click on Next> and in the next window that appears, click on Next> again.
In the final window, click on Finish

You should now see a folder with a file in it - double click Sec-info2.vbs to run it.
Once you have been informed that the script has completed, a text file called Sec-Info.txt should be created in the same folder - you may need to wait a couple of seconds for it to appear..
Please copy and paste the contents of the text file into your next reply and then you can delete both of the folders and their contents.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Run HJT and click on Open the Misc Tools section.
  • Click Open Uninstall Manager…
  • Click Save list… and save it to your Desktop.
  • Copy and paste the file uninstall_list.txt into your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download Rooter.exe from here and save it to your Desktop.
  • Double-click it to start the tool.
  • Click the Scan button to… well… scan - obvious really!
  • Once complete, a Notepad file containing the report will open; a copy of which can be found at C:\Rooter$\Rooter.txt - assuming your main drive is C: of course.
  • Please post the contents of Rooter.txt in your next reply.
Post #3
Dear Novociate
Thanks for your help!

I tried to run the Kaspersky Scanner 7 and it would not complete the updated database. I did not see anything regarding an ActiveX download on the download web site. Is there another program to do the scan?
Enclosed are the other programs text docs requested, which all worked well.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:45:03 AM, on 8/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\SoundMAX\smax4.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4pnp.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\PROGRA~1\VISION~1\ONETOU~2.EXE
C:\WINDOWS\system32\NVAREM.EXE
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Microsoft Location Finder\LocationFinder.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\3com\Connection Assistant\bin\mpbtn.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\WINDOWS\System32\3Com_DMI\3CDMINIC.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMemCrdMgr.exe
C:\Program Files\Analog Devices\SoundMAX\smagent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\x10nets.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\PROGRA~1\mcafee\msc\mcshell.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/explore.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Ask.com Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Ask.com Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\smax4.exe" /tray
O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\Smax4pnp.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~1\ONETOU~2.EXE
O4 - HKLM\..\Run: [NVIDIA Remote Control Panel] "NVAREM.EXE" /S /Q /R /L /A1 /B0 /C0 /D2 /E0
O4 - HKLM\..\Run: [MimBoot] "C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [PDUiP6000DMon] "C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe"
O4 - HKLM\..\Run: [PDUiP6000DTskbr] "C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe"
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WINSCHEDULER] "C:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Ad-Watch] "C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [PPWebCap] "C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe"
O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe"
O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [PPWebCap] "C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe" (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe" (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" (User '?')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User '?')
O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User '?')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user')
O4 - S-1-5-21-1715567821-602162358-682003330-1004 Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User '?')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: NaturalColorLoad.lnk = C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O4 - Global Startup: 3Com Connection Assistant.lnk = C:\Program Files\3com\Connection Assistant\bin\matcli.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Search - ?p=ZUfox000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Rick Deno\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupd806.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
O16 - DPF: {59131903-4A33-40D5-80C2-5242DD365AB3} - http://www.swissquake.ch/chumbalum-soft/fi…3DViewerOCX.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINDOWS\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Update Service (gupdate1c9a5ad82bf7822) (gupdate1c9a5ad82bf7822) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Canon PIXMA iP6000D Memory Card Manager (PDUiP6000DMemCrdMgr) - CANON INC. - C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMemCrdMgr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\smagent.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\WINDOWS\system32\x10nets.exe

–
End of file - 16649 bytes




Script run: 8/11/2009 10:17:56 PM

~~~~~~~~~~~~~~~~~~~~~~~~

On-Access Scanning Enabled: Yes
Product up-to-date: Yes

~~~~~~~~~~~~~~~~~~~~~~~~

Enabled: Yes

~~~~~~~~~~~~~~~~~~~~~~~~

The Windows Firewall is enabled.

~~~~~~~~~~~~~~~~~~~~~~~~

The Security Center Firewall Alerts are enabled.

~~~~~~~~~~~~~~~~~~~~~~~~


~~~~~~~~~~~~~~~~~~~~~~~~


Script run: 8/11/2009 10:18:31 PM

~~~~~~~~~~~~~~~~~~~~~~~~

On-Access Scanning Enabled: Yes
Product up-to-date: Yes

~~~~~~~~~~~~~~~~~~~~~~~~

Enabled: Yes

~~~~~~~~~~~~~~~~~~~~~~~~

The Windows Firewall is enabled.

~~~~~~~~~~~~~~~~~~~~~~~~

The Security Center Firewall Alerts are enabled.

~~~~~~~~~~~~~~~~~~~~~~~~


~~~~~~~~~~~~~~~~~~~~~~~~


Script run: 8/11/2009 10:18:37 PM

~~~~~~~~~~~~~~~~~~~~~~~~

On-Access Scanning Enabled: Yes
Product up-to-date: Yes

~~~~~~~~~~~~~~~~~~~~~~~~

Enabled: Yes

~~~~~~~~~~~~~~~~~~~~~~~~

The Windows Firewall is enabled.

~~~~~~~~~~~~~~~~~~~~~~~~

The Security Center Firewall Alerts are enabled.

~~~~~~~~~~~~~~~~~~~~~~~~


~~~~~~~~~~~~~~~~~~~~~~~~


Script run: 8/11/2009 10:18:43 PM

~~~~~~~~~~~~~~~~~~~~~~~~

On-Access Scanning Enabled: Yes
Product up-to-date: Yes

~~~~~~~~~~~~~~~~~~~~~~~~

Enabled: Yes

~~~~~~~~~~~~~~~~~~~~~~~~

The Windows Firewall is enabled.

~~~~~~~~~~~~~~~~~~~~~~~~

The Security Center Firewall Alerts are enabled.

~~~~~~~~~~~~~~~~~~~~~~~~


~~~~~~~~~~~~~~~~~~~~~~~~

3Com Connection Assistant
3Com DMI Agent
Ad-Aware
Ad-Aware
Adobe Acrobat 5.0
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop 6.0
Adobe Reader 8.1.2
Adobe SVG Viewer
Apple Software Update
Ask.com Toolbar
ASUS Probe V2.21.07
AsusUpdate
AudibleManager
AutoCAD 2004
AutoCAD Express Tools Volumes 1-9
Autodesk Express Viewer
Autodesk Revit Building 8
CA Yahoo! Anti-Spy (remove only)
Canon Camera Access Library
Canon Digital Camera Solution Disk 40-46 Software Starter Guide
CANON iMAGE GATEWAY Task for ZoomBrowser EX
Canon Internet Library for ZoomBrowser EX
Canon IXY 320, PowerShot S230, IXUS v3 WIA Driver
Canon MOV Decoder
Canon MOV Encoder
Canon MovieEdit Task for ZoomBrowser EX
Canon Personal Printing Guide
Canon PhotoRecord
Canon PIXMA iP6000D
Canon PIXMA iP6000D Memory Card Utility
Canon Utilities CameraWindow
Canon Utilities CameraWindow DC
Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
Canon Utilities Easy-PhotoPrint
Canon Utilities FileViewerUtility 1.0
Canon Utilities MyCamera
Canon Utilities MyCamera DC
Canon Utilities PhotoStitch
Canon Utilities RemoteCapture 2.6
Canon Utilities RemoteCapture Task for ZoomBrowser EX
Canon Utilities ZoomBrowser EX
Canon ZoomBrowser EX Memory Card Utility
CCleaner (remove only)
ClickArt® Fonts 2
Creative MediaSource 5
Creative MuVo V100
Creative System Information
Critical Update for Windows Media Player 11 (KB959772)
Dawn Of War DEMO
DeductionPro 2006
DeductionPro 2007
DeductionPro 2008
Defraggler (remove only)
Desktop Doctor
Digital Camera Driver
DocuCom PDF Driver
DVD Decrypter (Remove Only)
DVD Shrink 3.2
DWGgateway
Easy CD & DVD Creator 6
Easy-WebPrint
ffdshow [rev 1692] [2007-12-09]
Global MU Online
Google Apps
Google Earth
Google SketchUp 7
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Update Helper
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Interbank FX Trader 4.00
InterVideo WinDVD 4
InterVideo WinDVD Creator
InterVideo WinDVR
InterVideo WinRip
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java™ 6 Update 13
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7
Java™ SE Runtime Environment 6 Update 1
Lexmark Supplies Monitor
Macromedia Shockwave Player
Malwarebytes' Anti-Malware
McAfee SecurityCenter
Media Menu
Media Menu Patch
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Fighter Ace II
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Location Finder
Microsoft Midtown Madness 2
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 SR-1 Premium
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.5.2)
MSN Money Investment Toolbox
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 and SOAP Toolkit 3.0
Musicmatch® Jukebox
Natural Color
NVDVD
NVIDIA Display Driver
NVIDIA Drivers
NVIDIA WDM Drivers
NVIDIA Windows 2000/XP Display Drivers
NVRemote
OpenOffice.org 3.0
Opera 9.64
PaperPort 7.02
Pdf995 (installed by TaxCut)
PdfEdit995 (installed by TaxCut)
Picasa 2
QuickTime
RealPlayer
RegCure 1.6.0.0
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB973346)
SigmaTel MSCNMMC Audio Player
SoundMAX
Spybot - Search & Destroy
Star Wars Battlefront II
TaxCut 2003
TaxCut 2004
TaxCut Deluxe 2005
TaxCut Premium + State + Efile 2008
TaxCut Premium + State 2007
TaxCut Premium 2006
TBS WMP Plug-in
Ulead DVD MovieFactory 2 SE
Ulead VideoStudio 6 SE DVD
Uninstall Windows 9x USB 2.0 Support
Update for Windows Internet Explorer 8 (KB971180)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
VIA Integrated Setup Wizard
Visioneer 8100 Scanner
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Voice Editor
WILLPower v6
Windows Defender
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 10 Hotfix - KB895316
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 3
WinZip
Yahoo! Messenger
Yahoo! Toolbar

Rooter.exe (v1.0.2) by Eric_71
.
SeDebugPrivilege granted successfully …
.
Windows XP Home Edition (5.1.2600) Service Pack 3
[32_bits] - x86 Family 15 Model 2 Stepping 9, GenuineIntel
.
[wscsvc] (Security Center) RUNNING (state:4)
[SharedAccess] RUNNING (state:4)
Windows Firewall -> Enabled
.
Internet Explorer 8.0.6001.18702
Mozilla Firefox 3.5.2 (en-US)
.
A:\ [Removable]
C:\ [Fixed-FAT32] .. ( Total:186 Go - Free:72 Go )
D:\ [CD_Rom]
E:\ [Fixed-NTFS] .. ( Total:111 Go - Free:86 Go )
G:\ [Removable]
.
Scan : 22:23.59
Path : C:\Documents and Settings\Rick Deno\Desktop\Rooter.exe
User : Rick Deno ( Administrator -> YES )
.
———————-\\ Processes
.
Locked [System Process] (0)
______ System (4)
______ \SystemRoot\System32\smss.exe (472)
______ \??\C:\WINDOWS\system32\csrss.exe (536)
______ \??\C:\WINDOWS\system32\winlogon.exe (560)
______ C:\WINDOWS\system32\services.exe (612)
______ C:\WINDOWS\system32\lsass.exe (624)
______ C:\WINDOWS\system32\svchost.exe (788)
______ C:\WINDOWS\system32\svchost.exe (856)
______ C:\Program Files\Windows Defender\MsMpEng.exe (972)
______ C:\WINDOWS\System32\svchost.exe (1012)
______ C:\WINDOWS\system32\svchost.exe (1056)
______ C:\WINDOWS\System32\svchost.exe (1172)
______ C:\WINDOWS\System32\svchost.exe (1380)
______ C:\WINDOWS\Explorer.EXE (1424)
______ C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (1500)
______ C:\WINDOWS\system32\spoolsv.exe (1572)
______ C:\Program Files\Analog Devices\SoundMAX\smax4.exe (1820)
______ C:\Program Files\Analog Devices\SoundMAX\Smax4pnp.exe (1828)
______ C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe (1844)
______ C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe (1852)
______ C:\PROGRA~1\VISION~1\ONETOU~2.EXE (1864)
______ C:\WINDOWS\system32\NVAREM.EXE (1872)
______ C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe (1896)
______ C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe (1916)
______ C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe (1928)
______ C:\WINDOWS\system32\RUNDLL32.EXE (1936)
______ C:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE (1948)
______ C:\Program Files\Support.com\bin\tgcmd.exe (1984)
______ C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (2004)
______ C:\Program Files\Java\jre6\bin\jusched.exe (120)
______ C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe (184)
______ C:\Program Files\Windows Defender\MSASCui.exe (204)
______ C:\Program Files\Messenger\MSMSGS.EXE (248)
______ C:\Program Files\Microsoft Location Finder\LocationFinder.exe (356)
______ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (380)
______ C:\WINDOWS\system32\ctfmon.exe (408)
______ C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (444)
______ C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe (500)
______ C:\Program Files\VIA\RAID\raid_tool.exe (952)
______ C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe (676)
______ C:\Program Files\Microsoft Office\Office\1033\msoffice.exe (1404)
______ C:\Program Files\WinZip\WZQKPICK.EXE (1408)
______ C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe (1684)
______ C:\Program Files\3com\Connection Assistant\bin\mpbtn.exe (2124)
______ C:\Program Files\OpenOffice.org 3\program\soffice.exe (2168)
______ C:\Program Files\OpenOffice.org 3\program\soffice.bin (2324)
______ C:\WINDOWS\System32\svchost.exe (2532)
______ C:\WINDOWS\System32\3Com_DMI\3CDMINIC.EXE (2564)
______ C:\WINDOWS\system32\CTsvcCDA.exe (2584)
______ C:\Program Files\Java\jre6\bin\jqs.exe (2640)
______ C:\Program Files\Google\Update\GoogleUpdate.exe (2668)
______ C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe (2688)
______ c:\program files\common files\mcafee\mna\mcnasvc.exe (2828)
______ c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (2952)
______ C:\Program Files\McAfee\VirusScan\McShield.exe (3048)
______ C:\Program Files\McAfee\MPF\MPFSrv.exe (3108)
______ C:\WINDOWS\system32\nvsvc32.exe (3216)
______ C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMemCrdMgr.exe (3300)
______ C:\Program Files\Analog Devices\SoundMAX\smagent.exe (3444)
______ C:\WINDOWS\System32\svchost.exe (3500)
______ C:\WINDOWS\System32\MsPMSPSv.exe (3540)
______ c:\PROGRA~1\mcafee.com\agent\mcagent.exe (3628)
______ C:\Program Files\Canon\CAL\CALMAIN.exe (3852)
______ C:\WINDOWS\system32\x10nets.exe (1964)
______ C:\WINDOWS\System32\alg.exe (888)
______ C:\WINDOWS\system32\wscntfy.exe (2436)
______ C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe (3848)
______ C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (3368)
______ C:\WINDOWS\System32\svchost.exe (3884)
______ C:\Program Files\Internet Explorer\iexplore.exe (864)
______ C:\Program Files\Internet Explorer\iexplore.exe (2212)
______ C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE (4648)
______ C:\Program Files\Trend Micro\HijackThis\HijackThis.exe (4480)
______ C:\Program Files\Internet Explorer\iexplore.exe (6060)
______ C:\Documents and Settings\Rick Deno\Desktop\Rooter.exe (4544)
.
———————-\\ Device\Harddisk0\
.
\Device\Harddisk0 [Sectors : 63 x 512 Bytes]
.
\Device\Harddisk0\Partition1 –[ MBR ]– (Start_Offset:32256 | Length:200047002624)
.
———————-\\ Scheduled Tasks
.
C:\WINDOWS\Tasks\DESKTOP.INI
C:\WINDOWS\Tasks\SA.DAT
C:\WINDOWS\Tasks\Tune-up Application Start.job
C:\WINDOWS\Tasks\Google Software Updater.job
C:\WINDOWS\Tasks\MP Scheduled Scan.job
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job
C:\WINDOWS\Tasks\Symantec NetDetect.job
C:\WINDOWS\Tasks\RegCure Startup.job
C:\WINDOWS\Tasks\RegCure Program Check.job
C:\WINDOWS\Tasks\McQcTask.job
C:\WINDOWS\Tasks\McDefragTask.job
C:\WINDOWS\Tasks\Pareto UNS.job
C:\WINDOWS\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job
C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
C:\WINDOWS\Tasks\RegCure.job
.
———————-\\ Registry
.
.
———————-\\ Files & Folders
.
———————-\\ Scan completed at 22:24.12
.
C:\Rooter$\Rooter_1.txt - (11/08/2009 | 22:24.12)



Let me know if theres anything else to do.

Thanks

Rick
Post #4
Apologies, Kav is poorly-sick at the minute and nobody seems to be able to get it to run. Take a trip to this webpage for download links and instructions for running Combofix by sUBs: http://www.bleepingcomputer.com/combofix/how-to-use-combofix *
  • Please be aware that this tool may require the PC to be rebooted so close any programs you have open before you start.
  • When CF has finished, it will produce a log - C:\ComboFix.txt - copy and paste it into your next reply.
  • Post a fresh HJT log as well.
  • Let me know how the PC is behaving.
* There are two points to note from the instructions page:

1) The Recovery Console.

It is recommended that you install this as, in certain circumstances, it may be the difference between a successful repair and a reformat. If you are uncertain as to whether or not you already have the Recovery Console installed, simply run CF and it will prompt you if it does not detect it.
CF will complete some, but not all, of it's removal tasks without the installation of the Console, so you are free to choose whether you want to complete this step, but it is in your interests to do so.

2) Disabling your Anti-Virus.

CF has been the victim of false-positive detections on occasion and a resident AV may incorrectly identify and delete part of the tool which won't do it much good. If you don't disable your AV, you may not get the results you hoped for!
Post #5
Hi

As for how my machine is running. Not so well although speed is OK. I periodically get these little yellow triangles with exclamation points in them, saying I have a corrupt file such and such (always a different file it seems). I’ve run Ccleaner and have no problems there. I also get these various warnings from my Spybot that I’m about to open a dangerous page (not the page I was opening on my web browser). Also, for some reason, my Firefox is goofed up with Google trying to reconfigure my Firefox every time I open it. Very irritating. I also get this fake anti virus warning saying I’m under attack and I need to download some program…..
Also, combofix said "overlay aborted, run again…should I?

Rick



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:38:08 PM, on 8/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\3Com_DMI\3CDMINIC.EXE
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMemCrdMgr.exe
C:\Program Files\Analog Devices\SoundMAX\smagent.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4pnp.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\WINDOWS\system32\NVAREM.EXE
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe
C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE
C:\Program Files\Support.com\bin\tgcmd.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Microsoft Location Finder\LocationFinder.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\WINDOWS\system32\x10nets.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Microsoft Office\Office\1033\msoffice.exe
C:\Program Files\3com\Connection Assistant\bin\mpbtn.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\PROGRA~1\3com\CONNEC~1\COMMON\MOTIVE~1.EXE
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/explore.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Ask.com Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Ask.com Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\Smax4pnp.exe"
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [OneTouch Monitor] C:\PROGRA~1\VISION~1\ONETOU~2.EXE
O4 - HKLM\..\Run: [NVIDIA Remote Control Panel] "NVAREM.EXE" /S /Q /R /L /A1 /B0 /C0 /D2 /E0
O4 - HKLM\..\Run: [MimBoot] "C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [PDUiP6000DMon] "C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe"
O4 - HKLM\..\Run: [PDUiP6000DTskbr] "C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe"
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WINSCHEDULER] "C:\PROGRA~1\INTERV~1\WinDVR\WINSCH~1.EXE"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe" /server /startmonitor /deaf
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Ad-Watch] "C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [PPWebCap] "C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe"
O4 - HKCU\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe"
O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [PPWebCap] "C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe" (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [Microsoft Location Finder] "C:\Program Files\Microsoft Location Finder\LocationFinder.exe" (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (User '?')
O4 - HKUS\S-1-5-21-1715567821-602162358-682003330-1004\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" (User '?')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User '?')
O4 - HKUS\S-1-5-18\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User '?')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RealUpgradeHelper] "C:\Program Files\Common Files\Real\Update_OB\upgrdhlp.exe" "RealNetworks|RealPlayer|6.0" (User 'Default user')
O4 - S-1-5-21-1715567821-602162358-682003330-1004 Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe (User '?')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: NaturalColorLoad.lnk = C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O4 - Global Startup: 3Com Connection Assistant.lnk = C:\Program Files\3com\Connection Assistant\bin\matcli.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Search - ?p=ZUfox000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Rick Deno\Start Menu\Programs\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.mcafee.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupd806.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
O16 - DPF: {59131903-4A33-40D5-80C2-5242DD365AB3} - http://www.swissquake.ch/chumbalum-soft/fi…3DViewerOCX.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: 3Com DMI Agent (3ComDMIService) - 3Com Corporation - C:\WINDOWS\System32\3Com_DMI\3CDMINIC.EXE
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Update Service (gupdate1c9a5ad82bf7822) (gupdate1c9a5ad82bf7822) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Canon PIXMA iP6000D Memory Card Manager (PDUiP6000DMemCrdMgr) - CANON INC. - C:\Program Files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMemCrdMgr.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\smagent.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\WINDOWS\system32\x10nets.exe

–
End of file - 15922 bytes
ComboFix 09-08-10.06 - Rick Deno 08/12/2009 18:06.1.2 - FAT32x86
Running from: c:\documents and settings\[removed]\Local Settings\Application Data\Opera\Opera\profile\cache4\temporary_download\ComboFix.exe
* Created a new restore point
.

Overlay aborted … Please run ComboFix once more
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Arj.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\ArjPack.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\avlib.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Avp1.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\AVP3Info.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\AvpMgr.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\avs.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\avspm.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Base64.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Base64P.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\btdisk.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\btimages.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\buffer.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\CAB.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\crpthlpr.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\deflate.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\dmap.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\dtreg.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Explode.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\farbuffer.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\faristream.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\FsDrvPlg.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\FSSync.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\HashCont.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\HashMD5.PPL
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\HCCMP.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\ichk2.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\iChkSA.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\ikave.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Inflate.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\IniFile.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\IWGen.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\kave.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\klavsrch.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\kosglue-7.0.25.0.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\L_llio.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\lha.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\lic60.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\LicMgr.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\MailMsg.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\mc.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\mdb.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\MDMAP.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\MemModSc.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\MemScan.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\minizip.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\MKavIO.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\msoe.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\msvcm80.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\msvcp80.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\msvcr80.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\ndetect.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\nfio.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\NTFSstrm.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\ods.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\params.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\passdmap.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\prKernel.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\prLoader.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\procmon.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\prremote.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\prseqio.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\PrUpdate.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\PrUtil.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Quantum.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\rar.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\ScanningProcess.exe
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\schedule.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\sfdb.PPL
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\StdComp.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\StEnum2.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\stored.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\superio.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\TempFile.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\thpimpl.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Timer.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\tm.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\UnArj.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\UniArc.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\UnLZX.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Unreduce.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\UNSHRINK.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\UnStored.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\WDiskIO.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\WinReg.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\xorio.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\engine\bases\avcmhk5.mhk
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Arj.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\ArjPack.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\avlib.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Avp1.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\AVP3Info.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\AvpMgr.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\avs.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\avspm.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Base64.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Base64P.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\btdisk.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\btimages.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\buffer.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\CAB.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\crpthlpr.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\deflate.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\dmap.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\dtreg.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Explode.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\farbuffer.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\faristream.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\FsDrvPlg.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\FSSync.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\HashCont.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\HashMD5.PPL
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\HCCMP.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\ichk2.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\iChkSA.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\ikave.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Inflate.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\IniFile.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\IWGen.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\kave.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\klavsrch.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\kosglue-7.0.25.0.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\L_llio.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\lha.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\lic60.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\LicMgr.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\MailMsg.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\mc.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\mdb.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\MDMAP.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\MemModSc.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\MemScan.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\minizip.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\MKavIO.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\msoe.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\msvcm80.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\msvcp80.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\msvcr80.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\ndetect.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\nfio.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\NTFSstrm.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\ods.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\params.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\passdmap.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\prKernel.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\prLoader.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\procmon.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\prremote.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\prseqio.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\PrUpdate.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\PrUtil.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Quantum.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\rar.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\ScanningProcess.exe
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\schedule.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\sfdb.PPL
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\StdComp.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\StEnum2.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\stored.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\superio.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\TempFile.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\thpimpl.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Timer.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\tm.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\UnArj.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\UniArc.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\UnLZX.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Unreduce.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\UNSHRINK.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\UnStored.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\WDiskIO.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\WinReg.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\xorio.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\engine\bases\avcmhk5.mhk
c:\windows\Installer\375ae.msi
c:\windows\start.exe
c:\windows\Web\default.htt



.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_MYWEBSEARCHSERVICE


((((((((((((((((((((((((( Files Created from 2009-07-13 to 2009-08-13 )))))))))))))))))))))))))))))))
.

2009-08-13 01:28 . 2009-08-13 01:28 84 —ha-w- c:\windows\system32\x10prod.sys
2009-08-12 06:08 . 2009-08-12 06:08 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
2009-08-12 05:24 . 2009-08-12 05:24 ——– d—–w- C:\Rooter$
2009-08-11 02:09 . 2009-08-11 02:09 ——– d—–w- c:\program files\Defraggler
2009-08-11 02:00 . 2009-08-11 02:00 ——– d—–w- c:\program files\CCleaner
2009-08-11 01:19 . 2009-08-11 01:19 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-08-09 17:53 . 2009-08-09 17:53 ——– d—–w- c:\documents and settings\Rick Deno\Local Settings\Application Data\Opera
2009-08-09 17:53 . 2009-08-09 17:53 ——– d—–w- c:\program files\Opera
2009-08-09 15:31 . 2009-08-09 15:31 ——– d—–w- c:\windows\system32\NtmsData
2009-08-09 14:38 . 2009-08-09 14:38 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\RegCure
2009-08-09 14:38 . 2009-08-09 14:38 ——– d—–w- c:\program files\RegCure
2009-08-09 14:15 . 2009-08-09 14:15 ——– d—–w- c:\program files\Trend Micro
2009-08-09 14:11 . 2009-08-03 20:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-09 14:10 . 2009-08-09 14:11 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-08-09 14:10 . 2009-08-03 20:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-08-08 21:27 . 2009-08-08 21:27 ——– d—–w- c:\program files\MSXML 4.0
2009-08-08 16:21 . 2009-08-08 16:21 ——– d—–w- c:\documents and settings\Rick Deno\Local Settings\Application Data\Downloaded Installations
2009-08-08 15:08 . 2009-08-08 15:08 ——– d—–w- c:\documents and settings\Rick Deno\Local Settings\Application Data\AskToolbar
2009-08-08 15:08 . 2009-08-08 15:08 ——– d—–w- c:\windows\LastGood(2)
2009-08-08 15:01 . 2009-08-08 15:01 ——– d—–w- c:\program files\Ask.com
2009-08-08 15:00 . 2009-08-08 15:00 ——– d—–w- c:\program files\MSSOAP
2009-08-08 15:00 . 2009-08-08 15:00 ——– d—–w- c:\program files\Webroot
2009-08-08 14:59 . 2009-08-08 14:59 164 —-a-w- c:\windows\install.dat
2009-08-08 06:44 . 2009-08-08 06:44 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2009-08-08 06:44 . 2009-08-08 06:44 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-08-08 06:44 . 2009-08-08 06:44 ——– d—–w- c:\documents and settings\Rick Deno\Application Data\SUPERAntiSpyware.com
2009-08-08 05:11 . 2009-08-08 05:11 ——– d—–w- c:\program files\Windows Defender
2009-08-07 06:14 . 2009-08-07 06:14 ——– d—–w- c:\documents and settings\Rick Deno\Application Data\Uniblue
2009-08-07 01:29 . 2009-08-07 01:29 ——– d-sh–w- c:\documents and settings\Default User\IETldCache
2009-08-07 01:29 . 2009-08-07 01:29 ——– d—–w- c:\windows\system32\XPSViewer
2009-08-07 01:29 . 2009-08-07 01:29 ——– d—–w- c:\program files\MSBuild
2009-08-07 01:29 . 2009-08-07 01:29 ——– d—–w- c:\program files\Reference Assemblies
2009-08-07 01:28 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-07 01:28 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2009-08-07 01:28 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-07 01:28 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2009-08-07 01:28 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-07 01:28 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-08-07 01:28 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2009-07-25 06:40 . 2009-07-25 06:40 ——– d—–w- c:\documents and settings\Rick Deno\Application Data\vlc
2009-07-25 05:03 . 2009-07-25 05:04 ——– d—–w- c:\documents and settings\Rick Deno\Local Settings\Application Data\Graboid_Inc
2009-07-25 05:03 . 2009-07-25 05:03 ——– d—–w- c:\documents and settings\Rick Deno\Application Data\MozillaControl
2009-07-25 05:03 . 2009-07-25 05:03 ——– d—–w- c:\documents and settings\Rick Deno\Local Settings\Application Data\Graboid
2009-07-25 05:03 . 2009-07-25 05:03 ——– d—–w- c:\program files\Mozilla ActiveX Control v1.7.12
2009-07-25 05:03 . 2009-07-25 05:03 ——– d—–w- c:\program files\VideoLAN
2009-07-25 05:02 . 2009-07-25 05:02 ——– d—–w- c:\program files\Graboid

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-07 12:42 . 2005-07-02 06:55 90440 —-a-w- c:\documents and settings\Rick Deno\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-03 08:05 . 2006-03-05 23:05 21840 —-a-w- c:\windows\system32\SIntfNT.dll
2009-08-03 08:05 . 2006-03-05 23:05 17212 —-a-w- c:\windows\system32\SIntf32.dll
2009-08-03 08:05 . 2006-03-05 23:05 12067 —-a-w- c:\windows\system32\SIntf16.dll
2009-07-03 17:09 . 2005-04-27 17:54 915456 —-a-w- c:\windows\system32\wininet.dll
2009-06-16 14:36 . 2005-07-02 03:11 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2005-07-02 03:09 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-07 16:43 . 2009-03-15 18:49 15688 —-a-w- c:\windows\system32\lsdelete.exe
2009-06-03 19:09 . 2005-07-02 03:10 1291264 —-a-w- c:\windows\system32\quartz.dll
2005-07-01 03:37 . 2005-07-01 03:37 11079 —h–w- c:\program files\folder.htt
.

——- Sigcheck ——-

[-] 2008-04-14 00:12 82432 A653D56E4D0EEE64FC846915F3524E81 c:\windows\SYSTEM32\ws2_32.dll
[-] 2008-04-14 00:12 82432 A653D56E4D0EEE64FC846915F3524E81 c:\windows\SYSTEM32\dllcache\ws2_32.dll
[7] 2004-08-04 07:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\$NtServicePackUninstall$\ws2_32.dll
[-] 2008-04-14 00:12 82432 A653D56E4D0EEE64FC846915F3524E81 c:\windows\ServicePackFiles\i386\ws2_32.dll


c:\windows\system32\appmgmts.dll … is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-02-09 22:06 764296 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay]
@="{7D688A77-C613-11D0-999B-00C04FD655E1}"
[HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}]
2008-06-17 18:02 8461312 —-a-w- c:\windows\SYSTEM32\shell32.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" [2008-04-14 1695232]
"PPWebCap"="c:\progra~1\ScanSoft\PAPERP~1\PPWebCap.exe" [2001-08-10 40960]
"Microsoft Location Finder"="c:\program files\Microsoft Location Finder\LocationFinder.exe" [2005-11-06 101064]
"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-05-02 49152]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-19 68856]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-02-04 4363504]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\Smax4pnp.exe" [2003-05-29 790528]
"RoxioEngineUtility"="c:\program files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-02 65536]
"RoxioDragToDisc"="c:\program files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [2003-12-01 868352]
"RoxioAudioCentral"="c:\program files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" [2003-07-15 319488]
"MimBoot"="c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe" [2006-01-19 11776]
"MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-19 110592]
"PDUiP6000DMon"="c:\program files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe" [2004-05-31 57344]
"PDUiP6000DTskbr"="c:\program files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe" [2004-05-28 69632]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2003-05-02 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-05-02 4640768]
"tgcmd"="c:\program files\Support.com\bin\tgcmd.exe" [2007-03-07 1773568]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-29 413696]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-07-11 520024]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-15 185896]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"NVIDIA Remote Control Panel"="NVAREM.EXE" - c:\windows\SYSTEM32\nvarem.exe [2003-07-08 139264]
"nwiz"="nwiz.exe" - c:\windows\SYSTEM32\nwiz.exe [2003-05-02 323584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RealUpgradeHelper"="c:\program files\Common Files\Real\Update_OB\upgrdhlp.exe" [2009-03-15 136768]

c:\documents and settings\Rick Deno\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

c:\docume~1\ALLUSE~1\STARTM~1\Programs\Startup\
NaturalColorLoad.lnk - c:\program files\SEC\Natural Color\NaturalColorLoad.exe [2005-6-30 155715]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2005-6-30 565248]
3Com Connection Assistant.lnk - c:\program files\3com\Connection Assistant\bin\matcli.exe [2005-7-1 208896]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2006-6-26 114688]
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-8-5 113664]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2006-10-9 122880]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\c:\0autocheck autochk *\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
"SoundMAXPnP"=c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe
"SoundMax"="c:\program files\ANALOG DEVICES\SOUNDMAX\SMAX4.EXE" /tray
"ASUS Probe"=c:\program files\ASUS\Probe\AsusProb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\LucasArts\\Star Wars Battlefront II\\GameData\\BattlefrontII.exe"=
"c:\\Program Files\\Steam\\SteamApps\\cskiller45\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Steam\\SteamApps\\cskiller45\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\Steam\\SteamApps\\cskiller45\\day of defeat source\\hl2.exe"=
"c:\\Program Files\\THQ\\Dawn of War DEMO\\W40k.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\WINDOWS\\System32\\WBEM\\unsecapp.exe"=

R2 gupdate1c9a5ad82bf7822;Google Update Service (gupdate1c9a5ad82bf7822);c:\program files\Google\Update\GoogleUpdate.exe [2009-03-15 133104]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-04-26 64160]
S0 viaraid;viaraid;c:\windows\system32\drivers\viaraid.sys [2003-10-21 72192]
S2 3ComDMIService;3Com DMI Agent;c:\windows\System32\3Com_DMI\3CDMINIC.EXE [2003-03-04 114688]
S2 BCAITDI;3Com BCAITDI DMI TDI;c:\windows\system32\DRIVERS\BCAItdi.sys [2002-03-14 19470]
S2 IOPort;IOPort;c:\windows\System32\DRIVERS\IOPORT.SYS [1998-11-28 6144]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-07-11 1029456]
S2 nvTUNEP;nVidia WDM TVTuner;c:\windows\system32\DRIVERS\nvtunep.sys [2003-09-08 20640]
S2 nvtvSND;nVidia WDM TVAudio Crossbar;c:\windows\system32\DRIVERS\nvtvsnd.sys [2003-09-08 22640]
S2 ppsio2;PPDevice; [x]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.comcast.net/explore.html
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Search - ?p=ZUfox000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Rick Deno\Start Menu\Programs\IMVU\Run IMVU.lnk
Trusted Zone: internet
Trusted Zone: mcafee.com
Trusted Zone: musicmatch.com\online
DPF: DirectAnimation Java Classes - file://c:\windows\SYSTEM\dajava.cab
DPF: Internet Explorer Classes for Java - file://c:\windows\SYSTEM\iejava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {59131903-4A33-40D5-80C2-5242DD365AB3} - hxxp://www.swissquake.ch/chumbalum-soft/files/MS3DViewerOCX.cab
FF - ProfilePath - c:\docume~1\RICKDE~1\APPLIC~1\Mozilla\Firefox\Profiles\qihqpyw9.default\

—- FIREFOX POLICIES —-
FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-12 18:28
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …


c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\yö
c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\)é.é°.yc:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\èqrt;-Ér.c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\·uñc:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\jsr ác:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\áîzQ/c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\#êk4D¿c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\úò äh c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\«osbc:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\
Post #7
Hi!


Here ya go, this time it seemed to work, how ever it said " I didn't have enough main memory to complet the sort" I have tons of memory so I'm not sure what that was about….

Rick

PS
I still keep getting corrupt file notices…wierd

ComboFix 09-08-10.06 - Rick Deno 08/13/2009 18:28.2.2 - FAT32x86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Arj.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\ArjPack.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\avlib.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Avp1.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\AVP3Info.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\AvpMgr.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\avs.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\avspm.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Base64.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Base64P.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\btdisk.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\btimages.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\buffer.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\CAB.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\crpthlpr.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\deflate.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\dmap.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\dtreg.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Explode.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\farbuffer.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\faristream.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\FsDrvPlg.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\FSSync.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\HashCont.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\HashMD5.PPL
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\HCCMP.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\ichk2.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\iChkSA.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\ikave.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Inflate.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\IniFile.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\IWGen.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\kave.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\klavsrch.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\kosglue-7.0.25.0.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\L_llio.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\lha.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\lic60.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\LicMgr.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\MailMsg.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\mc.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\mdb.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\MDMAP.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\MemModSc.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\MemScan.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\minizip.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\MKavIO.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\msoe.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\msvcm80.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\msvcp80.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\msvcr80.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\ndetect.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\nfio.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\NTFSstrm.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\ods.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\params.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\passdmap.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\prKernel.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\prLoader.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\procmon.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\prremote.dll
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\prseqio.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\PrUpdate.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\PrUtil.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Quantum.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\rar.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\ScanningProcess.exe
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\schedule.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\sfdb.PPL
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\StdComp.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\StEnum2.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\stored.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\superio.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\TempFile.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\thpimpl.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Timer.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\tm.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\UnArj.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\UniArc.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\UnLZX.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\Unreduce.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\UNSHRINK.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\UnStored.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\WDiskIO.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\WinReg.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\binaries\xorio.ppl
c:\docume~1\RICKDE~1\LOCALS~1\Temp\jkos-Rick Deno\engine\bases\avcmhk5.mhk
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Arj.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\ArjPack.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\avlib.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Avp1.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\AVP3Info.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\AvpMgr.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\avs.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\avspm.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Base64.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Base64P.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\btdisk.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\btimages.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\buffer.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\CAB.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\crpthlpr.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\deflate.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\dmap.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\dtreg.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Explode.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\farbuffer.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\faristream.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\FsDrvPlg.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\FSSync.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\HashCont.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\HashMD5.PPL
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\HCCMP.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\ichk2.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\iChkSA.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\ikave.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Inflate.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\IniFile.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\IWGen.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\kave.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\klavsrch.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\kosglue-7.0.25.0.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\L_llio.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\lha.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\lic60.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\LicMgr.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\MailMsg.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\mc.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\mdb.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\MDMAP.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\MemModSc.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\MemScan.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\minizip.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\MKavIO.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\msoe.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\msvcm80.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\msvcp80.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\msvcr80.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\ndetect.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\nfio.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\NTFSstrm.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\ods.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\params.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\passdmap.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\prKernel.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\prLoader.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\procmon.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\prremote.dll
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\prseqio.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\PrUpdate.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\PrUtil.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Quantum.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\rar.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\ScanningProcess.exe
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\schedule.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\sfdb.PPL
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\StdComp.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\StEnum2.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\stored.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\superio.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\TempFile.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\thpimpl.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Timer.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\tm.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\UnArj.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\UniArc.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\UnLZX.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\Unreduce.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\UNSHRINK.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\UnStored.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\WDiskIO.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\WinReg.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\binaries\xorio.ppl
c:\documents and settings\Rick Deno\Local Settings\Temp\jkos-Rick Deno\engine\bases\avcmhk5.mhk



.
((((((((((((((((((((((((( Files Created from 2009-07-14 to 2009-08-14 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

——- Sigcheck ——-

[-] 2008-04-14 00:12 82432 A653D56E4D0EEE64FC846915F3524E81 c:\windows\SYSTEM32\ws2_32.dll
[-] 2008-04-14 00:12 82432 A653D56E4D0EEE64FC846915F3524E81 c:\windows\SYSTEM32\dllcache\ws2_32.dll
[7] 2004-08-04 07:56 82944 2ED0B7F12A60F90092081C50FA0EC2B2 c:\windows\$NtServicePackUninstall$\ws2_32.dll
[-] 2008-04-14 00:12 82432 A653D56E4D0EEE64FC846915F3524E81 c:\windows\ServicePackFiles\i386\ws2_32.dll


c:\windows\system32\appmgmts.dll … is missing !!
.
((((((((((((((((((((((((((((( SnapShot@2009-08-13_01.28.49 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2009-02-09 22:06 764296 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2009-02-09 764296]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay]
@="{7D688A77-C613-11D0-999B-00C04FD655E1}"
[HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}]
2008-06-17 18:02 8461312 —-a-w- c:\windows\SYSTEM32\shell32.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" [2008-04-14 1695232]
"PPWebCap"="c:\progra~1\ScanSoft\PAPERP~1\PPWebCap.exe" [2001-08-10 40960]
"Microsoft Location Finder"="c:\program files\Microsoft Location Finder\LocationFinder.exe" [2005-11-06 101064]
"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-05-02 49152]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-19 68856]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-02-04 4363504]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\Smax4pnp.exe" [2003-05-29 790528]
"RoxioEngineUtility"="c:\program files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-02 65536]
"RoxioDragToDisc"="c:\program files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [2003-12-01 868352]
"RoxioAudioCentral"="c:\program files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" [2003-07-15 319488]
"MimBoot"="c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe" [2006-01-19 11776]
"MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-19 110592]
"PDUiP6000DMon"="c:\program files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DMon.exe" [2004-05-31 57344]
"PDUiP6000DTskbr"="c:\program files\Canon\Memory Card Utility\PIXMA iP6000D\PDUiP6000DTskbr.exe" [2004-05-28 69632]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2003-05-02 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-05-02 4640768]
"tgcmd"="c:\program files\Support.com\bin\tgcmd.exe" [2007-03-07 1773568]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-29 413696]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-07-11 520024]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-03-15 185896]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]
"NVIDIA Remote Control Panel"="NVAREM.EXE" - c:\windows\SYSTEM32\nvarem.exe [2003-07-08 139264]
"nwiz"="nwiz.exe" - c:\windows\SYSTEM32\nwiz.exe [2003-05-02 323584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RealUpgradeHelper"="c:\program files\Common Files\Real\Update_OB\upgrdhlp.exe" [2009-03-15 136768]

c:\documents and settings\Rick Deno\Start Menu\Programs\Startup\
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

c:\docume~1\ALLUSE~1\STARTM~1\Programs\Startup\
NaturalColorLoad.lnk - c:\program files\SEC\Natural Color\NaturalColorLoad.exe [2005-6-30 155715]
VIA RAID TOOL.lnk - c:\program files\VIA\RAID\raid_tool.exe [2005-6-30 565248]
3Com Connection Assistant.lnk - c:\program files\3com\Connection Assistant\bin\matcli.exe [2005-7-1 208896]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2006-6-26 114688]
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-8-5 113664]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2006-10-9 122880]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /p \??\c:\0autocheck autochk *\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
"SoundMAXPnP"=c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe
"SoundMax"="c:\program files\ANALOG DEVICES\SOUNDMAX\SMAX4.EXE" /tray
"ASUS Probe"=c:\program files\ASUS\Probe\AsusProb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\LucasArts\\Star Wars Battlefront II\\GameData\\BattlefrontII.exe"=
"c:\\Program Files\\Steam\\SteamApps\\cskiller45\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\Steam\\SteamApps\\cskiller45\\half-life 2 deathmatch\\hl2.exe"=
"c:\\Program Files\\Steam\\SteamApps\\cskiller45\\day of defeat source\\hl2.exe"=
"c:\\Program Files\\THQ\\Dawn of War DEMO\\W40k.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\WINDOWS\\System32\\WBEM\\unsecapp.exe"=

R2 gupdate1c9a5ad82bf7822;Google Update Service (gupdate1c9a5ad82bf7822);c:\program files\Google\Update\GoogleUpdate.exe [2009-03-15 133104]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-04-26 64160]
S0 viaraid;viaraid;c:\windows\system32\drivers\viaraid.sys [2003-10-21 72192]
S2 3ComDMIService;3Com DMI Agent;c:\windows\System32\3Com_DMI\3CDMINIC.EXE [2003-03-04 114688]
S2 BCAITDI;3Com BCAITDI DMI TDI;c:\windows\system32\DRIVERS\BCAItdi.sys [2002-03-14 19470]
S2 IOPort;IOPort;c:\windows\System32\DRIVERS\IOPORT.SYS [1998-11-28 6144]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-07-11 1029456]
S2 nvTUNEP;nVidia WDM TVTuner;c:\windows\system32\DRIVERS\nvtunep.sys [2003-09-08 20640]
S2 nvtvSND;nVidia WDM TVAudio Crossbar;c:\windows\system32\DRIVERS\nvtvsnd.sys [2003-09-08 22640]
S2 ppsio2;PPDevice; [x]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.comcast.net/explore.html
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/ymj/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = 127.0.0.1
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Search - ?p=ZUfox000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Rick Deno\Start Menu\Programs\IMVU\Run IMVU.lnk
Trusted Zone: internet
Trusted Zone: mcafee.com
Trusted Zone: musicmatch.com\online
DPF: DirectAnimation Java Classes - file://c:\windows\SYSTEM\dajava.cab
DPF: Internet Explorer Classes for Java - file://c:\windows\SYSTEM\iejava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {59131903-4A33-40D5-80C2-5242DD365AB3} - hxxp://www.swissquake.ch/chumbalum-soft/files/MS3DViewerOCX.cab
FF - ProfilePath - c:\docume~1\RICKDE~1\APPLIC~1\Mozilla\Firefox\Profiles\qihqpyw9.default\

—- FIREFOX POLICIES —-
FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-13 18:46
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …


c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\yö
c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\)é.é°.yc:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\èqrt;-Ér.c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\·uñc:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\jsr ác:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\áîzQ/c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\#êk4D¿c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\úòähc:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\«osbc:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\c:\docume~1\RICKDE~1\LOCALS~1\Temp\svd37.tmp\
Post #8
You have an entry in your log that points to a file on your PC that I would like to have checked - if it is still present.

Please go to Jotti's and click on the Browse… button at the top and navigate to the following file and then click on Submit:

c:\windows\SYSTEM32\ws2_32.dll

When all the scans have been completed, please copy and paste the results into your next reply.

If this site is busy, try VirusTotal: Click the Browse … button, navigate to the file and double click it and then click the Send button.

You may need to set Windows to show All Hidden Files and Folders - Instructions can be found here.
* These files are hidden to stop you accidentally removing something important.
It is advisable to hide them again after you have done. *

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Open a Command Window: go to Start > Run… and enter cmd into the textbox and click OK
Copy and paste the following into the window and hit :

dir /a /s \appmgmts.dll > "%userprofile%\desktop\loggy.txt"

After a short while you should see a text file called loggy.txt appear on your Desktop. I'd like a copy of the contents in your next reply.
Post #9
Noviciate,
Here ya go, I did both procedures…..
Thanks for your help!!!!

Rick

Loggy text

Volume in drive C has no label.
Volume Serial Number is 0625-1BF1

VirusTotal
File ws2_32.dll received on 2009.08.15 02:55:29 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.24 2009.08.14 Trojan.Patched!IK
Avast 4.8.1335.0 2009.08.14 Win32:Patched-KW
AVG 8.5.0.406 2009.08.14 Win32/Patched
BitDefender 7.2 2009.08.15 Trojan.Patched.EM
GData 19 2009.08.15 Trojan.Patched.EM
Ikarus T3.1.1.64.0 2009.08.14 Trojan.Patched
Microsoft 1.4903 2009.08.15 Trojan:Win32/Patched.L
Sophos 4.44.0 2009.08.15 Mal/WSHack-A
Additional information
File size: 82432 bytes
MD5…: a653d56e4d0eee64fc846915f3524e81
SHA1..: cfaceadd0f127da9acf5e0ad2f83b2038a148275
SHA256: 7d434b64bf935987a0fa10d191141e82ec3b323bc32c844aecbe59592d059996
ssdeep:
1536:cRqRCOAJcBuyg2m1htxvSrqtkBx5sALnR4lxCyqoHYP:cR08JKBm1hrvSrM
kBx5swR41/

PEiD..: -
TrID..: File type identification
Win64 Executable Generic (59.6%)
Win32
Executable MS Visual C++ (generic) (26.2%)
Win32 Executable Generic (5.9%)

Win32 Dynamic Link Library (generic) (5.2%)
Generic Win/DOS Executable
(1.3%)
PEInfo: PE Structure information

( base data )
entrypointaddress.:
0x141a1
timedatestamp…..: 0x4802a164 (Mon Apr 14 00:12:20 2008)

machinetype…….: 0x14c (I386)

( 4 sections )
name viradd virsiz
rawdsiz ntrpy md5
.text 0x1000 0x12153 0x12200 6.48
a1b8b69799eace6b5bb29c19049fc92a
.data 0x14000 0x914 0xa00 5.90
0610f62e64fca3856561c235ee53eaea
.rsrc 0x15000 0x3f8 0x400 3.43
5ff68b649c14d167754073f671ef1ef1
.reloc 0x16000 0xdc8 0xe00 6.46
239d11cbbd5ee1de927d8b585d658322

( 5 imports )
> ADVAPI32.dll:
RegNotifyChangeKeyValue, RegDeleteKeyA, RegSetValueExA, RegQueryValueExA,
RegOpenKeyExA, RegCreateKeyExA, RegCloseKey, RegEnumKeyExA
> KERNEL32.dll:
GetTickCount, QueryPerformanceCounter, lstrcmpA, HeapReAlloc, HeapFree, HeapAlloc,
InterlockedCompareExchange, IsBadWritePtr, GetEnvironmentVariableA,
GetComputerNameA, GetVersionExA, GetSystemDirectoryA, GetWindowsDirectoryA,
WaitForMultipleObjectsEx, ResetEvent, IsBadReadPtr, TlsSetValue,
GetHandleInformation, ExpandEnvironmentStringsA, InterlockedExchange,
GetCurrentThreadId, TlsAlloc, GetSystemInfo, HeapCreate, GetProcessHeap,
HeapDestroy, TlsFree, lstrlenA, lstrcpyA, IsBadCodePtr, GetProcAddress,
CreateEventA, GetModuleFileNameA, LoadLibraryA, CreateThread, FreeLibrary,
WaitForSingleObject, CloseHandle, FreeLibraryAndExitThread, EnterCriticalSection,
SetEvent, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess,
GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter,
SwitchToThread, SetLastError, DelayLoadFailureHook, TlsGetValue,
InterlockedDecrement, GetLastError, WideCharToMultiByte, MultiByteToWideChar,
InitializeCriticalSection, DeleteCriticalSection, InterlockedIncrement,
LeaveCriticalSection
> msvcrt.dll: __isascii, isspace, _except_handler3,
sprintf, _adjust_fdiv, malloc, _initterm, free, _stricmp, fclose, fgets, atoi,
strchr, fopen, wcscpy, strtoul, wcscmp, wcslen, wcschr
> ntdll.dll:
RtlIpv4StringToAddressW, RtlIpv6StringToAddressExW,
RtlIpv4StringToAddressA
> WS2HELP.dll: WahCompleteRequest, WahQueueUserApc,
WahEnableNonIFSHandleSupport, WahDisableNonIFSHandleSupport,
WahCreateSocketHandle, WahNotifyAllProcesses, WahCreateNotificationHandle,
WahWaitForNotification, WahOpenCurrentThread, WahCloseThread,
WahInsertHandleContext, WahRemoveHandleContext, WahDestroyHandleContextTable,
WahCreateHandleContextTable, WahEnumerateHandleContexts, WahCloseApcHelper,
VirusTotal Page 1 of 2
http://www.virustotal.com/compacto.html 8/14/2009
WahCloseHandleHelper, WahCloseNotificationHandleHelper,
WahOpenNotificationHandleHelper, WahOpenHandleHelper, WahOpenApcHelper,
WahCloseSocketHandle, WahReferenceContextByHandle

( 117 exports )

FreeAddrInfoW, GetAddrInfoW, GetNameInfoW, WEP, WPUCompleteOverlappedRequest,
WSAAccept, WSAAddressToStringA, WSAAddressToStringW, WSAAsyncGetHostByAddr,
WSAAsyncGetHostByName, WSAAsyncGetProtoByName, WSAAsyncGetProtoByNumber,
WSAAsyncGetServByName, WSAAsyncGetServByPort, WSAAsyncSelect,
WSACancelAsyncRequest, WSACancelBlockingCall, WSACleanup, WSACloseEvent,
WSAConnect, WSACreateEvent, WSADuplicateSocketA, WSADuplicateSocketW,
WSAEnumNameSpaceProvidersA, WSAEnumNameSpaceProvidersW, WSAEnumNetworkEvents,
WSAEnumProtocolsA, WSAEnumProtocolsW, WSAEventSelect, WSAGetLastError,
WSAGetOverlappedResult, WSAGetQOSByName, WSAGetServiceClassInfoA,
WSAGetServiceClassInfoW, WSAGetServiceClassNameByClassIdA,
WSAGetServiceClassNameByClassIdW, WSAHtonl, WSAHtons, WSAInstallServiceClassA,
WSAInstallServiceClassW, WSAIoctl, WSAIsBlocking, WSAJoinLeaf,
WSALookupServiceBeginA, WSALookupServiceBeginW, WSALookupServiceEnd,
WSALookupServiceNextA, WSALookupServiceNextW, WSANSPIoctl, WSANtohl, WSANtohs,
WSAProviderConfigChange, WSARecv, WSARecvDisconnect, WSARecvFrom,
WSARemoveServiceClass, WSAResetEvent, WSASend, WSASendDisconnect, WSASendTo,
WSASetBlockingHook, WSASetEvent, WSASetLastError, WSASetServiceA, WSASetServiceW,
WSASocketA, WSASocketW, WSAStartup, WSAStringToAddressA, WSAStringToAddressW,
WSAUnhookBlockingHook, WSAWaitForMultipleEvents, WSApSetPostRoutine,
WSCDeinstallProvider, WSCEnableNSProvider, WSCEnumProtocols, WSCGetProviderPath,
WSCInstallNameSpace, WSCInstallProvider, WSCUnInstallNameSpace, WSCUpdateProvider,
WSCWriteNameSpaceOrder, WSCWriteProviderOrder, __WSAFDIsSet, accept, bind,
closesocket, connect, freeaddrinfo, getaddrinfo, gethostbyaddr, gethostbyname,
gethostname, getnameinfo, getpeername, getprotobyname, getprotobynumber,
getservbyname, getservbyport, getsockname, getsockopt, htonl, htons, inet_addr,
inet_ntoa, ioctlsocket, listen, ntohl, ntohs, recv, recvfrom, select, send,
sendto, setsockopt, shutdown, socket

PDFiD.: -
RDS…: NSRL Reference Data Set
-
VirusTotal Page 2 of 2
http://



Jottis Scan


Scanners
2009-08-13 Found nothing 2009-08-15 Trojan.Patched.EM
2009-08-15 Trojan.Patched!IK 2009-08-14 Trojan.Patched
2009-08-14 Win32:Patched-KW 2009-08-15 Found nothing
2009-08-14 Win32/Patched 2009-08-14 Found nothing
2009-08-14 Found nothing 2009-08-14 Found nothing
2009-08-10 Trojan.Patched.EM 2009-08-14 Found nothing
2009-08-14 Found nothing 2009-08-13 Found nothing
2009-08-15 Found nothing 2009-08-15 Mal/WSHack-A
2009-08-15 Found nothing 2009-08-13 Found nothing
2009-08-14 Found nothing 2009-08-14 Found nothing
2009-08-14 Found nothing


Additional info
File size: 82432 bytes
Filetype: PE32 executable for MS Windows (DLL) (console) Intel 80386 32-bit
MD5: a653d56e4d0eee64fc846915f3524e81
SHA1: cfaceadd0f127da9acf5e0ad2f83b2038a148275
Post #10
The logs show that you have one missing Microsoft file, and one that has been infected and needs replacing. Do you have access to a fully updated version of XP SP3 that you can "borrow" two files from?
Post #11
My xp disk only has Service Pack 1 on it. I must have downloaded SP #2/3 from Microsoft. I'm not sure where those files would reside. Rick Again, thanks for you help on this!
Post #14
I was thinking more of an up and running PC, because any installation disc is going to be out of date and you don't really want old files on your PC.
Post #15
My sons computer has xp service pack 2…I could try and up date it to three from Microsoft. What files do I need to replace and how do I replace them?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI