What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Laptop infected with virus

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I think I am going to need really savy volunteer with lots of options and patience who want's a real challenge. I can't access any internet page without trying 2 or 3 times. None of the microsoft repair procedures have helped. I would be willing to wipe clean and reload but this Vio laptop came with no Vista discs. I do have a desktop that works and have tried loading malware repair dics from the desktop with no luck. So I'll wait for instructions. Thanks
Post #2
Hi brickgolf,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

As we work through your logs. Please remember to run any tools by Right-clicking on the icon and selecting Run As Administrator….

  • Download DDS and save it to your desktop from
  • Here
  • here or
  • here.
    • Disable any script blocking protection (How to Disable your Security Programs)
    • Double click DDS icon to run the tool (may take up to 3 minutes to run)
    • When done, DDS.txt will open.
    • After a few moments, attach.txt will open in a second window.
    • Save both reports to your desktop.
  • We Need to check for Rootkits with RootRepeal
    • Download RootRepeal from one of the following locations and save it to your desktop.
    • Open [external image: Posted Image] on your desktop.
    • Click the [external image: Posted Image] tab.
    • Click the [external image: Posted Image] button.
    • In the Select Scan dialog, check
      [external image: Posted Image]
    • Push Ok
    • Check the box for your main system drive (Usually C:), and press Ok.
    • Allow RootRepeal to run a scan of your system. This may take some time.
    • Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt.
  • Copy/paste the log (that you've previously saved to your desktop) from RootRepeal onto your post.

  • Copy/paste the DDS.txt log (that you've previously saved to your desktop) onto your post.

  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
Post #3
Tomk, I'll try bthis one step at a time, DDS (Ver_09-07-30.01) - NTFSx86 Run by [removed] at 17:46:39.08 on Wed 08/26/2009 Internet Explorer: 8.0.6001.18813 BrowserJavaVersion: 1.6.0_13 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1014.125 [GMT -4:00] AV: Norton Internet Security *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8} SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A} FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\Sony\Network Utility\NSUService.exe C:\Program Files\Sony\VAIO Service Utility\VAIO-SUTOOL.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Spyware Doctor\pctsTray.exe C:\Program Files\Sony\VAIO Event Service\VESMgr.exe C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe C:\Windows\system32\WUDFHost.exe C:\Windows\system32\igfxext.exe C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\system32\igfxext.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Sony\VAIO Power Management\SPMgr.exe C:\Windows\System32\alg.exe C:\Program Files\Spyware Doctor\TFEngine\TFService.exe C:\Windows\system32\taskeng.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Sony\ISB Utility\ISBMgr.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Sony\VAIO Center Access Bar\VCAB.exe C:\Program Files\Sony\VAIO PC Wireless LAN Wizard\AutoLaunchWLASU.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Sony\Network Utility\LANUtil.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Apoint\ApMsgFwd.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\ehome\ehmsas.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Users\kevinkim\Downloads\dds.scr C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://www.aol.com mDefault_Page_URL = hxxp://www.sony.com/vaiopeople BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: {1e8a6170-7264-4d0f-beae-d42a53123c75} - c:\program files\common files\symantec shared\coshared\browser\1.5\NppBho.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll TB: Show Norton Toolbar: {90222687-f593-4738-b738-fbee9c7b26df} - c:\program files\common files\symantec shared\coshared\browser\1.5\UIBHO.dll TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun uRun: [NSUFloatingUI] "c:\program files\sony\network utility\LANUtil.exe" uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [AOL Fast Start] "c:\program files\aol 9.1\AOL.EXE" -b uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [Apoint] c:\program files\apoint\Apoint.exe mRun: [ISBMgr.exe] "c:\program files\sony\isb utility\ISBMgr.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [VAIO Center Access Bar] "c:\program files\sony\vaio center access bar\VCAB.exe" 1 mRun: [VWLASU] "c:\program files\sony\vaio pc wireless lan wizard\AutoLaunchWLASU.exe" mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [HostManager] c:\program files\common files\aol\1239025762\ee\AOLSoftware.exe mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe" StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\aolddi~1.lnk - c:\ddi\AOLICON.exe mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-us/wlscctrl2.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab Notify: igfxcui - igfxdev.dll Notify: VESWinlogon - VESWinlogon.dll ================= FIREFOX =================== FF - ProfilePath - FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-7-13 130936] R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-7-13 51488] R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-7-13 39200] R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\symantec\defini~1\symcdata\idsdefs\20080312.001\IDSvix86.sys [2008-3-12 261680] R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2009-7-13 159600] R2 NSUService;NSUService;c:\program files\sony\network utility\NSUService.exe [2007-8-26 200704] R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-7-13 348752] R3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2009-7-13 64392] R3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2007-10-30 37936] R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-7-13 33056] R3 ThreatFire;ThreatFire;c:\program files\spyware doctor\tfengine\tfservice.exe service –> c:\program files\spyware doctor\tfengine\TFService.exe service [?] R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2007-8-26 812544] S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\sony\vaio media integrated server\UCLS.exe [2007-8-26 745472] S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\sony\vaio media integrated server\platform\SV_Httpd.exe [2007-8-26 397312] S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\sony\vaio media integrated server\platform\UPnPFramework.exe [2007-8-26 1089536] S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\sony\vcm intelligent analyzing manager\VcmIAlzMgr.exe [2007-8-26 292152] S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\common files\sony shared\vcmxml\VcmXmlIfHelper.exe [2007-8-26 79736] ============== File Associations =============== regfile=regedit.exe "%1" %* scrfile="%1" %* =============== Created Last 30 ================ 2009-08-10 15:38 174,442,784 a——- c:\windows\MEMORY.DMP 2009-08-10 14:29 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-08-10 14:29 19,096 a——- c:\windows\system32\drivers\mbam.sys 2009-08-10 14:29 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-08-07 03:15 97,800 a——- c:\windows\system32\infocardapi.dll 2009-08-07 03:14 105,016 a——- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll 2009-08-07 03:14 37,384 a——- c:\windows\system32\infocardcpl.cpl 2009-08-07 03:14 622,080 a——- c:\windows\system32\icardagt.exe 2009-08-07 03:14 43,544 a——- c:\windows\system32\PresentationHostProxy.dll 2009-08-07 03:14 11,264 a——- c:\windows\system32\icardres.dll 2009-08-07 03:14 781,344 a——- c:\windows\system32\PresentationNative_v0300.dll 2009-08-07 03:14 326,160 a——- c:\windows\system32\PresentationHost.exe 2009-08-07 03:03 96,760 a——- c:\windows\system32\dfshim.dll 2009-08-07 03:02 282,112 a——- c:\windows\system32\mscoree.dll 2009-08-07 03:02 41,984 a——- c:\windows\system32\netfxperf.dll 2009-08-07 03:02 158,720 a——- c:\windows\system32\mscorier.dll 2009-08-07 03:01 83,968 a——- c:\windows\system32\mscories.dll 2009-08-05 16:06 –d—– c:\program files\Trend Micro 2009-08-04 20:34 289,792 a——- c:\windows\system32\atmfd.dll 2009-08-04 20:34 156,672 a——- c:\windows\system32\t2embed.dll 2009-08-04 20:34 72,704 a——- c:\windows\system32\fontsub.dll 2009-08-04 20:34 10,240 a——- c:\windows\system32\dciman32.dll 2009-08-04 20:32 915,456 a——- c:\windows\system32\wininet.dll 2009-08-04 20:32 1,469,440 a——- c:\windows\system32\inetcpl.cpl 2009-08-04 20:31 133,632 a——- c:\windows\system32\ieUnatt.exe 2009-08-04 20:31 109,056 a——- c:\windows\system32\iesysprep.dll 2009-08-04 20:31 71,680 a——- c:\windows\system32\iesetup.dll 2009-08-04 20:31 1,638,912 a——- c:\windows\system32\mshtml.tlb 2009-08-04 20:31 57,667 a——- c:\windows\system32\ieuinit.inf 2009-07-30 12:21 –d—– c:\program files\AOL Toolbar 2009-07-30 12:17 –d—– c:\program files\AOL(3) 2009-07-30 12:17 –d—– c:\windows\aolshare 2009-07-30 12:17 –d—– c:\program files\common files\aolshare(16) 2009-07-30 12:17 –d—– c:\program files\AOL 9(4).1 ==================== Find3M ==================== 2009-07-14 06:49 143,360 a——- c:\windows\inf\infstrng.dat 2009-07-14 06:49 86,016 a——- c:\windows\inf\infstor.dat 2009-07-14 06:49 51,200 a——- c:\windows\inf\infpub.dat 2009-07-13 10:41 54,832 a——- c:\windows\system32\AOLParconLink.exe 2009-06-04 12:04 410,984 a——- c:\windows\system32\deploytk.dll 2008-06-12 07:38 665,600 a——- c:\windows\inf\drvindex.dat 2008-06-01 15:02 174 a–sh— c:\program files\desktop.ini 2007-08-26 06:19 1,132,112 a——- c:\programdata\pswi_preloaded.exe 2007-08-26 06:19 1,132,112 a——- c:\progra~2\pswi_preloaded.exe 2006-11-02 08:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 08:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 08:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 08:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 05:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 05:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 05:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 05:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat 2009-05-17 16:19 245,760 a–sh— c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\ietldcache\index.dat 2007-08-26 17:25 8,192 a–sh— c:\windows\users\default\NTUSER.DAT ============= FINISH: 17:50:25.29 ===============
Post #4
Tomk, unable to perform Rootkis. Can't get past an :Initializing please wait box. Any long program has a problem being downloaded. any and all completed functions are now regarded as miracles. This is the 2nd attempt to reply. Brickgolf
Post #5
brickgolf,

It appears that you have Malwarebytes' Antimalware installed. Please update it.

  • Do this by double clicking the icon on your desktop to start the program.
  • Then click on the update tab at the top.
  • Then click on the Check for Updates button.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).
Post #7
Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #8
Tomk, seems to have worked. log attached. hope it reveals something, thanks brickgolf
ComboFix 09-08-30.04 - kevinkim 08/31/2009 12:40.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1014.243 [GMT -4:00]
Running from: c:\users\[removed]\Downloads\1.exe
AV: Norton Internet Security *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-1693903684-3139912343-2051395266-500
c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-2181796264-1699009989-3321213798-500
c:\$recycle.bin\S-1-5-21-3463033140-3895764627-2494982918-500
c:\windows\Installer\543844c.msi

.
((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-31 )))))))))))))))))))))))))))))))
.

2009-08-31 17:08 . 2009-08-31 17:10 ——– d—–w- c:\users\kevinkim\AppData\Local\temp
2009-08-31 17:08 . 2009-08-31 17:08 ——– d—–w- c:\users\Default\AppData\Local\temp
2009-08-31 15:58 . 2009-08-31 16:06 ——– d-s—w- C:\ComboFix
2009-08-29 07:05 . 2009-06-22 10:22 2048 —-a-w- c:\windows\system32\tzres.dll
2009-08-28 18:09 . 2009-07-17 14:35 71680 —-a-w- c:\windows\system32\atl.dll
2009-08-28 18:09 . 2009-06-10 12:12 160256 —-a-w- c:\windows\system32\wkssvc.dll
2009-08-28 18:07 . 2009-06-10 12:07 91136 —-a-w- c:\windows\system32\avifil32.dll
2009-08-28 18:06 . 2009-06-04 12:34 2066432 —-a-w- c:\windows\system32\mstscax.dll
2009-08-28 18:06 . 2009-06-15 15:21 499712 —-a-w- c:\windows\system32\kerberos.dll
2009-08-28 18:06 . 2009-06-15 15:24 175104 —-a-w- c:\windows\system32\wdigest.dll
2009-08-28 18:06 . 2009-06-15 15:22 213504 —-a-w- c:\windows\system32\msv1_0.dll
2009-08-28 18:06 . 2009-06-15 15:24 270848 —-a-w- c:\windows\system32\schannel.dll
2009-08-28 18:06 . 2009-06-15 15:23 1256448 —-a-w- c:\windows\system32\lsasrv.dll
2009-08-28 18:06 . 2009-06-15 18:20 439896 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-08-28 18:06 . 2009-06-15 12:57 9728 —-a-w- c:\windows\system32\lsass.exe
2009-08-28 18:06 . 2009-06-15 15:24 72704 —-a-w- c:\windows\system32\secur32.dll
2009-08-28 18:05 . 2009-07-14 13:00 313344 —-a-w- c:\windows\system32\wmpdxm.dll
2009-08-28 18:05 . 2009-07-14 12:58 7680 —-a-w- c:\windows\system32\spwmp.dll
2009-08-28 18:05 . 2009-07-14 12:59 4096 —-a-w- c:\windows\system32\dxmasf.dll
2009-08-28 18:05 . 2009-07-14 10:59 8147456 —-a-w- c:\windows\system32\wmploc.DLL
2009-08-28 17:38 . 2009-08-28 17:38 3942048 —-a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-26 22:12 . 2009-08-26 22:12 34816 —-a-w- c:\windows\system32\drivers\rootrepeal[1].sys
2009-08-26 22:11 . 2009-08-26 22:11 34816 —-a-w- c:\windows\system32\drivers\rootrepeal.sys
2009-08-26 21:58 . 2009-08-26 22:04 34816 —-a-w- c:\windows\system32\drivers\downloads[1].sys
2009-08-11 00:32 . 2009-08-11 00:32 ——– d—–w- c:\users\kevinkim\AppData\Local\Adobe
2009-08-10 18:29 . 2009-08-03 17:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-10 18:29 . 2009-08-03 17:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-08-10 18:29 . 2009-08-28 17:39 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-08-07 07:15 . 2008-06-20 01:14 97800 —-a-w- c:\windows\system32\infocardapi.dll
2009-08-07 07:14 . 2008-06-20 01:14 105016 —-a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-08-07 07:14 . 2008-06-20 01:14 622080 —-a-w- c:\windows\system32\icardagt.exe
2009-08-07 07:14 . 2008-06-20 01:14 43544 —-a-w- c:\windows\system32\PresentationHostProxy.dll
2009-08-07 07:14 . 2008-06-20 01:14 11264 —-a-w- c:\windows\system32\icardres.dll
2009-08-07 07:14 . 2008-06-20 01:14 781344 —-a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-08-07 07:14 . 2008-06-20 01:14 326160 —-a-w- c:\windows\system32\PresentationHost.exe
2009-08-07 07:03 . 2008-07-27 18:03 96760 —-a-w- c:\windows\system32\dfshim.dll
2009-08-07 07:02 . 2008-07-27 18:03 282112 —-a-w- c:\windows\system32\mscoree.dll
2009-08-07 07:02 . 2008-07-27 18:03 41984 —-a-w- c:\windows\system32\netfxperf.dll
2009-08-07 07:02 . 2008-07-27 18:03 158720 —-a-w- c:\windows\system32\mscorier.dll
2009-08-07 07:01 . 2008-07-27 18:03 83968 —-a-w- c:\windows\system32\mscories.dll
2009-08-05 20:06 . 2009-08-05 20:06 ——– d—–w- c:\program files\Trend Micro
2009-08-05 00:34 . 2009-06-15 15:24 156672 —-a-w- c:\windows\system32\t2embed.dll
2009-08-05 00:34 . 2009-06-15 15:20 72704 —-a-w- c:\windows\system32\fontsub.dll
2009-08-05 00:34 . 2009-06-15 15:20 10240 —-a-w- c:\windows\system32\dciman32.dll
2009-08-05 00:34 . 2009-06-15 12:52 289792 —-a-w- c:\windows\system32\atmfd.dll
2009-08-05 00:32 . 2009-07-21 21:52 915456 —-a-w- c:\windows\system32\wininet.dll
2009-08-05 00:31 . 2009-07-21 20:13 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2009-08-05 00:31 . 2009-07-21 21:47 109056 —-a-w- c:\windows\system32\iesysprep.dll
2009-08-05 00:31 . 2009-07-21 21:47 71680 —-a-w- c:\windows\system32\iesetup.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-31 17:09 . 2009-07-13 12:22 ——– d—–w- c:\program files\Spyware Doctor
2009-08-29 07:03 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2009-08-05 17:15 . 2008-04-02 02:59 ——– d—–w- c:\program files\Microsoft Silverlight
2009-08-05 00:07 . 2009-03-31 21:33 ——– d—–w- c:\program files\Windows Live Safety Center
2009-08-05 00:07 . 2007-12-22 17:13 ——– d—–w- c:\programdata\AOL
2009-08-05 00:07 . 2009-04-06 13:49 ——– d—–w- c:\program files\Common Files\aolshare
2009-08-05 00:06 . 2009-07-13 14:43 ——– d—–w- c:\program files\AOL 9.1
2009-07-30 16:26 . 2009-07-30 16:17 ——– d—–w- c:\program files\AOL 9(4).1
2009-07-30 16:25 . 2007-12-22 18:11 ——– d—–w- c:\users\kevinkim\AppData\Roaming\AOL
2009-07-30 16:23 . 2009-07-30 16:17 ——– d—–w- c:\program files\Common Files\aolshare(16)
2009-07-30 16:22 . 2009-07-30 16:17 ——– d—–w- c:\program files\AOL(3)
2009-07-30 16:21 . 2009-07-30 16:21 ——– d—–w- c:\program files\AOL Toolbar
2009-07-25 22:36 . 2009-07-20 16:46 ——– d—–w- c:\programdata\Spybot - Search & Destroy
2009-07-25 22:33 . 2009-07-25 20:35 ——– d—–w- c:\users\kevinkim\AppData\Roaming\uTorrent
2009-07-25 13:27 . 2009-07-25 13:27 ——– d—–w- c:\users\kevinkim\AppData\Roaming\Thinstall
2009-07-23 16:48 . 2009-07-23 16:47 680 —-a-w- c:\users\kevinkim\AppData\Local\d3d9caps.dat
2009-07-21 00:29 . 2007-12-22 17:13 ——– d—–w- c:\users\kevinkim\AppData\Roaming\Corel
2009-07-14 17:14 . 2008-07-11 20:14 ——– d—–w- c:\program files\Google
2009-07-14 17:09 . 2009-07-13 19:48 ——– d—–w- c:\users\kevinkim\AppData\Roaming\IObit
2009-07-14 17:09 . 2009-07-14 01:18 ——– d—–w- c:\programdata\Viewpoint
2009-07-14 17:09 . 2007-08-26 21:38 ——– d—–w- c:\programdata\Sony Corporation
2009-07-14 17:09 . 2007-08-26 21:08 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-14 17:09 . 2007-08-26 10:42 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-07-14 17:09 . 2007-08-26 21:26 ——– d—–w- c:\program files\Common Files\Sony Shared
2009-07-14 17:09 . 2007-08-26 21:19 ——– d—–w- c:\program files\Apoint
2009-07-14 15:17 . 2007-08-26 21:26 ——– d—–w- c:\program files\Sony
2009-07-14 15:17 . 2007-08-26 10:42 ——– d—–w- c:\program files\Symantec
2009-07-14 10:23 . 2007-08-26 09:43 ——– d—–w- c:\program files\Common Files\AOL
2009-07-14 02:43 . 2008-02-04 17:01 ——– d—–w- c:\programdata\Apple Computer
2009-07-14 01:04 . 2007-08-26 21:40 ——– d—–w- c:\programdata\Napster
2009-07-13 14:40 . 2009-07-13 14:40 127224 —-a-w- c:\programdata\AOL Downloads\waol\0.4334.34.14\comps\afix\afixlang.exe
2009-07-13 14:40 . 2009-07-13 14:40 2439824 —-a-w- c:\programdata\AOL Downloads\waol\0.4334.34.14\comps\ccu\ocpinsti.exe
2009-07-13 14:40 . 2009-07-13 14:40 711520 —-a-w- c:\programdata\AOL Downloads\waol\0.4334.34.14\comps\sysinfo\SinfInst.exe
2009-07-13 14:40 . 2009-07-13 14:40 62816 —-a-w- c:\programdata\AOL Downloads\waol\0.4334.34.14\comps\ocp\ocpgc.exe
2009-07-13 14:40 . 2009-07-13 14:37 35387072 —-a-w- c:\programdata\AOL Downloads\waol\0.4334.34.14\noneCodesignFilesBundle.exe
2009-07-13 14:37 . 2009-07-13 14:37 359184 —-a-w- c:\programdata\AOL Downloads\waol\0.4334.34.14\comps\tb\tbsetup.exe
2009-07-13 14:37 . 2009-07-13 14:37 75104 —-a-w- c:\programdata\AOL Downloads\waol\0.4334.34.14\comps\ocp\instSup.dll
2009-07-13 14:37 . 2009-07-13 14:37 223152 —-a-w- c:\programdata\AOL Downloads\waol\0.4334.34.14\comps\afix\wsfinst.exe
2009-07-13 14:37 . 2009-07-13 14:37 175224 —-a-w- c:\programdata\AOL Downloads\waol\0.4334.34.14\comps\sm\stmninst.exe
2009-07-13 14:37 . 2009-07-13 14:37 1475416 —-a-w- c:\programdata\AOL Downloads\waol\0.4334.34.14\comps\ocp\ocpinst.exe
2009-07-13 14:37 . 2009-07-13 14:37 15712 —-a-w- c:\programdata\AOL Downloads\waol\0.4334.34.14\comps\ocp\ocpchk.dll
2009-07-13 14:37 . 2009-07-13 14:37 390704 —-a-w- c:\programdata\AOL Downloads\waol\0.4334.34.14\comps\afix\WinsockFix.exe
2009-07-13 13:47 . 2007-08-26 10:42 ——– d—–w- c:\programdata\Symantec
2009-07-13 13:21 . 2009-07-12 21:18 ——– d—–w- c:\program files\NeoSmart Technologies
2009-07-13 13:02 . 2009-07-13 12:22 ——– d—–w- c:\programdata\PC Tools
2009-07-13 12:24 . 2009-07-13 12:22 ——– d—–w- c:\program files\Common Files\PC Tools
2009-07-13 12:22 . 2009-07-13 12:22 ——– d—–w- c:\users\kevinkim\AppData\Roaming\PC Tools
2009-07-09 17:31 . 2009-07-09 17:31 ——– d—–w- c:\users\kevinkim\AppData\Roaming\InstallShield
2009-06-27 01:20 . 2009-06-27 01:20 746744 —-a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-06-04 16:04 . 2009-06-04 16:04 410984 —-a-w- c:\windows\system32\deploytk.dll
2007-08-26 21:25 . 2007-08-26 21:25 8192 –sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AOLOverlayIcon]
@="{AB0C8BE3-041C-47d6-8195-E089D32B38DD}"
[HKEY_CLASSES_ROOT\CLSID\{AB0C8BE3-041C-47d6-8195-E089D32B38DD}]
2007-08-15 16:42 303104 ——w- c:\ddi\OverIcon.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2007-06-29 258048]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"AOL Fast Start"="c:\program files\AOL 9.1\AOL.EXE" [2008-11-06 50472]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-29 137752]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-29 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-29 133656]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2007-06-08 118784]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2007-06-12 317560]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-04 148888]
"VAIO Center Access Bar"="c:\program files\sony\VAIO Center Access Bar\VCAB.exe" [2007-06-21 53248]
"VWLASU"="c:\program files\Sony\VAIO PC Wireless LAN Wizard\AutoLaunchWLASU.exe" [2007-07-12 45056]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 115816]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"HostManager"="c:\program files\Common Files\AOL\1239025762\ee\AOLSoftware.exe" [2008-11-06 41264]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-08-31 1181064]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-06-25 4489216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2007-07-25 02:26 98304 —-a-w- c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{7F3D9032-4FC3-49BE-AFFA-13D232162C23}"= UDP:c:\program files\Sony\LocationFreePlayer\LFPC3\LFPC3.exe:LocationFree Player
"{931F2317-C9AA-435F-8FC8-5DD8E8017078}"= TCP:c:\program files\Sony\LocationFreePlayer\LFPC3\LFPC3.exe:LocationFree Player
"{CECD2AC6-6D8D-47C3-80C1-FD11842631B2}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{C5DAF2DF-7AC0-4653-AEFD-55D13C2AB35F}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{EEA8D889-3A96-4B3F-A3A0-37E9773D46D7}"= Disabled:UDP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media
"{D32E8B6F-040D-403E-BFBE-E5BBD20213C2}"= Disabled:TCP:c:\program files\Sony\VAIO Media 6.0\Vc.exe:[VAIO Media] VAIO Media
"{C21B099F-E6E7-460B-8E65-C31334581BFF}"= UDP:c:\program files\Common Files\AOL\ACS\AOLDial.exe:AOL Connectivity Service Dialer
"{36F82F7E-16B4-48A4-9C0E-A8974F9F91B5}"= TCP:c:\program files\Common Files\AOL\ACS\AOLDial.exe:AOL Connectivity Service Dialer
"{A22754D3-C61A-4B21-A120-B0BB5DE39D25}"= UDP:c:\program files\Common Files\AOL\ACS\AOLacsd.exe:AOL Connectivity Service
"{99619181-A42F-47D6-94A6-9063657BD30A}"= TCP:c:\program files\Common Files\AOL\ACS\AOLacsd.exe:AOL Connectivity Service
"{0F8A80C7-3C21-4F2A-898C-23586AD433FA}"= UDP:c:\program files\AOL 9.0\waol.exe:AOL
"{69AD39A5-A44E-4873-B2DD-4720EE7AAED1}"= TCP:c:\program files\AOL 9.0\waol.exe:AOL
"{26CD691B-0CBB-4C06-B12E-E1C3E58FC4BF}"= UDP:c:\program files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{EC96A18F-232A-46A0-9E50-42B636A551A7}"= TCP:c:\program files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{57F4D6CE-76AC-41BE-AB22-D13D27B259B5}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{488239E1-C878-4FF5-9F75-B85BF18FD810}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{607F0E11-2485-4790-8CBE-CB01B6D52B20}"= UDP:c:\program files\Common Files\AOL\System Information\sinf.exe:AOL System Information
"{618CB2DD-C5DF-4C58-AB06-85435BBEBB69}"= TCP:c:\program files\Common Files\AOL\System Information\sinf.exe:AOL System Information
"{DE8DA868-4CC7-41CD-883B-32B0A504387D}"= UDP:c:\program files\AOL 9.0a\waol.exe:AOL
"{46589029-8ADD-47C4-B66C-E23F612A9D1D}"= TCP:c:\program files\AOL 9.0a\waol.exe:AOL
"{BBD26E48-6FB8-46AF-B6AB-830CC660C519}"= UDP:c:\program files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{E2CD8AD3-7DF0-4116-8F3A-8DF3CB0F0930}"= TCP:c:\program files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe:AOL TopSpeed
"{49C16BFF-C05E-4908-80A7-7BD5C6540B14}"= UDP:c:\program files\Common Files\AOL\ACS\AOLDial.exe:AOL Connectivity Service Dialer
"{EA724800-E224-47AC-860B-141696441380}"= TCP:c:\program files\Common Files\AOL\ACS\AOLDial.exe:AOL Connectivity Service Dialer
"{50B4B829-68CB-4733-B143-6A51A56C2E7B}"= UDP:c:\program files\Common Files\AOL\ACS\AOLacsd.exe:AOL Connectivity Service
"{733B6EC4-DAFA-405F-AADB-CFB71A8248EA}"= TCP:c:\program files\Common Files\AOL\ACS\AOLacsd.exe:AOL Connectivity Service
"{0C953E4E-E29D-4340-BB30-2C8E1337E95B}"= UDP:c:\program files\Common Files\AOL\1209246100\ee\aolsoftware.exe:AOL Shared Components
"{334FEE10-B5C6-42E5-9C15-60608F7A1993}"= TCP:c:\program files\Common Files\AOL\1209246100\ee\aolsoftware.exe:AOL Shared Components
"{40D8E8B4-0BAD-4FB2-A438-C3D1DA5E9419}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{5F9FBA93-1C54-4767-A1F5-49A75EE0495F}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{E997A802-8AC1-4469-8982-08805C07F447}"= UDP:c:\program files\Common Files\AOL\1209246100\ee\AOLDesktop.exe:AOL Desktop
"{FF262E72-9E6F-4983-8137-ED5FB73CB42C}"= TCP:c:\program files\Common Files\AOL\1209246100\ee\AOLDesktop.exe:AOL Desktop
"{357F1892-9B88-4F08-8DC4-6356DB504F7A}"= UDP:c:\program files\Common Files\AOL\1209868711\ee\aolsoftware.exe:AOL Shared Components
"{CB24AB05-6780-4334-A796-2E97A33C427D}"= TCP:c:\program files\Common Files\AOL\1209868711\ee\aolsoftware.exe:AOL Shared Components
"{79FEA2A2-E460-499E-B837-B7786DBB0A6F}"= UDP:c:\program files\AOL 9.0\waol.exe:AOL
"{48A53DEB-58E6-4BB0-85F1-6565256146C1}"= TCP:c:\program files\AOL 9.0\waol.exe:AOL
"{96FA14CE-9D1E-45E7-AE38-5D6453B1C710}"= UDP:c:\program files\Common Files\AOL\System Information\sinf.exe:AOL System Information
"{BCDC1B03-77AE-46E9-B16D-712352D844D5}"= TCP:c:\program files\Common Files\AOL\System Information\sinf.exe:AOL System Information
"{FF896714-A772-4036-BC8A-F79FD5A95C52}"= UDP:c:\program files\Common Files\AOL\1209868711\ee\AOLDesktop.exe:AOL Desktop
"{F2459660-AE70-471A-9974-E2C85667C5C9}"= TCP:c:\program files\Common Files\AOL\1209868711\ee\AOLDesktop.exe:AOL Desktop
"{6D91B633-F62C-4494-8A1C-0CD944ADD4A8}"= UDP:c:\program files\AOL 9.1\waol.exe:AOL
"{BB775011-F76A-427C-89C3-2CC0381C7D4E}"= TCP:c:\program files\AOL 9.1\waol.exe:AOL
"TCP Query User{CC936029-EE4E-414B-BC2C-3879B7592BBE}c:\\program files\\sos online wagering\\client.exe"= UDP:c:\program files\sos online wagering\client.exe:Application
"UDP Query User{6F91D6FD-720D-4CD8-AB95-6B33CB0DB9FA}c:\\program files\\sos online wagering\\client.exe"= TCP:c:\program files\sos online wagering\client.exe:Application
"{8A25B265-A9D5-43F3-B8A3-D66A268F8976}"= UDP:c:\program files\Common Files\AOL\1239025762\ee\aolsoftware.exe:AOL Shared Components
"{1F2A62EE-DB1D-4D3D-9E39-677813B13A19}"= TCP:c:\program files\Common Files\AOL\1239025762\ee\aolsoftware.exe:AOL Shared Components
"{0FD7A1BC-6F5C-41FD-84B9-00234C9E2C50}"= UDP:c:\program files\AOL 9.5\waol.exe:AOL
"{E11FCA7C-0FF4-41B4-A7DA-98333C762648}"= TCP:c:\program files\AOL 9.5\waol.exe:AOL
"{4C0A0F53-D9A5-488F-BB6C-3B45BEB371C3}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{F709BEF4-1263-45A3-88F2-BEA45EEBF94A}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{B12C0C10-20C4-4C45-AD1A-AA0B3E8DE2CA}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{01959B27-8671-45FD-9255-D1BE0F980045}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{C53197A2-B9A4-449A-B7F6-BE40FF9368E4}"= UDP:c:\program files\AOL 9.1\waol.exe:AOL
"{F335EC3F-B9E4-4286-9047-3FB2E933EB56}"= TCP:c:\program files\AOL 9.1\waol.exe:AOL

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

R0 PCTCore;PCTools KDS;c:\windows\System32\drivers\PCTCore.sys [7/13/2009 8:22 AM 130936]
R0 TfFsMon;TfFsMon;c:\windows\System32\drivers\TfFsMon.sys [7/13/2009 8:59 AM 51488]
R0 TfSysMon;TfSysMon;c:\windows\System32\drivers\TfSysMon.sys [7/13/2009 8:59 AM 39200]
R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\idsdefs\20080312.001\IDSvix86.sys [3/12/2008 3:43 PM 261680]
R1 pctgntdi;pctgntdi;c:\windows\System32\drivers\pctgntdi.sys [7/13/2009 8:22 AM 159600]
R2 NSUService;NSUService;c:\program files\Sony\Network Utility\NSUService.exe [8/26/2007 6:34 AM 200704]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [7/13/2009 8:22 AM 348752]
R3 pctplsg;pctplsg;c:\windows\System32\drivers\pctplsg.sys [7/13/2009 8:22 AM 64392]
R3 SYMNDISV;SYMNDISV;c:\windows\System32\drivers\symndisv.sys [10/30/2007 8:55 PM 37936]
R3 TfNetMon;TfNetMon;c:\windows\System32\drivers\TfNetMon.sys [7/13/2009 8:59 AM 33056]
R3 ThreatFire;ThreatFire;c:\program files\Spyware Doctor\TFEngine\TFService.exe service –> c:\program files\Spyware Doctor\TFEngine\TFService.exe service [?]
R3 ti21sony;ti21sony;c:\windows\System32\drivers\ti21sony.sys [8/26/2007 5:18 PM 812544]
S3 VAIOMediaPlatform-UCLS-AppServer;VAIO Media Content Collection;c:\program files\Sony\VAIO Media Integrated Server\UCLS.exe [8/26/2007 6:30 AM 745472]
S3 VAIOMediaPlatform-UCLS-HTTP;VAIO Media Content Collection (HTTP);c:\program files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [8/26/2007 6:30 AM 397312]
S3 VAIOMediaPlatform-UCLS-UPnP;VAIO Media Content Collection (UPnP);c:\program files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [8/26/2007 6:30 AM 1089536]
S3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [8/26/2007 5:50 PM 292152]
S3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [8/26/2007 5:51 PM 79736]

— Other Services/Drivers In Memory —

*NewlyCreated* - COMHOST
*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-31 c:\windows\Tasks\User_Feed_Synchronization-{00E2891D-A372-4101-A235-17F44E0CC1D3}.job
- c:\windows\system32\msfeedssync.exe [2009-08-05 20:13]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.aol.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
FF - ProfilePath - c:\users\kevinkim\AppData\Roaming\Mozilla\Firefox\Profiles\a0sdam60.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/aolcom/search?invocationType=tb50ffTB50CLie7&query=
FF - prefs.js: browser.search.selectedEngine - Searchme
FF - prefs.js: browser.startup.homepage - hxxp://www.aol.com
FF - prefs.js: keyword.URL - hxxp://search.aol.com/aolcom/search?invocationType=tb50ffTB50CLab&query=
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-31 13:09
Windows 6.0.6001 Service Pack 1 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
"ImagePath"="\??\c:\windows\system32\drivers\downloads
[1].sys"

–
"ImagePath"="\??\c:\windows\system32\drivers\rootrepeal
[1].sys"


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\downloads[1]]
"ImagePath"="\??\c:\windows\system32\drivers\downloads

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\rootrepeal[1]]
"ImagePath"="\??\c:\windows\system32\drivers\rootrepeal
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(756)
c:\program files\Spyware Doctor\TFEngine\TFWAH.dll

- - - - - - - > 'lsass.exe'(652)
c:\program files\Spyware Doctor\TFEngine\TFWAH.dll
.
Completion time: 2009-08-31 13:19
ComboFix-quarantined-files.txt 2009-08-31 17:19

Pre-Run: 103,915,249,664 bytes free
Post-Run: 103,880,146,944 bytes free

Current=1 Default=1 Failed=0 LastKnownGood=11 Sets=1,2,3,4,5,6,7,8,9,10,11
311 — E O F — 2009-08-29 07:07
Post #9
Did you happen to notice this in the instructions?

* IMPORTANT !!! Save ComboFix.exe to your Desktop


This doesn't appear to be running from your desktop: Running from: c:\users\[removed]\Downloads\1.exe

Is your computer running any differently now?


Please go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
  • Please post this log in your next reply.
Post #10
Tomk, normally when i download a program it establishes a desktop icon from which I can run it. This did not. I'll try running it from the link you showed me and if suceesfull I'll post the log. It's not that i'm ignoring your suggestions or trying to skip steps, my sick laptop sometimes won't comply. Thank you brickgolf
Post #11
brickgolf,

Kaspersky online is an online scan. It doesn't actually download the program to your computer because it doesn't actually install on your computer, it is running over the internet.

If you were speaking of the location of ComboFix, I think we are OK with what we got in the log, however, it is designed to run from the desktop and works best from there.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI