Spyware / Malware / Virus Removal

[Resolved] windows has gone crazy!

15 min read

Looking for the outcome? Ask AI

lisafunkypants Topic Starter

Post #1August 20, 2009, 5:14 PM UTC last edited August 26, 2009, 12:22 PM UTC

Hi guys, help needed again,
I have been having trouble with pc, had 2 blue screens with nvp_disp error !!
Also couldnt get a pic on desktop
When ever i tried to log off it would say that other users are logged on etc,
and constantly would turn its self off to standby, although the settings have not been changed for it to do this.
So I have done a full recovery and as soon as i turned the thing on again nothing but trouble,
Since yesterday i have had cyberlink error report to send,
last night it closed down my window and went to the desktop all the icons were large as if in safemode.
The windows updates wont install
When i try to do live update for norton it freezes before it can download any and says its not responding.
If i leave the pc standing i get an error message saying it cant find flash.ocx file
I also had something called Zwangi on the pc, i tried to remove it but not sure if it has totally gone. It wont install service pack 3 for Windows at all.
and it is really slow still cant believe this is all happening after a supposed full recovery although most of the data is still on pc ie photos and music etc

i have installed malwarebytes and spyblaster for extra protection,
I had posted on software but they thought it may be malware so sent me here
as i am writing this now there is a cyberlink error message on the screen wanting to close

Heelllp please

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:57:52, on 20/08/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
C:\Apps\Powercinema\PCMService.exe
C:\apps\ABoard\ABoard.exe
C:\apps\ABoard\AOSD.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Electronic Arts\EADM\Core.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\AdBlocking\NSMdtr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://format.packardbell.com/cgi-bin/redi…&key=SEARCH
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\uk.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe
O4 - HKLM\..\Run: [EmailChecker] C:\APPS\EmailChecker\ech.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-3965977090-3551812889-490671574-1008\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'bailey')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

–
End of file - 8899 bytes

———————————————

Malwarebytes' Anti-Malware 1.40
Database version: 2669
Windows 5.1.2600 Service Pack 2

21/08/2009 14:21:43
mbam-log-2009-08-21 (14-21-43).txt

Scan type: Quick Scan
Objects scanned: 397175
Time elapsed: 1 hour(s), 17 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Registry Helper (Rogue.RegistryHelper) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

CatByte

Post #2August 26, 2009, 3:53 PM UTC

Hi,

Please do the following:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

Disable any script blocking protection
Double click dds.pif to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

NEXT

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

lisafunkypants

Post #3August 26, 2009, 8:06 PM UTC

HI Catbyte
When Gmer reaches c/Windows\$NTServicePackUninstall$ it disappears is that right?

==== Installed Programs ======================

3-D Salt Water Fish Tank Demo 2 Screen Saver
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 7.0
Advanced SystemCare 3
Apple Mobile Device Support
Apple Software Update
Bonjour
CC_ccProxyExt
ccCommon
ccPxyCore
EA Download Manager
ESET Online Scanner v3
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB935448)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB954708)
Hotfix for Windows XP (KB961118)
IObit Security 360 RC
iTunes
J2SE Runtime Environment 5.0 Update 2
Java™ 6 Update 15
Junk Mail filter update
LimeWire 5.2.13
LiveReg (Symantec Corporation)
LiveUpdate 3.0 (Symantec Corporation)
Living 3D Dolphins Full Screen Saver
Living 3D Waterfalls Full Screen Saver
Macromedia Shockwave Player
Malwarebytes' Anti-Malware
Messenger Plus! Live
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Microsoft WSE 3.0 Runtime
MSRedist
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 6 Service Pack 2 (KB954459)
Norton AntiSpam
Norton AntiVirus 2005
Norton Internet Security
Norton Internet Security 2005 (Symantec Corporation)
Norton WMI Update
NVIDIA Drivers
NVIDIA nView Desktop Manager
QuickTime

DDS (Ver_09-07-30.01) - NTFSx86
Run by [removed] at 19:23:28.87 on 26/08/2009
Internet Explorer: 7.0.5730.13

============== Pseudo HJT Report ===============

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: CNisExtBho Class: {9ecb9560-04f9-4bbc-943d-298ddf1699e1} - c:\program files\common files\symantec shared\adblocking\NISShExt.dll
BHO: CNavExtBho Class: {bdf3e430-b101-42ad-a544-fadc6b084872} - c:\program files\norton internet security\norton antivirus\NavShExt.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Norton Internet Security: {0b53eac3-8d69-4b9e-9b19-a37c9a5676a7} - c:\program files\common files\symantec shared\adblocking\NISShExt.dll
TB: Norton AntiVirus: {42cdd1bf-3ffb-4238-8ad1-7859df00b1d6} - c:\program files\norton internet security\norton antivirus\NavShExt.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
mRun: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [AlcWzrd] ALCWZRD.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [Ulead AutoDetector v2] c:\program files\common files\ulead systems\autodetector\monitor.exe
mRun: [PCMService] "c:\apps\powercinema\PCMService.exe"
mRun: [ACTIVBOARD] c:\apps\aboard\ABoard.exe
mRun: [EmailChecker] c:\apps\emailchecker\ech.exe
mRun: [Symantec NetDriver Monitor] c:\progra~1\symnet~1\SNDMon.exe /Consumer
mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /install
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [IObit Security 360] c:\program files\iobit\iobit security 360\IS360tray.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: {53F6FCCD-9E22-4d71-86EA-6E43136192AB}
IE: {925DAB62-F9AC-4221-806A-057BFB1014AA}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

============= SERVICES / DRIVERS ===============

=============== Created Last 30 ================

2009-08-26 11:27 –d—– c:\program files\ESET
2009-08-25 23:59 30 a——- c:\windows\iedit.INI
2009-08-25 23:56 26,496 a——- c:\windows\system32\dllcache\usbstor.sys
2009-08-25 21:09 –d—– c:\windows\system32\wbem\Repository
2009-08-25 19:36 –d—– c:\windows\system32\scripting
2009-08-25 19:36 –d—– c:\windows\l2schemas
2009-08-22 18:36 –d—– d:\docume~1\bikini~1\applic~1\LimeWire
2009-08-21 23:43 –d—– c:\program files\Microsoft CAPICOM 2.1.0.2
2009-08-21 20:15 –d—– d:\docume~1\bikini~1\applic~1\IObit
2009-08-21 18:50 –d—– d:\docume~1\alluse~1\applic~1\IObit
2009-08-21 18:50 –d—– c:\program files\IObit
2009-08-21 17:38 –d—– d:\documents and settings\bikini babe\Tracing
2009-08-21 11:59 268,648 a——- c:\windows\system32\mucltui.dll
2009-08-21 11:59 208,744 a——- c:\windows\system32\muweb.dll
2009-08-21 11:59 27,496 a——- c:\windows\system32\mucltui.dll.mui
2009-08-21 02:29 –d—– d:\docume~1\alluse~1\applic~1\3399
2009-08-21 02:20 –d—– d:\docume~1\alluse~1\applic~1\2B138
2009-08-21 02:17 483,328 a——- c:\windows\system32\actskn45.ocx
2009-08-21 02:03 107,368 a——- c:\windows\system32\GEARAspi.dll
2009-08-21 02:03 23,400 a——- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-08-21 02:03 –d—– c:\program files\iPod
2009-08-21 02:03 –d—– c:\program files\iTunes
2009-08-21 02:02 –d—– c:\program files\Bonjour
2009-08-21 00:28 679,936 a——- c:\windows\Living 3D Waterfalls Full.scr
2009-08-21 00:27 –d—– d:\docume~1\alluse~1\applic~1\Zwangi
2009-08-21 00:26 –d—– c:\program files\ZwangiSearch
2009-08-21 00:25 405,504 a——- c:\windows\Living 3D Dolphins Full.scr
2009-08-21 00:25 –d—– c:\program files\Freeze.com
2009-08-21 00:24 –d—– c:\program files\Winferno
2009-08-21 00:22 197,120 a——- c:\windows\system32\3-D Salt Water Fish Tank Demo 2.scr
2009-08-21 00:22 –d—– c:\windows\system32\3-D Salt Water Fish Tank Demo 2 dir
2009-08-20 23:55 –d—– c:\program files\LimeWire
2009-08-20 22:22 –d—– c:\program files\Messenger Plus! Live
2009-08-20 22:19 54,752 a——- c:\windows\system32\drivers\fssfltr_tdi.sys
2009-08-20 22:19 3,426,072 a——- c:\windows\system32\d3dx9_32.dll
2009-08-20 22:18 –d—– c:\program files\Microsoft SQL Server Compact Edition
2009-08-20 22:17 –d—– c:\program files\Microsoft
2009-08-20 22:17 –d—– c:\program files\Windows Live SkyDrive
2009-08-20 22:14 –d—– c:\program files\common files\Windows Live
2009-08-20 17:57 –d—– c:\program files\Trend Micro
2009-08-20 14:37 1,089,601 ——– c:\windows\system32\dllcache\ntprint.cat
2009-08-20 11:08 198,656 a——- c:\windows\system32\CNMLM83.DLL
2009-08-20 11:01 25,856 a——- c:\windows\system32\drivers\usbprint.sys
2009-08-20 11:01 25,856 a——- c:\windows\system32\dllcache\usbprint.sys
2009-08-20 11:01 15,104 a——- c:\windows\system32\drivers\usbscan.sys
2009-08-20 11:01 15,104 a——- c:\windows\system32\dllcache\usbscan.sys
2009-08-20 01:51 –d—– c:\windows\system32\XPSViewer
2009-08-20 01:50 1,676,288 ——– c:\windows\system32\xpssvcs.dll
2009-08-20 01:50 1,676,288 ——– c:\windows\system32\dllcache\xpssvcs.dll
2009-08-20 01:50 597,504 ——– c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-20 01:50 575,488 ——– c:\windows\system32\xpsshhdr.dll
2009-08-20 01:50 575,488 ——– c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-20 01:50 117,760 ——– c:\windows\system32\prntvpt.dll
2009-08-20 01:50 89,088 ——– c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-20 01:50 –d—– C:\f6fe359d59fc775063cca5f70f4051
2009-08-20 01:48 –d—– c:\program files\MSXML 6.0
2009-08-20 01:41 483,840 a——- c:\windows\system32\SET244.tmp
2009-08-20 01:41 438,784 a——- c:\windows\system32\SET1118.tmp
2009-08-20 01:41 52,736 a——- c:\windows\system32\SET245.tmp
2009-08-20 01:41 22,528 a——- c:\windows\system32\SET249.tmp
2009-08-20 01:41 19,456 a——- c:\windows\system32\SET24B.tmp
2009-08-20 01:41 18,432 a——- c:\windows\system32\SET247.tmp
2009-08-20 01:41 6,656 a——- c:\windows\system32\SET111C.tmp
2009-08-20 01:39 183,808 a——- c:\windows\system32\SET43C.tmp
2009-08-19 22:04 –d—– c:\windows\system32\CatRoot_bak
2009-08-19 17:53 940,794 a——- c:\windows\system32\LoopyMusic.wav
2009-08-19 17:53 146,650 a——- c:\windows\system32\BuzzingBee.wav
2009-08-19 17:53 73,728 a——- c:\windows\ALCFDRTM.VER
2009-08-19 17:53 73,728 a——- c:\windows\ALCFDRTM.EXE
2009-08-19 11:09 –d—– d:\docume~1\bikini~1\applic~1\Malwarebytes
2009-08-19 11:09 38,160 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-19 11:09 19,096 a——- c:\windows\system32\drivers\mbam.sys
2009-08-19 11:09 –d—– c:\program files\Malwarebytes' Anti-Malware
2009-08-19 11:07 –d—– c:\program files\SpywareBlaster
2009-08-19 10:24 503,808 a——- c:\windows\Tranquil - Waterfalls.scr
2009-08-19 10:23 606,848 a——- c:\windows\flashax.exe
2009-08-19 10:23 12,288 a——- c:\windows\impborl.dll
2009-08-19 10:13 3,394 a——- c:\windows\system32\SolarSystem3DScreensaver.html
2009-08-19 10:13 14,667,776 a——- c:\windows\system32\Solar System 3D Screensaver.scr
2009-08-19 10:13 –d—– c:\program files\Solar System 3D Screensaver
2009-08-19 09:05 –d—– c:\windows\ServicePackFiles
2009-08-19 09:04 –d—– c:\program files\MSXML 4.0
2009-08-19 03:47 –d—– d:\docume~1\alluse~1\applic~1\Symantec
2009-08-19 03:40 –d-h— c:\program files\WindowsUpdate
2009-08-19 03:40 –d—– c:\program files\Windows NT
2009-08-19 03:40 –d—– c:\program files\Windows Media Components
2009-08-19 03:40 –d—– c:\program files\Viewpoint
2009-08-19 03:40 –d—– c:\program files\Ulead Systems
2009-08-19 03:40 –d—– c:\program files\Symantec
2009-08-19 03:40 –d—– c:\program files\Sonic
2009-08-19 03:40 –d—– c:\program files\Realtek
2009-08-19 03:40 –d—– c:\program files\Online Services
2009-08-19 03:40 –d—– c:\program files\Norton Internet Security
2009-08-19 03:40 –d—– c:\program files\Norman
2009-08-19 03:40 –d—– c:\program files\MSN Gaming Zone
2009-08-19 03:40 –d—– c:\program files\Messenger
2009-08-19 03:40 –d—– c:\program files\Learn2.com
2009-08-19 03:40 –d—– c:\program files\GMixon
2009-08-19 03:40 –d—– c:\program files\common files\xing shared
2009-08-19 03:40 –d—– c:\program files\common files\Ulead Systems
2009-08-19 03:40 –d—– c:\program files\common files\Symantec Shared
2009-08-19 03:40 –d—– c:\program files\common files\SureThing Shared
2009-08-19 03:40 –d—– c:\program files\common files\SpeechEngines
2009-08-19 03:40 –d—– c:\program files\common files\Sonic Shared
2009-08-19 03:40 –d—– c:\program files\common files\Real
2009-08-19 03:40 –d—– c:\program files\common files\ODBC
2009-08-19 03:40 –d—– c:\program files\common files\Nullsoft
2009-08-19 03:40 –d—– c:\program files\common files\MSSoap
2009-08-19 03:40 –d—– c:\program files\common files\aolshare
2009-08-19 03:40 –d—– c:\program files\common files\AOL
2009-08-18 22:06 –d—– c:\program files\NVIDIA Corporation
2009-08-18 22:03 –d—– c:\program files\SystemRequirementsLab
2009-08-18 21:34 –ds—- d:\documents and settings\bikini babe\UserData
2009-08-18 21:05 –d—– c:\program files\Microsoft WSE
2009-08-18 20:31 –d—– c:\program files\SymNetDrv
2009-08-18 20:25 –d—– d:\docume~1\bikini~1\applic~1\AOL
2009-08-18 20:25 –d—– d:\docume~1\bikini~1\applic~1\You've Got Pictures Screensaver
2009-08-18 20:25 –d—– d:\docume~1\bikini~1\applic~1\Symantec
2009-08-11 22:14 –d—– d:\docume~1\alluse~1\applic~1\NVIDIA Corporation

==================== Find3M ====================

2009-08-18 20:34 411,368 a——- c:\windows\system32\deploytk.dll
2009-08-05 10:11 204,800 a——- c:\windows\system32\mswebdvd.dll
2009-08-05 10:11 204,800 ——– c:\windows\system32\dllcache\mswebdvd.dll
2009-07-29 05:53 119,808 a——- c:\windows\system32\t2embed.dll
2009-07-29 05:53 82,432 a——- c:\windows\system32\fontsub.dll
2009-07-29 05:53 119,808 ——– c:\windows\system32\dllcache\t2embed.dll
2009-07-29 05:53 82,432 ——– c:\windows\system32\dllcache\fontsub.dll
2009-07-26 16:44 48,448 a——- c:\windows\system32\sirenacm.dll
2009-07-19 19:03 3,597,824 ——– c:\windows\system32\dllcache\mshtml.dll
2009-07-19 14:32 6,067,200 ——– c:\windows\system32\dllcache\ieframe.dll
2009-07-18 17:20 1,506,304 ——– c:\windows\system32\dllcache\shdocvw.dll
2009-07-17 19:55 58,880 a——- c:\windows\system32\atl.dll
2009-07-17 19:55 58,880 ——– c:\windows\system32\dllcache\atl.dll
2009-07-14 19:54 10,457,088 a——- c:\windows\system32\nvoglnt.dll
2009-07-14 19:54 7,741,664 a——- c:\windows\system32\drivers\nv4_mini.sys
2009-07-14 19:54 7,741,664 a——- c:\windows\system32\dllcache\nv4_mini.sys
2009-07-14 19:54 5,842,816 a——- c:\windows\system32\nv4_disp.dll
2009-07-14 19:54 2,189,856 a——- c:\windows\system32\nvcuvid.dll
2009-07-14 19:54 2,002,944 a——- c:\windows\system32\nvcuda.dll
2009-07-14 19:54 1,706,528 a——- c:\windows\system32\nvcuvenc.dll
2009-07-14 19:54 1,597,690 a——- c:\windows\system32\nvdata.bin
2009-07-14 19:54 868,352 a——- c:\windows\system32\nvapi.dll
2009-07-14 19:54 485,920 a——- c:\windows\system32\nvudisp.exe
2009-07-14 19:54 151,552 a——- c:\windows\system32\nvcodins.dll
2009-07-14 19:54 151,552 a——- c:\windows\system32\nvcod.dll
2009-07-14 13:35 2,173,472 a——- c:\windows\system32\nvcplui.exe
2009-07-14 13:35 81,920 a——- c:\windows\system32\nvwddi.dll
2009-07-14 13:35 4,026,368 a——- c:\windows\system32\nvvitvs.dll
2009-07-14 13:35 3,170,304 a——- c:\windows\system32\nvwss.dll
2009-07-14 13:34 13,877,248 a——- c:\windows\system32\nvcpl.dll
2009-07-14 13:34 4,923,392 a——- c:\windows\system32\nvdisps.dll
2009-07-14 13:34 3,547,136 a——- c:\windows\system32\nvgames.dll
2009-07-14 13:34 1,286,144 a——- c:\windows\system32\nvmobls.dll
2009-07-14 13:34 188,416 a——- c:\windows\system32\nvmccss.dll
2009-07-14 13:34 168,004 a——- c:\windows\system32\nvsvc32.exe
2009-07-14 13:34 143,360 a——- c:\windows\system32\nvcolor.exe
2009-07-14 13:34 86,016 a——- c:\windows\system32\nvmctray.dll
2009-07-14 13:34 229,376 a——- c:\windows\system32\nvmccs.dll
2009-07-13 10:08 286,720 a——- c:\windows\system32\wmpdxm.dll
2009-07-13 10:08 286,720 a——- c:\windows\system32\dllcache\wmpdxm.dll
2009-07-13 10:08 5,537,792 a——- c:\windows\system32\dllcache\wmp.dll
2009-07-10 14:42 1,315,328 ——– c:\windows\system32\dllcache\msoe.dll
2009-07-10 12:15 306,544 a——- c:\windows\WLXPGSS.SCR
2009-07-10 07:01 485,920 a——- c:\windows\system32\NVUNINST.EXE
2009-06-29 12:07 13,824 ——– c:\windows\system32\dllcache\ieudinit.exe
2009-06-29 12:07 70,656 ——– c:\windows\system32\dllcache\ie4uinit.exe
2009-06-29 09:35 634,632 ——– c:\windows\system32\dllcache\iexplore.exe
2009-06-29 09:33 2,452,872 ——– c:\windows\system32\dllcache\ieapfltr.dat
2009-06-29 09:33 161,792 ——– c:\windows\system32\dllcache\ieakui.dll
2009-06-26 17:18 474,112 a——- c:\windows\system32\shlwapi(2).dll
2009-06-26 17:18 474,112 ——– c:\windows\system32\dllcache\shlwapi.dll
2009-06-26 17:18 1,023,488 a——- c:\windows\system32\browseui(2).dll
2009-06-26 17:18 1,023,488 ——– c:\windows\system32\dllcache\browseui.dll
2009-06-26 17:18 151,040 ——– c:\windows\system32\dllcache\cdfview.dll
2009-06-22 12:34 92,544 ——– c:\windows\system32\dllcache\ksecdd.sys
2009-06-12 12:50 76,288 a——- c:\windows\system32\telnet.exe
2009-06-12 12:50 76,288 ——– c:\windows\system32\dllcache\telnet.exe
2009-06-10 15:21 84,992 a——- c:\windows\system32\avifil32.dll
2009-06-10 15:21 84,992 ——– c:\windows\system32\dllcache\avifil32.dll
2009-06-10 07:32 132,096 a——- c:\windows\system32\wkssvc.dll
2009-06-10 07:32 132,096 ——– c:\windows\system32\dllcache\wkssvc.dll
2009-06-05 08:42 655,872 a——- c:\windows\system32\mstscax.dll
2009-06-05 08:42 655,872 ——– c:\windows\system32\dllcache\mstscax.dll
2009-06-03 20:27 1,290,752 a——- c:\windows\system32\quartz.dll
2009-06-03 20:27 1,290,752 a——- c:\windows\system32\quartz(2).dll
2009-06-03 20:27 1,290,752 ——– c:\windows\system32\dllcache\quartz.dll

============= FINISH: 19:23:38.92 ===============

GMER 1.0.15.15077 [gmer.exe] - http://www.gmer.net
Rootkit scan 2009-08-26 20:59:43
Windows 5.1.2600 Service Pack 2

—- System - GMER 1.0.15 —-

SSDT 822E1DA8 ZwConnectPort
SSDT 817AC050 ZwOpenProcess
SSDT 817AC0B0 ZwOpenThread

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\Udp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \FileSystem\Fastfat \Fat SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)

—- EOF - GMER 1.0.15 —-

CatByte

Post #4August 26, 2009, 8:23 PM UTC

Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please make sure you include the combo fix log in your next reply as well as describe how your computer is running now

lisafunkypants

Post #5August 26, 2009, 9:48 PM UTC

ComboFix 09-08-26.05 - bikini babe 26/08/2009 21:49.1.1 - NTFSx86
Running from: d:\documents and settings\[removed]\My Documents\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-1272449539-2518697703-2530951015-1003
c:\windows\Installer\WMEncoder.msi
c:\windows\system32\SET4F4.tmp
d:\documents and settings\All Users\Start Menu\Programs\PC Camer@
d:\documents and settings\All Users\Start Menu\Programs\PC Camer@ \Amcap.lnk
d:\documents and settings\All Users\Start Menu\Programs\PC Camer@ \Uninstall.lnk

.
((((((((((((((((((((((((( Files Created from 2009-07-26 to 2009-08-26 )))))))))))))))))))))))))))))))
.

2009-08-26 10:27 . 2009-08-26 10:27 ——– d—–w- c:\program files\ESET
2009-08-25 22:59 . 2009-08-25 22:59 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\Ulead Systems
2009-08-25 22:56 . 2004-08-03 22:08 26496 —-a-w- c:\windows\system32\dllcache\usbstor.sys
2009-08-25 20:09 . 2009-08-25 20:09 ——– d—–w- c:\windows\system32\wbem\Repository
2009-08-25 18:36 . 2009-08-25 18:36 ——– d—–w- c:\windows\system32\scripting
2009-08-25 18:36 . 2009-08-25 18:36 ——– d—–w- c:\windows\l2schemas
2009-08-24 10:14 . 2009-07-19 13:32 6067200 ——w- c:\windows\system32\dllcache\ieframe.dll
2009-08-24 10:14 . 2009-06-29 16:12 52224 ——w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-08-24 10:14 . 2009-06-29 16:12 459264 ——w- c:\windows\system32\dllcache\msfeeds.dll
2009-08-24 10:14 . 2009-06-29 16:12 268288 ——w- c:\windows\system32\dllcache\iertutil.dll
2009-08-24 10:14 . 2009-06-29 16:12 63488 ——w- c:\windows\system32\dllcache\icardie.dll
2009-08-24 10:14 . 2009-06-29 16:12 380928 ——w- c:\windows\system32\dllcache\ieapfltr.dll
2009-08-24 10:14 . 2009-06-29 11:07 13824 ——w- c:\windows\system32\dllcache\ieudinit.exe
2009-08-24 10:14 . 2009-06-29 08:33 2452872 ——w- c:\windows\system32\dllcache\ieapfltr.dat
2009-08-23 14:02 . 2009-08-26 19:35 ——– d—–w- d:\documents and settings\bailey.048919120306\Tracing
2009-08-22 18:16 . 2009-08-22 18:16 ——– d—–w- d:\docume~1\BIKINI~1\APPLIC~1\CyberLink
2009-08-22 17:36 . 2009-08-22 18:16 ——– d—–w- d:\docume~1\BIKINI~1\APPLIC~1\LimeWire
2009-08-21 22:43 . 2009-08-21 22:43 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-08-21 21:39 . 2009-08-21 21:39 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Adobe
2009-08-21 21:00 . 2009-08-21 21:00 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\OD2
2009-08-21 20:32 . 2009-08-21 20:32 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\Malwarebytes
2009-08-21 19:15 . 2009-08-21 19:15 ——– d—–w- d:\docume~1\BIKINI~1\APPLIC~1\IObit
2009-08-21 17:50 . 2009-08-21 17:50 ——– d—–w- d:\documents and settings\All Users\Application Data\IObit
2009-08-21 17:50 . 2009-08-21 19:15 ——– d—–w- c:\program files\IObit
2009-08-21 16:38 . 2009-08-25 19:54 ——– d—–w- d:\documents and settings\bikini babe\Tracing
2009-08-21 12:01 . 2009-08-21 12:01 ——– d—–w- d:\docume~1\BIKINI~1\APPLIC~1\Apple Computer
2009-08-21 10:59 . 2008-10-16 13:06 268648 —-a-w- c:\windows\system32\mucltui.dll
2009-08-21 10:59 . 2008-10-16 13:06 208744 —-a-w- c:\windows\system32\muweb.dll
2009-08-21 01:29 . 2009-08-21 01:29 ——– d—–w- d:\documents and settings\All Users\Application Data\3399
2009-08-21 01:20 . 2009-08-21 01:20 ——– d—–w- d:\documents and settings\All Users\Application Data\2B138
2009-08-21 01:03 . 2009-08-21 01:03 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\Apple Computer
2009-08-21 01:03 . 2009-03-19 15:32 23400 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-08-21 01:03 . 2008-04-17 11:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2009-08-21 01:03 . 2009-08-21 01:03 ——– d—–w- c:\program files\iPod
2009-08-21 01:03 . 2009-08-21 01:03 ——– d—–w- c:\program files\iTunes
2009-08-21 01:02 . 2009-08-21 01:02 ——– d—–w- c:\program files\Bonjour
2009-08-21 01:02 . 2009-08-21 01:02 ——– d—–w- c:\program files\QuickTime
2009-08-21 01:01 . 2009-08-21 01:01 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Apple
2009-08-21 01:01 . 2009-08-21 01:01 ——– d—–w- c:\program files\Apple Software Update
2009-08-21 01:00 . 2009-08-21 01:03 ——– d—–w- c:\program files\Common Files\Apple
2009-08-21 01:00 . 2009-08-21 01:03 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Apple Computer
2009-08-20 23:29 . 2009-08-20 23:29 ——– d—–w- d:\documents and settings\All Users\Application Data\Winferno
2009-08-20 23:28 . 2005-07-13 16:09 679936 —-a-w- c:\windows\Living 3D Waterfalls Full.scr
2009-08-20 23:28 . 2009-08-20 23:28 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\Jenkat
2009-08-20 23:28 . 2009-08-20 23:28 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\blinkx
2009-08-20 23:27 . 2009-08-20 23:27 ——– d—–w- d:\documents and settings\All Users\Application Data\Zwangi
2009-08-20 23:26 . 2009-08-21 11:52 ——– d—–w- c:\program files\ZwangiSearch
2009-08-20 23:25 . 2006-10-10 13:39 405504 —-a-w- c:\windows\Living 3D Dolphins Full.scr
2009-08-20 23:25 . 2009-08-20 23:28 ——– d—–w- c:\program files\Freeze.com
2009-08-20 23:24 . 2009-08-21 11:26 ——– d—–w- c:\program files\Winferno
2009-08-20 23:22 . 2009-08-20 23:22 ——– d—–w- c:\windows\system32\3-D Salt Water Fish Tank Demo 2 dir
2009-08-20 23:22 . 2009-08-20 23:22 197120 —-a-w- c:\windows\system32\3-D Salt Water Fish Tank Demo 2.scr
2009-08-20 22:58 . 2009-08-23 18:12 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\LimeWire
2009-08-20 22:55 . 2009-08-20 22:56 ——– d—–w- c:\program files\LimeWire
2009-08-20 21:26 . 2009-08-20 21:26 ——– d-sh–w- d:\documents and settings\leah.048919120306.000\UserData
2009-08-20 21:22 . 2009-08-20 21:22 ——– d—–w- c:\program files\Messenger Plus! Live
2009-08-20 21:20 . 2009-08-26 15:17 ——– d—–w- d:\documents and settings\leah.048919120306.000\Tracing
2009-08-20 21:20 . 2009-08-22 06:28 ——– d—–w- c:\program files\Microsoft Silverlight
2009-08-20 21:19 . 2009-08-21 01:03 ——– dc—-w- c:\windows\system32\DRVSTORE
2009-08-20 21:19 . 2009-08-05 21:48 54752 —-a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2009-08-20 21:19 . 2006-11-29 12:06 3426072 —-a-w- c:\windows\system32\d3dx9_32.dll
2009-08-20 21:18 . 2009-08-20 21:18 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2009-08-20 21:17 . 2009-08-20 21:17 ——– d—–w- c:\program files\Microsoft
2009-08-20 21:17 . 2009-08-20 21:17 ——– d—–w- c:\program files\Windows Live SkyDrive
2009-08-20 21:16 . 2009-08-20 21:19 ——– d—–w- c:\program files\Windows Live
2009-08-20 21:14 . 2009-08-20 21:14 ——– d—–w- c:\program files\Common Files\Windows Live
2009-08-20 21:09 . 2009-08-20 21:09 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Temp
2009-08-20 21:09 . 2009-08-20 21:09 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Google
2009-08-20 21:08 . 2009-08-20 21:09 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Deployment
2009-08-20 16:57 . 2009-08-20 16:57 ——– d—–w- c:\program files\Trend Micro
2009-08-20 10:24 . 2009-08-20 10:24 ——– d—–w- d:\documents and settings\bailey.048919120306\Application Data\Ulead Systems
2009-08-20 10:08 . 2008-04-02 19:00 198656 —-a-w- c:\windows\system32\CNMLM83.DLL
2009-08-20 10:01 . 2004-08-03 22:01 25856 —-a-w- c:\windows\system32\drivers\usbprint.sys
2009-08-20 10:01 . 2004-08-03 22:01 25856 —-a-w- c:\windows\system32\dllcache\usbprint.sys
2009-08-20 10:01 . 2004-08-03 21:58 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys
2009-08-20 10:01 . 2004-08-03 21:58 15104 —-a-w- c:\windows\system32\dllcache\usbscan.sys
2009-08-20 00:51 . 2009-08-20 00:51 ——– d—–w- c:\windows\system32\XPSViewer
2009-08-20 00:51 . 2009-08-20 00:51 ——– d—–w- c:\program files\MSBuild
2009-08-20 00:51 . 2009-08-20 00:51 ——– d—–w- c:\program files\Reference Assemblies
2009-08-20 00:50 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-20 00:50 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2009-08-20 00:50 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-20 00:50 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-08-20 00:50 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-20 00:50 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2009-08-20 00:50 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-20 00:50 . 2009-08-20 00:51 ——– d—–w- C:\f6fe359d59fc775063cca5f70f4051
2009-08-20 00:48 . 2009-08-20 00:48 ——– d—–w- c:\program files\MSXML 6.0
2009-08-19 21:04 . 2009-08-25 20:09 ——– d—–w- c:\windows\system32\CatRoot_bak
2009-08-19 16:53 . 2009-08-19 16:53 73728 —-a-w- c:\windows\ALCFDRTM.EXE
2009-08-19 10:09 . 2009-08-19 10:09 ——– d—–w- d:\docume~1\BIKINI~1\APPLIC~1\Malwarebytes
2009-08-19 10:09 . 2009-08-03 12:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-19 10:09 . 2009-08-19 10:09 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-08-19 10:09 . 2009-08-03 12:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-08-19 10:07 . 2009-08-19 10:07 ——– d—–w- c:\program files\SpywareBlaster
2009-08-19 09:24 . 2009-08-19 09:24 503808 —-a-w- c:\windows\Tranquil - Waterfalls.scr
2009-08-19 09:23 . 2009-08-19 09:23 606848 —-a-w- c:\windows\flashax.exe
2009-08-19 09:23 . 2009-08-19 09:23 12288 —-a-w- c:\windows\impborl.dll
2009-08-19 09:13 . 2009-08-19 09:13 ——– d—–w- c:\program files\Solar System 3D Screensaver
2009-08-19 09:13 . 2006-10-12 13:58 14667776 —-a-w- c:\windows\system32\Solar System 3D Screensaver.scr
2009-08-19 08:05 . 2009-08-25 18:34 ——– d—–w- c:\windows\ServicePackFiles
2009-08-19 08:04 . 2009-08-19 08:04 ——– d—–w- c:\program files\MSXML 4.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-26 20:45 . 2009-08-19 02:40 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-08-23 14:02 . 2009-08-19 08:06 71144 —-a-w- d:\documents and settings\bailey.048919120306\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-21 09:51 . 2009-08-19 02:40 ——– d—–w- c:\program files\Norton Internet Security
2009-08-20 21:20 . 2009-08-20 21:04 71144 —-a-w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-19 10:08 . 2008-08-07 17:38 ——– d—a-w- d:\documents and settings\All Users\Application Data\TEMP
2009-08-19 02:47 . 2009-08-20 21:04 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\AOL
2009-08-19 02:47 . 2009-08-19 08:06 ——– d—–w- d:\documents and settings\bailey.048919120306\Application Data\AOL
2009-08-19 02:47 . 2009-08-18 19:25 ——– d—–w- d:\docume~1\BIKINI~1\APPLIC~1\AOL
2009-08-19 02:47 . 2009-08-18 19:21 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\AOL
2009-08-19 02:44 . 2005-10-17 19:31 ——– d—–w- d:\documents and settings\All Users\Application Data\AOL
2009-08-19 02:43 . 2009-08-19 02:40 ——– d—–w- c:\program files\Microsoft Works
2009-08-19 02:41 . 2009-08-19 02:40 ——– d—–w- c:\program files\Common Files\SureThing Shared
2009-08-19 02:41 . 2009-08-19 02:40 ——– d—–w- c:\program files\Common Files\Sonic Shared
2009-08-18 21:06 . 2009-08-18 21:06 ——– d—–w- c:\program files\NVIDIA Corporation
2009-08-18 21:03 . 2009-08-18 21:03 ——– d—–w- c:\program files\SystemRequirementsLab
2009-08-18 20:05 . 2009-08-18 19:47 ——– d—–w- c:\program files\Electronic Arts
2009-08-18 20:05 . 2009-08-18 20:05 ——– d—–w- c:\program files\Microsoft WSE
2009-08-18 19:47 . 2009-08-19 02:40 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-08-18 19:44 . 2009-08-18 19:44 ——– d—–w- d:\docume~1\BIKINI~1\APPLIC~1\Ulead Systems
2009-08-18 19:34 . 2009-08-18 19:34 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-08-18 19:34 . 2009-08-19 02:40 ——– d—–w- c:\program files\Java
2009-08-18 19:32 . 2009-08-19 02:40 ——– d—–w- c:\program files\Symantec
2009-08-18 19:31 . 2009-08-18 19:31 ——– d—–w- c:\program files\SymNetDrv
2009-08-18 19:27 . 2009-08-18 19:25 ——– d—–w- d:\docume~1\BIKINI~1\APPLIC~1\Symantec
2009-08-18 19:26 . 2009-08-18 19:26 ——– d—–w- d:\docume~1\BIKINI~1\APPLIC~1\Skype
2009-08-18 19:26 . 2006-03-07 08:22 ——– d—–w- d:\documents and settings\All Users\Application Data\Skype
2009-08-18 19:25 . 2009-08-19 02:47 ——– d—–w- d:\documents and settings\All Users\Application Data\Symantec
2009-08-18 17:02 . 2009-08-18 17:02 ——– d—–w- d:\documents and settings\Lisa's Internett x\Application Data\Apple Computer
2009-08-18 15:40 . 2009-08-15 08:45 ——– d—–w- d:\documents and settings\Bailey\Application Data\OnlineArmor
2009-08-18 10:14 . 2009-08-18 10:14 0 —-a-w- d:\documents and settings\Lisa's Internett x\Application Data\wklnhst.dat
2009-08-17 19:14 . 2009-08-17 19:14 ——– d—–w- d:\documents and settings\Lisa's Internett x\Application Data\Malwarebytes
2009-08-12 19:21 . 2008-01-04 11:34 ——– d—–w- d:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-11 21:14 . 2009-08-11 21:14 ——– d—–w- d:\documents and settings\All Users\Application Data\NVIDIA Corporation
2009-08-11 19:31 . 2009-04-28 13:05 111472 —-a-w- d:\documents and settings\Lisa's Internett x\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-09 17:34 . 2008-02-09 16:15 111472 -c–a-w- d:\documents and settings\Renshai Warrior.048919120306.001\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-05 09:11 . 2004-08-10 15:38 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-01 19:21 . 2006-09-08 13:47 ——– d—–w- d:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-29 04:53 . 2004-08-10 15:38 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-07-29 04:53 . 2004-08-10 15:37 82432 —-a-w- c:\windows\system32\fontsub.dll
2009-07-28 10:43 . 2009-04-26 08:37 ——– d—–w- d:\documents and settings\All Users\Application Data\avg8
2009-07-26 15:44 . 2009-07-26 15:44 48448 —-a-w- c:\windows\system32\sirenacm.dll
2009-07-17 18:55 . 2004-08-10 15:37 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-14 18:54 . 2009-08-18 21:05 2189856 —-a-w- c:\windows\system32\nvcuvid.dll
2009-07-14 18:54 . 2009-08-18 21:05 1706528 —-a-w- c:\windows\system32\nvcuvenc.dll
2009-07-14 18:54 . 2009-08-18 21:05 868352 —-a-w- c:\windows\system32\nvapi.dll
2009-07-14 18:54 . 2009-08-18 21:05 2002944 —-a-w- c:\windows\system32\nvcuda.dll
2009-07-14 18:54 . 2009-08-18 21:05 1597690 —-a-w- c:\windows\system32\nvdata.bin
2009-07-14 18:54 . 2005-10-17 19:22 485920 —-a-w- c:\windows\system32\nvudisp.exe
2009-07-14 18:54 . 1979-12-31 23:00 7741664 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-07-14 18:54 . 1979-12-31 23:00 5842816 —-a-w- c:\windows\system32\nv4_disp.dll
2009-07-14 18:54 . 1979-12-31 23:00 151552 —-a-w- c:\windows\system32\nvcodins.dll
2009-07-14 18:54 . 1979-12-31 23:00 151552 —-a-w- c:\windows\system32\nvcod.dll
2009-07-14 18:54 . 1979-12-31 23:00 10457088 —-a-w- c:\windows\system32\nvoglnt.dll
2009-07-14 12:35 . 2009-07-14 12:35 2173472 —-a-w- c:\windows\system32\nvcplui.exe
2009-07-14 12:35 . 2009-07-14 12:35 81920 —-a-w- c:\windows\system32\nvwddi.dll
2009-07-14 12:35 . 2009-07-14 12:35 4026368 —-a-w- c:\windows\system32\nvvitvs.dll
2009-07-14 12:35 . 2009-07-14 12:35 3170304 —-a-w- c:\windows\system32\nvwss.dll
2009-07-14 12:34 . 2009-07-14 12:34 86016 —-a-w- c:\windows\system32\nvmctray.dll
2009-07-14 12:34 . 2009-07-14 12:34 4923392 —-a-w- c:\windows\system32\nvdisps.dll
2009-07-14 12:34 . 2009-07-14 12:34 3547136 —-a-w- c:\windows\system32\nvgames.dll
2009-07-14 12:34 . 2009-07-14 12:34 188416 —-a-w- c:\windows\system32\nvmccss.dll
2009-07-14 12:34 . 2009-07-14 12:34 168004 —-a-w- c:\windows\system32\nvsvc32.exe
2009-07-14 12:34 . 2009-07-14 12:34 143360 —-a-w- c:\windows\system32\nvcolor.exe
2009-07-14 12:34 . 2009-07-14 12:34 13877248 —-a-w- c:\windows\system32\nvcpl.dll
2009-07-14 12:34 . 2009-07-14 12:34 1286144 —-a-w- c:\windows\system32\nvmobls.dll
2009-07-14 12:34 . 2009-07-14 12:34 229376 —-a-w- c:\windows\system32\nvmccs.dll
2009-07-14 11:53 . 2009-07-14 11:53 ——– d—–w- d:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-07-13 09:08 . 2004-08-10 15:38 286720 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-10 20:23 . 2009-07-10 20:23 ——– d—–w- d:\documents and settings\All Users\Application Data\Electronic Arts
2009-07-10 11:15 . 2009-07-10 11:15 306544 —-a-w- c:\windows\WLXPGSS.SCR
2009-07-10 06:01 . 2005-10-17 19:22 485920 —-a-w- c:\windows\system32\NVUNINST.EXE
2009-06-29 16:12 . 2004-08-10 15:38 827392 —-a-w- c:\windows\system32\wininet.dll
2009-06-29 16:12 . 2004-08-10 15:37 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-06-29 16:12 . 2004-08-10 15:37 17408 ——w- c:\windows\system32\corpol.dll
2009-06-26 16:18 . 2004-08-10 15:38 474112 —-a-w- c:\windows\system32\shlwapi(2).dll
2009-06-26 16:18 . 2004-08-10 15:37 1023488 —-a-w- c:\windows\system32\browseui(2).dll
2009-06-25 08:44 . 2004-08-10 15:38 59392 —-a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:44 . 2004-08-10 15:38 59392 —-a-w- c:\windows\system32\wdigest(2).dll
2009-06-25 08:44 . 2004-08-10 15:38 56320 —-a-w- c:\windows\system32\secur32.dll
2009-06-25 08:44 . 2004-08-10 15:38 56320 —-a-w- c:\windows\system32\secur32(2).dll
2009-06-25 08:44 . 2004-08-10 15:38 168448 —-a-w- c:\windows\system32\schannel.dll
2009-06-25 08:44 . 2004-08-10 15:38 133632 —-a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:44 . 2004-08-10 15:37 724480 —-a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:44 . 2004-08-10 15:37 298496 —-a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:44 . 2004-08-10 15:37 298496 —-a-w- c:\windows\system32\kerberos(2).dll
2009-06-22 11:34 . 2004-08-10 15:37 92544 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-12 11:50 . 2004-08-10 15:38 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 14:21 . 2004-08-10 15:37 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:32 . 2004-08-10 15:38 132096 —-a-w- c:\windows\system32\wkssvc.dll
2009-06-07 00:54 . 2009-06-07 00:54 252856 —-a-w- d:\documents and settings\LocalService.NT AUTHORITY.014\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-06-05 07:42 . 2004-08-10 15:54 655872 —-a-w- c:\windows\system32\mstscax.dll
2009-06-03 19:27 . 2004-08-10 15:38 1290752 —-a-w- c:\windows\system32\quartz.dll
2009-06-03 19:27 . 2004-08-10 15:38 1290752 —-a-w- c:\windows\system32\quartz(2).dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-18 149280]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-01-17 58728]
"Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 90112]
"PCMService"="c:\apps\Powercinema\PCMService.exe" [2005-05-11 127118]
"ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 24576]
"EmailChecker"="c:\apps\EmailChecker\ech.exe" [2003-07-02 40960]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2009-08-18 100056]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-07-08 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-14 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-07-14 86016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"IObit Security 360"="c:\program files\IObit\IObit Security 360\IS360tray.exe" [2009-08-20 943888]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" - c:\windows\system32\Hdaudpropshortcut.exe [2004-03-17 61952]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SoundMan.exe [2004-09-10 77824]
"AlcWzrd"="ALCWZRD.EXE" - c:\windows\ALCWZRD.EXE [2004-09-15 2557952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\APPS\\skype\\phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [2009-08-05 704864]
S2 fssfltr;fssfltr;c:\windows\system32\DRIVERS\fssfltr_tdi.sys [2009-08-05 54752]
S2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\IS360srv.exe [2009-08-20 305936]

— Other Services/Drivers In Memory —

*Deregistered* - aunasnkj
.
Contents of the 'Scheduled Tasks' folder

2009-08-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-08-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3965977090-3551812889-490671574-1007Core.job
- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-20 21:09]

2009-08-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3965977090-3551812889-490671574-1007UA.job
- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-20 21:09]

2009-08-18 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\system32\OOBE\oobebaln.exe [2004-08-10 13:00]
.
.
——- Supplementary Scan ——-
.
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-26 22:02
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2009-08-26 22:03
ComboFix-quarantined-files.txt 2009-08-26 21:03

Pre-Run: 15,072,739,328 bytes free
Post-Run: 15,055,548,416 bytes free

315 — E O F — 2009-08-25 00:28

As for the behaviour: i cant access internet through my account so i have to go onto my sons, when i did this after the scan there where no desktop icons & i had to access internet through task manager, however iicons did return when i logged off and back on again. My account still has no desktop picture the windows are in old silver box style and i cant access the internet, the tower itself is making loud crackling noises when ever it decides to boot into action and my moniter keeps going into standby still.

CatByte

Post #6August 27, 2009, 2:25 AM UTC

Hi,

Please delete the copy of combofix you have from documents and settings

Please download a fresh copy and make sure you save it directly to your DESKTOP

make sure your Iobit security is totally disabled and run combofix again.

post the log.

If the connection is still lost - do the following:

if your network icon appears on the Windows taskbar, then you can repair it by right-clicking on the icon and selecting Repair.

[external image: Posted Image]

If you have no task bar icon do this:

Click on the Start button.
Click on the Settings menu option.
Click on the Control Panel option.
When the Control Panel opens, double-click on the Network Connections icon. If your Control Panel is set to Category View, then double-click on Network and Internet Connections and then click on Network Connections at the bottom.
You will now see a list of available network connections. Locate the connection for your Wireless or Lan adapter and right-click on it.
click on the Repair menu option.

[external image: Posted Image]

Let the repair process perform its tasks and when it has finished, your Internet connection should be working again.

NEXT

Please do the following:

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.

Copy the content of the following codebox into the main textfield:

:dir
d:\documents and settings\All Users\Application Data\3399 /s
d:\documents and settings\All Users\Application Data\2B138 /s

Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

lisafunkypants

Post #7August 27, 2009, 11:04 AM UTC last edited August 27, 2009, 11:10 AM UTC

ComboFix 09-08-26.05 - bailey 27/08/2009 11:43.2.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.1023.447 [GMT 1:00]
Running from: d:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((( Files Created from 2009-07-27 to 2009-08-27 )))))))))))))))))))))))))))))))
.

2009-08-27 10:38 . 2009-08-27 10:38 ——– d—–w- d:\documents and settings\bailey.048919120306\Application Data\IObit
2009-08-26 10:27 . 2009-08-26 10:27 ——– d—–w- c:\program files\ESET
2009-08-25 22:59 . 2009-08-25 22:59 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\Ulead Systems
2009-08-25 22:56 . 2004-08-03 22:08 26496 —-a-w- c:\windows\system32\dllcache\usbstor.sys
2009-08-25 20:09 . 2009-08-25 20:09 ——– d—–w- c:\windows\system32\wbem\Repository
2009-08-25 18:36 . 2009-08-25 18:36 ——– d—–w- c:\windows\system32\scripting
2009-08-25 18:36 . 2009-08-25 18:36 ——– d—–w- c:\windows\l2schemas
2009-08-24 10:14 . 2009-07-19 13:32 6067200 ——w- c:\windows\system32\dllcache\ieframe.dll
2009-08-24 10:14 . 2009-06-29 16:12 52224 ——w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-08-24 10:14 . 2009-06-29 16:12 459264 ——w- c:\windows\system32\dllcache\msfeeds.dll
2009-08-24 10:14 . 2009-06-29 16:12 268288 ——w- c:\windows\system32\dllcache\iertutil.dll
2009-08-24 10:14 . 2009-06-29 16:12 63488 ——w- c:\windows\system32\dllcache\icardie.dll
2009-08-24 10:14 . 2009-06-29 16:12 380928 ——w- c:\windows\system32\dllcache\ieapfltr.dll
2009-08-24 10:14 . 2009-06-29 11:07 13824 ——w- c:\windows\system32\dllcache\ieudinit.exe
2009-08-24 10:14 . 2009-06-29 08:33 2452872 ——w- c:\windows\system32\dllcache\ieapfltr.dat
2009-08-23 14:02 . 2009-08-27 10:17 ——– d—–w- d:\documents and settings\bailey.048919120306\Tracing
2009-08-21 22:43 . 2009-08-21 22:43 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-08-21 21:39 . 2009-08-21 21:39 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Adobe
2009-08-21 21:00 . 2009-08-21 21:00 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\OD2
2009-08-21 20:32 . 2009-08-21 20:32 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\Malwarebytes
2009-08-21 17:50 . 2009-08-21 17:50 ——– d—–w- d:\documents and settings\All Users\Application Data\IObit
2009-08-21 17:50 . 2009-08-21 19:15 ——– d—–w- c:\program files\IObit
2009-08-21 16:38 . 2009-08-25 19:54 ——– d—–w- d:\documents and settings\bikini babe\Tracing
2009-08-21 10:59 . 2008-10-16 13:06 268648 —-a-w- c:\windows\system32\mucltui.dll
2009-08-21 10:59 . 2008-10-16 13:06 208744 —-a-w- c:\windows\system32\muweb.dll
2009-08-21 01:29 . 2009-08-21 01:29 ——– d—–w- d:\documents and settings\All Users\Application Data\3399
2009-08-21 01:20 . 2009-08-21 01:20 ——– d—–w- d:\documents and settings\All Users\Application Data\2B138
2009-08-21 01:03 . 2009-08-21 01:03 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\Apple Computer
2009-08-21 01:03 . 2009-03-19 15:32 23400 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-08-21 01:03 . 2008-04-17 11:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2009-08-21 01:03 . 2009-08-21 01:03 ——– d—–w- c:\program files\iPod
2009-08-21 01:03 . 2009-08-21 01:03 ——– d—–w- c:\program files\iTunes
2009-08-21 01:02 . 2009-08-21 01:02 ——– d—–w- c:\program files\Bonjour
2009-08-21 01:02 . 2009-08-21 01:02 ——– d—–w- c:\program files\QuickTime
2009-08-21 01:01 . 2009-08-21 01:01 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Apple
2009-08-21 01:01 . 2009-08-21 01:01 ——– d—–w- c:\program files\Apple Software Update
2009-08-21 01:00 . 2009-08-21 01:03 ——– d—–w- c:\program files\Common Files\Apple
2009-08-21 01:00 . 2009-08-21 01:03 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Apple Computer
2009-08-20 23:29 . 2009-08-20 23:29 ——– d—–w- d:\documents and settings\All Users\Application Data\Winferno
2009-08-20 23:28 . 2005-07-13 16:09 679936 —-a-w- c:\windows\Living 3D Waterfalls Full.scr
2009-08-20 23:28 . 2009-08-20 23:28 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\Jenkat
2009-08-20 23:28 . 2009-08-20 23:28 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\blinkx
2009-08-20 23:27 . 2009-08-20 23:27 ——– d—–w- d:\documents and settings\All Users\Application Data\Zwangi
2009-08-20 23:26 . 2009-08-21 11:52 ——– d—–w- c:\program files\ZwangiSearch
2009-08-20 23:25 . 2006-10-10 13:39 405504 —-a-w- c:\windows\Living 3D Dolphins Full.scr
2009-08-20 23:25 . 2009-08-20 23:28 ——– d—–w- c:\program files\Freeze.com
2009-08-20 23:24 . 2009-08-21 11:26 ——– d—–w- c:\program files\Winferno
2009-08-20 23:22 . 2009-08-20 23:22 ——– d—–w- c:\windows\system32\3-D Salt Water Fish Tank Demo 2 dir
2009-08-20 23:22 . 2009-08-20 23:22 197120 —-a-w- c:\windows\system32\3-D Salt Water Fish Tank Demo 2.scr
2009-08-20 22:58 . 2009-08-23 18:12 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\LimeWire
2009-08-20 22:55 . 2009-08-20 22:56 ——– d—–w- c:\program files\LimeWire
2009-08-20 21:26 . 2009-08-20 21:26 ——– d-sh–w- d:\documents and settings\leah.048919120306.000\UserData
2009-08-20 21:22 . 2009-08-20 21:22 ——– d—–w- c:\program files\Messenger Plus! Live
2009-08-20 21:20 . 2009-08-26 22:24 ——– d—–w- d:\documents and settings\leah.048919120306.000\Tracing
2009-08-20 21:20 . 2009-08-22 06:28 ——– d—–w- c:\program files\Microsoft Silverlight
2009-08-20 21:19 . 2009-08-21 01:03 ——– dc—-w- c:\windows\system32\DRVSTORE
2009-08-20 21:19 . 2009-08-05 21:48 54752 —-a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2009-08-20 21:19 . 2006-11-29 12:06 3426072 —-a-w- c:\windows\system32\d3dx9_32.dll
2009-08-20 21:18 . 2009-08-20 21:18 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2009-08-20 21:17 . 2009-08-20 21:17 ——– d—–w- c:\program files\Microsoft
2009-08-20 21:17 . 2009-08-20 21:17 ——– d—–w- c:\program files\Windows Live SkyDrive
2009-08-20 21:16 . 2009-08-20 21:19 ——– d—–w- c:\program files\Windows Live
2009-08-20 21:14 . 2009-08-20 21:14 ——– d—–w- c:\program files\Common Files\Windows Live
2009-08-20 21:09 . 2009-08-20 21:09 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Temp
2009-08-20 21:09 . 2009-08-20 21:09 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Google
2009-08-20 21:08 . 2009-08-20 21:09 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Deployment
2009-08-20 16:57 . 2009-08-20 16:57 ——– d—–w- c:\program files\Trend Micro
2009-08-20 10:24 . 2009-08-20 10:24 ——– d—–w- d:\documents and settings\bailey.048919120306\Application Data\Ulead Systems
2009-08-20 10:08 . 2008-04-02 19:00 198656 —-a-w- c:\windows\system32\CNMLM83.DLL
2009-08-20 10:01 . 2004-08-03 22:01 25856 —-a-w- c:\windows\system32\drivers\usbprint.sys
2009-08-20 10:01 . 2004-08-03 22:01 25856 —-a-w- c:\windows\system32\dllcache\usbprint.sys
2009-08-20 10:01 . 2004-08-03 21:58 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys
2009-08-20 10:01 . 2004-08-03 21:58 15104 —-a-w- c:\windows\system32\dllcache\usbscan.sys
2009-08-20 00:51 . 2009-08-20 00:51 ——– d—–w- c:\windows\system32\XPSViewer
2009-08-20 00:51 . 2009-08-20 00:51 ——– d—–w- c:\program files\MSBuild
2009-08-20 00:51 . 2009-08-20 00:51 ——– d—–w- c:\program files\Reference Assemblies
2009-08-20 00:50 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-20 00:50 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2009-08-20 00:50 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-20 00:50 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-08-20 00:50 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-20 00:50 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2009-08-20 00:50 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-20 00:50 . 2009-08-20 00:51 ——– d—–w- C:\f6fe359d59fc775063cca5f70f4051
2009-08-20 00:48 . 2009-08-20 00:48 ——– d—–w- c:\program files\MSXML 6.0
2009-08-19 21:04 . 2009-08-25 20:09 ——– d—–w- c:\windows\system32\CatRoot_bak
2009-08-19 16:53 . 2009-08-19 16:53 73728 —-a-w- c:\windows\ALCFDRTM.EXE
2009-08-19 10:09 . 2009-08-03 12:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-19 10:09 . 2009-08-19 10:09 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-08-19 10:09 . 2009-08-03 12:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-08-19 10:07 . 2009-08-19 10:07 ——– d—–w- c:\program files\SpywareBlaster
2009-08-19 09:24 . 2009-08-19 09:24 503808 —-a-w- c:\windows\Tranquil - Waterfalls.scr
2009-08-19 09:23 . 2009-08-19 09:23 606848 —-a-w- c:\windows\flashax.exe
2009-08-19 09:23 . 2009-08-19 09:23 12288 —-a-w- c:\windows\impborl.dll
2009-08-19 09:13 . 2009-08-19 09:13 ——– d—–w- c:\program files\Solar System 3D Screensaver
2009-08-19 09:13 . 2006-10-12 13:58 14667776 —-a-w- c:\windows\system32\Solar System 3D Screensaver.scr
2009-08-19 08:05 . 2009-08-25 18:34 ——– d—–w- c:\windows\ServicePackFiles
2009-08-19 08:04 . 2009-08-19 08:04 ——– d—–w- c:\program files\MSXML 4.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-27 10:18 . 2009-08-19 02:40 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-08-23 14:02 . 2009-08-19 08:06 71144 —-a-w- d:\documents and settings\bailey.048919120306\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-21 09:51 . 2009-08-19 02:40 ——– d—–w- c:\program files\Norton Internet Security
2009-08-20 21:20 . 2009-08-20 21:04 71144 —-a-w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-19 10:08 . 2008-08-07 17:38 ——– d—a-w- d:\documents and settings\All Users\Application Data\TEMP
2009-08-19 02:47 . 2009-08-20 21:04 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\AOL
2009-08-19 02:47 . 2009-08-19 08:06 ——– d—–w- d:\documents and settings\bailey.048919120306\Application Data\AOL
2009-08-19 02:47 . 2009-08-18 19:21 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\AOL
2009-08-19 02:44 . 2005-10-17 19:31 ——– d—–w- d:\documents and settings\All Users\Application Data\AOL
2009-08-19 02:43 . 2009-08-19 02:40 ——– d—–w- c:\program files\Microsoft Works
2009-08-19 02:41 . 2009-08-19 02:40 ——– d—–w- c:\program files\Common Files\SureThing Shared
2009-08-19 02:41 . 2009-08-19 02:40 ——– d—–w- c:\program files\Common Files\Sonic Shared
2009-08-18 21:06 . 2009-08-18 21:06 ——– d—–w- c:\program files\NVIDIA Corporation
2009-08-18 21:03 . 2009-08-18 21:03 ——– d—–w- c:\program files\SystemRequirementsLab
2009-08-18 20:05 . 2009-08-18 19:47 ——– d—–w- c:\program files\Electronic Arts
2009-08-18 20:05 . 2009-08-18 20:05 ——– d—–w- c:\program files\Microsoft WSE
2009-08-18 19:47 . 2009-08-19 02:40 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-08-18 19:34 . 2009-08-18 19:34 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-08-18 19:34 . 2009-08-19 02:40 ——– d—–w- c:\program files\Java
2009-08-18 19:32 . 2009-08-19 02:40 ——– d—–w- c:\program files\Symantec
2009-08-18 19:31 . 2009-08-18 19:31 ——– d—–w- c:\program files\SymNetDrv
2009-08-18 19:26 . 2006-03-07 08:22 ——– d—–w- d:\documents and settings\All Users\Application Data\Skype
2009-08-18 19:25 . 2009-08-19 02:47 ——– d—–w- d:\documents and settings\All Users\Application Data\Symantec
2009-08-18 17:02 . 2009-08-18 17:02 ——– d—–w- d:\documents and settings\Lisa's Internett x\Application Data\Apple Computer
2009-08-18 15:40 . 2009-08-15 08:45 ——– d—–w- d:\documents and settings\Bailey\Application Data\OnlineArmor
2009-08-18 10:14 . 2009-08-18 10:14 0 —-a-w- d:\documents and settings\Lisa's Internett x\Application Data\wklnhst.dat
2009-08-17 19:14 . 2009-08-17 19:14 ——– d—–w- d:\documents and settings\Lisa's Internett x\Application Data\Malwarebytes
2009-08-12 19:21 . 2008-01-04 11:34 ——– d—–w- d:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-11 21:14 . 2009-08-11 21:14 ——– d—–w- d:\documents and settings\All Users\Application Data\NVIDIA Corporation
2009-08-11 19:31 . 2009-04-28 13:05 111472 —-a-w- d:\documents and settings\Lisa's Internett x\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-09 17:34 . 2008-02-09 16:15 111472 -c–a-w- d:\documents and settings\Renshai Warrior.048919120306.001\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-05 09:11 . 2004-08-10 15:38 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-01 19:21 . 2006-09-08 13:47 ——– d—–w- d:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-29 04:53 . 2004-08-10 15:38 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-07-29 04:53 . 2004-08-10 15:37 82432 —-a-w- c:\windows\system32\fontsub.dll
2009-07-28 10:43 . 2009-04-26 08:37 ——– d—–w- d:\documents and settings\All Users\Application Data\avg8
2009-07-26 15:44 . 2009-07-26 15:44 48448 —-a-w- c:\windows\system32\sirenacm.dll
2009-07-17 18:55 . 2004-08-10 15:37 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-14 18:54 . 2009-08-18 21:05 2189856 —-a-w- c:\windows\system32\nvcuvid.dll
2009-07-14 18:54 . 2009-08-18 21:05 1706528 —-a-w- c:\windows\system32\nvcuvenc.dll
2009-07-14 18:54 . 2009-08-18 21:05 868352 —-a-w- c:\windows\system32\nvapi.dll
2009-07-14 18:54 . 2009-08-18 21:05 2002944 —-a-w- c:\windows\system32\nvcuda.dll
2009-07-14 18:54 . 2009-08-18 21:05 1597690 —-a-w- c:\windows\system32\nvdata.bin
2009-07-14 18:54 . 2005-10-17 19:22 485920 —-a-w- c:\windows\system32\nvudisp.exe
2009-07-14 18:54 . 1979-12-31 23:00 7741664 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-07-14 18:54 . 1979-12-31 23:00 5842816 —-a-w- c:\windows\system32\nv4_disp.dll
2009-07-14 18:54 . 1979-12-31 23:00 151552 —-a-w- c:\windows\system32\nvcodins.dll
2009-07-14 18:54 . 1979-12-31 23:00 151552 —-a-w- c:\windows\system32\nvcod.dll
2009-07-14 18:54 . 1979-12-31 23:00 10457088 —-a-w- c:\windows\system32\nvoglnt.dll
2009-07-14 12:35 . 2009-07-14 12:35 2173472 —-a-w- c:\windows\system32\nvcplui.exe
2009-07-14 12:35 . 2009-07-14 12:35 81920 —-a-w- c:\windows\system32\nvwddi.dll
2009-07-14 12:35 . 2009-07-14 12:35 4026368 —-a-w- c:\windows\system32\nvvitvs.dll
2009-07-14 12:35 . 2009-07-14 12:35 3170304 —-a-w- c:\windows\system32\nvwss.dll
2009-07-14 12:34 . 2009-07-14 12:34 86016 —-a-w- c:\windows\system32\nvmctray.dll
2009-07-14 12:34 . 2009-07-14 12:34 4923392 —-a-w- c:\windows\system32\nvdisps.dll
2009-07-14 12:34 . 2009-07-14 12:34 3547136 —-a-w- c:\windows\system32\nvgames.dll
2009-07-14 12:34 . 2009-07-14 12:34 188416 —-a-w- c:\windows\system32\nvmccss.dll
2009-07-14 12:34 . 2009-07-14 12:34 168004 —-a-w- c:\windows\system32\nvsvc32.exe
2009-07-14 12:34 . 2009-07-14 12:34 143360 —-a-w- c:\windows\system32\nvcolor.exe
2009-07-14 12:34 . 2009-07-14 12:34 13877248 —-a-w- c:\windows\system32\nvcpl.dll
2009-07-14 12:34 . 2009-07-14 12:34 1286144 —-a-w- c:\windows\system32\nvmobls.dll
2009-07-14 12:34 . 2009-07-14 12:34 229376 —-a-w- c:\windows\system32\nvmccs.dll
2009-07-14 11:53 . 2009-07-14 11:53 ——– d—–w- d:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-07-13 09:08 . 2004-08-10 15:38 286720 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-10 20:23 . 2009-07-10 20:23 ——– d—–w- d:\documents and settings\All Users\Application Data\Electronic Arts
2009-07-10 11:15 . 2009-07-10 11:15 306544 —-a-w- c:\windows\WLXPGSS.SCR
2009-07-10 06:01 . 2005-10-17 19:22 485920 —-a-w- c:\windows\system32\NVUNINST.EXE
2009-06-29 16:12 . 2004-08-10 15:38 827392 ——w- c:\windows\system32\wininet.dll
2009-06-29 16:12 . 2004-08-10 15:37 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-06-29 16:12 . 2004-08-10 15:37 17408 ——w- c:\windows\system32\corpol.dll
2009-06-26 16:18 . 2004-08-10 15:38 474112 —-a-w- c:\windows\system32\shlwapi(2).dll
2009-06-26 16:18 . 2004-08-10 15:37 1023488 —-a-w- c:\windows\system32\browseui(2).dll
2009-06-25 08:44 . 2004-08-10 15:38 59392 —-a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:44 . 2004-08-10 15:38 59392 —-a-w- c:\windows\system32\wdigest(2).dll
2009-06-25 08:44 . 2004-08-10 15:38 56320 —-a-w- c:\windows\system32\secur32.dll
2009-06-25 08:44 . 2004-08-10 15:38 56320 —-a-w- c:\windows\system32\secur32(2).dll
2009-06-25 08:44 . 2004-08-10 15:38 168448 —-a-w- c:\windows\system32\schannel.dll
2009-06-25 08:44 . 2004-08-10 15:38 133632 —-a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:44 . 2004-08-10 15:37 724480 —-a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:44 . 2004-08-10 15:37 298496 —-a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:44 . 2004-08-10 15:37 298496 —-a-w- c:\windows\system32\kerberos(2).dll
2009-06-22 11:34 . 2004-08-10 15:37 92544 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-12 11:50 . 2004-08-10 15:38 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 14:21 . 2004-08-10 15:37 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:32 . 2004-08-10 15:38 132096 —-a-w- c:\windows\system32\wkssvc.dll
2009-06-07 00:54 . 2009-06-07 00:54 252856 —-a-w- d:\documents and settings\LocalService.NT AUTHORITY.014\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-06-05 07:42 . 2004-08-10 15:54 655872 —-a-w- c:\windows\system32\mstscax.dll
2009-06-03 19:27 . 2004-08-10 15:38 1290752 —-a-w- c:\windows\system32\quartz.dll
2009-06-03 19:27 . 2004-08-10 15:38 1290752 —-a-w- c:\windows\system32\quartz(2).dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-26_21.02.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-22 09:47 . 2009-07-14 11:03 46080 c:\windows\system32\tzchange.exe
+ 2005-10-17 19:26 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll
- 2005-10-17 19:26 . 2008-07-08 13:02 17272 c:\windows\system32\spmsg.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-06-30 2329224]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-18 149280]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-01-17 58728]
"Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 90112]
"PCMService"="c:\apps\Powercinema\PCMService.exe" [2005-05-11 127118]
"ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 24576]
"EmailChecker"="c:\apps\EmailChecker\ech.exe" [2003-07-02 40960]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2009-08-18 100056]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-07-08 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-14 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-07-14 86016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"IObit Security 360"="c:\program files\IObit\IObit Security 360\IS360tray.exe" [2009-08-20 943888]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" - c:\windows\system32\Hdaudpropshortcut.exe [2004-03-17 61952]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SoundMan.exe [2004-09-10 77824]
"AlcWzrd"="ALCWZRD.EXE" - c:\windows\ALCWZRD.EXE [2004-09-15 2557952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

d:\documents and settings\lisa.SN048919120306\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2006-1-30 225280]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\APPS\\skype\\phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [20/08/2009 22:19 54752]
R2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\is360srv.exe [21/08/2009 18:50 305936]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
.
Contents of the 'Scheduled Tasks' folder

2009-08-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-08-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3965977090-3551812889-490671574-1007Core.job
- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-20 21:09]

2009-08-27 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3965977090-3551812889-490671574-1007UA.job
- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-20 21:09]

2009-08-18 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\system32\OOBE\oobebaln.exe [2004-08-10 13:00]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.kibagames.com/Game/Boys/Spiderman_Dress_Up
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-27 11:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2776)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
.
Completion time: 2009-08-27 11:52
ComboFix-quarantined-files.txt 2009-08-27 10:52
ComboFix2.txt 2009-08-26 21:03

Pre-Run: 15,057,375,232 bytes free
Post-Run: 15,020,515,328 bytes free

318 — E O F — 2009-08-27 00:21

—————————–

SystemLook v1.0 by jpshortstuff (18.05.09)
Log created at 12:08 on 27/08/2009 by bailey (Administrator - Elevation successful)

========== dir ==========

d:\documents and settings\All Users\Application Data\3399 - Parameters: "/s"

—Files—
{84CCF9B6-079A-463A-A70A-DFC7CF84C476}.swf –a— 2329 bytes [01:29 21/08/2009] [14:19 07/07/2009]

No folders found.

d:\documents and settings\All Users\Application Data\2B138 - Parameters: "/s"

—Files—
{0651FC59-1EDD-497C-AC2E-B2E762460BBD}.swf –a— 2329 bytes [01:20 21/08/2009] [14:19 07/07/2009]

No folders found.

-=End Of File=-

CatByte

Post #8August 27, 2009, 12:05 PM UTC

Please do the following:

Download Sec-Info2.zip from here and save it to your Desktop. You will need to extract the file.

Right click on the zipped folder and from the menu that appears, click on Extract All…
In the 'Extraction Wizard' window that opens, click on Next> and in the next window that appears, click on Next> again.
In the final window, click on Finish

You should now see a folder with a .vbs file in it. Double click Sec-info2.vbs to run it and a text file called Sec-Info.txt should be created in the same folder - either that or you'll get an error message.
Please copy and paste the contents of the text file into your next reply and then you can delete both of the folders and their contents.

Also, please advise how your computer is running and if there are still outstanding issues

lisafunkypants

Post #9August 27, 2009, 12:21 PM UTC

Script run: 27/08/2009 13:15:56 ~~~~~~~~~~~~~~~~~~~~~~~~ Company Name: Symantec Corporation AV Name: Norton Internet Security Version Number: 2005 On-Access Scanning Enabled: No Product up-to-date: Yes ~~~~~~~~~~~~~~~~~~~~~~~~ Company Name: Symantec Corporation Firewall Name: Norton Internet Security Version Number: 2005 Enabled: No ~~~~~~~~~~~~~~~~~~~~~~~~ The Windows Firewall is disabled. ~~~~~~~~~~~~~~~~~~~~~~~~ The Security Center Anti-Virus Alerts are disabled. The Security Center Firewall Alerts are disabled. ~~~~~~~~~~~~~~~~~~~~~~~~ Number of Restore Points found: 8 ~~~~~~~~~~~~~~~~~~~~~~~~ Still hard to access internet when it does its like a snail, my account is totally unusable so think i may just delete that one and start afresh, not had any alerts as yet which is better but if that is me done then to be honest think i should get new pc lol, as this one sounds like it has a jet engine running inside it. Thanks for your help by the way

CatByte

Post #10August 27, 2009, 12:31 PM UTC

Please run the following command

Click Start > Run then copy/paste the following single-line command into the Run box and click OK:

C:\Qoobox\Add-Remove Programs.txt

A text file should open.

Post the contents of that file in your next reply.

lisafunkypants

Post #11August 28, 2009, 1:19 PM UTC

3-D Salt Water Fish Tank Demo 2 Screen Saver Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 7.0 Advanced SystemCare 3 Apple Mobile Device Support Apple Software Update Bonjour CC_ccProxyExt ccCommon ccPxyCore EA Download Manager ESET Online Scanner v3 High Definition Audio Driver Package - KB835221 HijackThis 2.0.2 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB935448) Hotfix for Windows XP (KB952287) Hotfix for Windows XP (KB954550-v5) Hotfix for Windows XP (KB954708) Hotfix for Windows XP (KB961118) Hotfix for Windows XP (KB970653-v3) IObit Security 360 RC iTunes J2SE Runtime Environment 5.0 Update 2 Java™ 6 Update 15 Junk Mail filter update LimeWire 5.2.13 LiveReg (Symantec Corporation) LiveUpdate 3.0 (Symantec Corporation) Living 3D Dolphins Full Screen Saver Living 3D Waterfalls Full Screen Saver Macromedia Shockwave Player Malwarebytes' Anti-Malware Messenger Plus! Live Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.0 Service Pack 2 Microsoft .NET Framework 3.5 SP1 Microsoft Application Error Reporting Microsoft Choice Guard Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Works Microsoft WSE 3.0 Runtime MSRedist MSVCRT MSXML 4.0 SP2 (KB954430) MSXML 6 Service Pack 2 (KB954459) Norton AntiSpam Norton AntiVirus 2005 Norton Internet Security Norton Internet Security 2005 (Symantec Corporation) Norton WMI Update NVIDIA Drivers NVIDIA nView Desktop Manager QuickTime Realtek High Definition Audio Driver Security Update for CAPICOM (KB931906) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB938127-v2) Security Update for Windows Internet Explorer 7 (KB972260) Security Update for Windows Media Encoder (KB954156) Security Update for Windows Media Player (KB952069) Security Update for Windows Media Player (KB973540) Security Update for Windows XP (KB901190) Security Update for Windows XP (KB923561) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB938464-v2) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB944338-v2) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952004) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB954600) Security Update for Windows XP (KB955069) Security Update for Windows XP (KB956572) Security Update for Windows XP (KB956802) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB957097) Security Update for Windows XP (KB958470) Security Update for Windows XP (KB958644) Security Update for Windows XP (KB958687) Security Update for Windows XP (KB959426) Security Update for Windows XP (KB960225) Security Update for Windows XP (KB960803) Security Update for Windows XP (KB960859) Security Update for Windows XP (KB961371-v2) Security Update for Windows XP (KB961501) Security Update for Windows XP (KB968537) Security Update for Windows XP (KB969897) Security Update for Windows XP (KB970238) Security Update for Windows XP (KB971557) Security Update for Windows XP (KB971633) Security Update for Windows XP (KB971657) Security Update for Windows XP (KB972260) Security Update for Windows XP (KB973346) Security Update for Windows XP (KB973354) Security Update for Windows XP (KB973507) Security Update for Windows XP (KB973869) Segoe UI Solar System 3D Screensaver 1.4 Sonic MyDVD Sonic RecordNow! SPBBC SpywareBlaster 4.2 Symantec Network Drivers Update SymNet System Requirements Lab The Sims™ 3 Update for Windows XP (KB898461) Update for Windows XP (KB925720) Update for Windows XP (KB955839) Update for Windows XP (KB961503) Update for Windows XP (KB967715) Update for Windows XP (KB968389) Update for Windows XP (KB973815) WebFldrs XP Windows Imaging Component Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Family Safety Windows Live Mail Windows Live Messenger Windows Live Photo Gallery Windows Live Sign-in Assistant Windows Live Sync Windows Live Upload Tool Windows Live Writer Windows Media Encoder 9 Series Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890047 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB890923 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893066 Windows XP Hotfix - KB893086 Zwangi 1.0 build 110

CatByte

Post #12August 28, 2009, 1:34 PM UTC

Hi,

Zwangi is still showing in your installed programs list…does it show up in your Add/Remove programs?

If not I can remove that

You are still showing as having IOBIT AntiVirus installed "IObit Security 360 RC"

You can remove the older version of Java through Add/Remove programs

J2SE Runtime Environment 5.0 Update 2

3-D Salt Water Fish Tank Demo 2 Screen Saver
Living 3D Dolphins Full Screen Saver
Living 3D Waterfalls Full Screen Saver

These items use a lot of system resources…If you don't really love them, I would remove them.

If you use Windows Live messenger then remove Messenger Plus! Live

lisafunkypants

Post #13August 28, 2009, 8:29 PM UTC

Hi i have deleted the screensavers except the dolphin one because i like that one, i have removed the Java. I did not know that IObit Security was anti virus i thought it was just a malware scanner would that be conflicting with Norton then? And i do not have the Zwangi on Add & Remove so it would be a great help if you could help me remove that. My daughter uses Messenger plus we dont use Windows mess' should i remove that?

CatByte

Post #14August 28, 2009, 10:29 PM UTC

Hi,

My mistake, I apologize, I thought you had the Iobit security suite which includes the antivirus, but your version is just the standalone, so it will be fine to keep. Leave the windows messenger, it won't interfere with anything.

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

Folder::
d:\documents and settings\All Users\Application Data\Zwangi
c:\program files\ZwangiSearch

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

NEXT

Please describe how your computer is running and if there are any outstanding issues.

lisafunkypants

Post #15August 29, 2009, 12:00 PM UTC

ComboFix 09-08-28.05 - bailey 29/08/2009 12:42.3.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.44.1033.18.1023.571 [GMT 1:00]
Running from: d:\documents and settings\[removed]\Desktop\Combo-Fix.exe
Command switches used :: d:\documents and settings\bailey.048919120306\Desktop\CFScript.txt
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\ZwangiSearch
c:\program files\ZwangiSearch\ZwangiSearch_deleted_\zwangi.dll
d:\documents and settings\All Users\Application Data\Zwangi
d:\documents and settings\All Users\Application Data\Zwangi\zwangi110.exe

.
((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-29 )))))))))))))))))))))))))))))))
.

2009-08-27 18:44 . 2009-08-27 18:44 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\ArcSoft
2009-08-27 18:40 . 2006-11-10 14:05 18688 —-a-w- c:\windows\system32\drivers\afc.sys
2009-08-27 18:40 . 2005-04-27 15:36 245408 —-a-w- c:\windows\system32\unicows.dll
2009-08-27 18:40 . 1995-08-01 03:44 212480 —-a-w- c:\windows\PCDLIB32.DLL
2009-08-27 18:40 . 2009-08-27 18:40 ——– d—–w- c:\program files\Common Files\ArcSoft
2009-08-27 18:40 . 2009-08-27 18:40 ——– d—–w- c:\program files\ArcSoft
2009-08-27 18:37 . 2007-03-12 13:25 33728 —-a-w- c:\windows\system32\drivers\STK02NW1.sys
2009-08-27 18:37 . 2007-03-12 13:25 101520 —-a-w- c:\windows\system32\drivers\STK02NW2.sys
2009-08-27 18:37 . 2009-08-27 18:37 ——– d—–w- c:\windows\STK02N
2009-08-27 18:37 . 2009-08-27 18:37 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\InstallShield
2009-08-27 18:23 . 2009-08-27 18:23 ——– d—–w- c:\windows\PAC207
2009-08-27 18:23 . 2009-08-27 18:23 ——– d—–w- c:\program files\Common Files\PCCamera
2009-08-27 18:23 . 2009-08-27 18:23 ——– d—–w- c:\program files\ORITE
2009-08-27 18:22 . 2009-08-27 18:22 ——– d—–w- c:\windows\Downloaded Installations
2009-08-27 18:03 . 2009-08-27 18:03 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\Blitware
2009-08-27 17:57 . 2009-08-27 17:57 ——– d—–w- d:\documents and settings\NetworkService.NT AUTHORITY.015\Local Settings\Application Data\Apple
2009-08-27 10:38 . 2009-08-27 10:38 ——– d—–w- d:\documents and settings\bailey.048919120306\Application Data\IObit
2009-08-26 10:27 . 2009-08-26 10:27 ——– d—–w- c:\program files\ESET
2009-08-25 22:59 . 2009-08-25 22:59 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\Ulead Systems
2009-08-25 22:56 . 2004-08-03 22:08 26496 —-a-w- c:\windows\system32\dllcache\usbstor.sys
2009-08-25 20:09 . 2009-08-25 20:09 ——– d—–w- c:\windows\system32\wbem\Repository
2009-08-25 18:36 . 2009-08-25 18:36 ——– d—–w- c:\windows\system32\scripting
2009-08-25 18:36 . 2009-08-25 18:36 ——– d—–w- c:\windows\l2schemas
2009-08-24 10:14 . 2009-07-19 13:32 6067200 ——w- c:\windows\system32\dllcache\ieframe.dll
2009-08-24 10:14 . 2009-06-29 16:12 52224 ——w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-08-24 10:14 . 2009-06-29 16:12 459264 ——w- c:\windows\system32\dllcache\msfeeds.dll
2009-08-24 10:14 . 2009-06-29 16:12 268288 ——w- c:\windows\system32\dllcache\iertutil.dll
2009-08-24 10:14 . 2009-06-29 16:12 63488 ——w- c:\windows\system32\dllcache\icardie.dll
2009-08-24 10:14 . 2009-06-29 16:12 380928 ——w- c:\windows\system32\dllcache\ieapfltr.dll
2009-08-24 10:14 . 2009-06-29 11:07 13824 ——w- c:\windows\system32\dllcache\ieudinit.exe
2009-08-24 10:14 . 2009-06-29 08:33 2452872 ——w- c:\windows\system32\dllcache\ieapfltr.dat
2009-08-23 14:02 . 2009-08-29 10:53 ——– d—–w- d:\documents and settings\bailey.048919120306\Tracing
2009-08-21 22:43 . 2009-08-21 22:43 ——– d—–w- c:\program files\Microsoft CAPICOM 2.1.0.2
2009-08-21 21:39 . 2009-08-21 21:39 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Adobe
2009-08-21 21:00 . 2009-08-21 21:00 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\OD2
2009-08-21 20:32 . 2009-08-21 20:32 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\Malwarebytes
2009-08-21 17:50 . 2009-08-21 17:50 ——– d—–w- d:\documents and settings\All Users\Application Data\IObit
2009-08-21 17:50 . 2009-08-21 19:15 ——– d—–w- c:\program files\IObit
2009-08-21 16:38 . 2009-08-25 19:54 ——– d—–w- d:\documents and settings\bikini babe\Tracing
2009-08-21 10:59 . 2008-10-16 13:06 268648 —-a-w- c:\windows\system32\mucltui.dll
2009-08-21 10:59 . 2008-10-16 13:06 208744 —-a-w- c:\windows\system32\muweb.dll
2009-08-21 01:29 . 2009-08-21 01:29 ——– d—–w- d:\documents and settings\All Users\Application Data\3399
2009-08-21 01:20 . 2009-08-21 01:20 ——– d—–w- d:\documents and settings\All Users\Application Data\2B138
2009-08-21 01:03 . 2009-08-21 01:03 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\Apple Computer
2009-08-21 01:03 . 2009-03-19 15:32 23400 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-08-21 01:03 . 2008-04-17 11:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2009-08-21 01:03 . 2009-08-21 01:03 ——– d—–w- c:\program files\iPod
2009-08-21 01:03 . 2009-08-21 01:03 ——– d—–w- c:\program files\iTunes
2009-08-21 01:02 . 2009-08-21 01:02 ——– d—–w- c:\program files\Bonjour
2009-08-21 01:02 . 2009-08-21 01:02 ——– d—–w- c:\program files\QuickTime
2009-08-21 01:01 . 2009-08-21 01:01 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Apple
2009-08-21 01:01 . 2009-08-21 01:01 ——– d—–w- c:\program files\Apple Software Update
2009-08-21 01:00 . 2009-08-21 01:03 ——– d—–w- c:\program files\Common Files\Apple
2009-08-21 01:00 . 2009-08-21 01:03 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Apple Computer
2009-08-20 23:29 . 2009-08-20 23:29 ——– d—–w- d:\documents and settings\All Users\Application Data\Winferno
2009-08-20 23:28 . 2009-08-20 23:28 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\Jenkat
2009-08-20 23:28 . 2009-08-20 23:28 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\blinkx
2009-08-20 23:25 . 2006-10-10 13:39 405504 —-a-w- c:\windows\Living 3D Dolphins Full.scr
2009-08-20 23:25 . 2009-08-20 23:28 ——– d—–w- c:\program files\Freeze.com
2009-08-20 23:24 . 2009-08-21 11:26 ——– d—–w- c:\program files\Winferno
2009-08-20 23:00 . 2009-08-20 23:00 20480 —-a-w- d:\documents and settings\leah.048919120306.000\Application Data\LimeWire\browser\xulrunner\components\autoconfig.dll
2009-08-20 23:00 . 2009-08-20 23:00 17408 —-a-w- d:\documents and settings\leah.048919120306.000\Application Data\LimeWire\browser\xulrunner\components\auth.dll
2009-08-20 23:00 . 2009-08-20 23:00 18944 —-a-w- d:\documents and settings\leah.048919120306.000\Application Data\LimeWire\browser\xulrunner\components\appshell_modal.dll
2009-08-20 23:00 . 2009-08-20 23:00 8192 —-a-w- d:\documents and settings\leah.048919120306.000\Application Data\LimeWire\browser\xulrunner\AccessibleMarshal.dll
2009-08-20 23:00 . 2009-08-20 23:00 20480 —-a-w- d:\documents and settings\leah.048919120306.000\Application Data\LimeWire\browser\xulrunner\IA2Marshal.dll
2009-08-20 22:58 . 2009-08-23 18:12 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\LimeWire
2009-08-20 22:55 . 2009-08-20 22:56 ——– d—–w- c:\program files\LimeWire
2009-08-20 21:26 . 2009-08-20 21:26 ——– d-sh–w- d:\documents and settings\leah.048919120306.000\UserData
2009-08-20 21:22 . 2009-08-20 21:22 ——– d—–w- c:\program files\Messenger Plus! Live
2009-08-20 21:20 . 2009-08-28 16:03 ——– d—–w- d:\documents and settings\leah.048919120306.000\Tracing
2009-08-20 21:20 . 2009-08-22 06:28 ——– d—–w- c:\program files\Microsoft Silverlight
2009-08-20 21:19 . 2009-08-21 01:03 ——– dc—-w- c:\windows\system32\DRVSTORE
2009-08-20 21:19 . 2009-08-05 21:48 54752 —-a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2009-08-20 21:19 . 2006-11-29 12:06 3426072 —-a-w- c:\windows\system32\d3dx9_32.dll
2009-08-20 21:18 . 2009-08-20 21:18 ——– d—–w- c:\program files\Microsoft SQL Server Compact Edition
2009-08-20 21:17 . 2009-08-20 21:17 ——– d—–w- c:\program files\Microsoft
2009-08-20 21:17 . 2009-08-20 21:17 ——– d—–w- c:\program files\Windows Live SkyDrive
2009-08-20 21:16 . 2009-08-20 21:19 ——– d—–w- c:\program files\Windows Live
2009-08-20 21:14 . 2009-08-20 21:14 ——– d—–w- c:\program files\Common Files\Windows Live
2009-08-20 21:09 . 2009-08-27 22:15 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Temp
2009-08-20 21:09 . 2009-08-20 21:09 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Google
2009-08-20 21:08 . 2009-08-20 21:09 ——– d—–w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Deployment
2009-08-20 16:57 . 2009-08-20 16:57 ——– d—–w- c:\program files\Trend Micro
2009-08-20 10:24 . 2009-08-20 10:24 ——– d—–w- d:\documents and settings\bailey.048919120306\Application Data\Ulead Systems
2009-08-20 10:08 . 2008-04-02 19:00 198656 —-a-w- c:\windows\system32\CNMLM83.DLL
2009-08-20 10:01 . 2004-08-03 22:01 25856 —-a-w- c:\windows\system32\drivers\usbprint.sys
2009-08-20 10:01 . 2004-08-03 22:01 25856 —-a-w- c:\windows\system32\dllcache\usbprint.sys
2009-08-20 10:01 . 2004-08-03 21:58 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys
2009-08-20 10:01 . 2004-08-03 21:58 15104 —-a-w- c:\windows\system32\dllcache\usbscan.sys
2009-08-20 00:51 . 2009-08-20 00:51 ——– d—–w- c:\windows\system32\XPSViewer
2009-08-20 00:51 . 2009-08-20 00:51 ——– d—–w- c:\program files\MSBuild
2009-08-20 00:51 . 2009-08-20 00:51 ——– d—–w- c:\program files\Reference Assemblies
2009-08-20 00:50 . 2008-07-06 12:06 89088 ——w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-20 00:50 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2009-08-20 00:50 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-20 00:50 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2009-08-20 00:50 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-20 00:50 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2009-08-20 00:50 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-20 00:50 . 2009-08-20 00:51 ——– d—–w- C:\f6fe359d59fc775063cca5f70f4051
2009-08-20 00:48 . 2009-08-20 00:48 ——– d—–w- c:\program files\MSXML 6.0
2009-08-19 21:04 . 2009-08-25 20:09 ——– d—–w- c:\windows\system32\CatRoot_bak
2009-08-19 16:53 . 2009-08-19 16:53 73728 —-a-w- c:\windows\ALCFDRTM.EXE
2009-08-19 10:09 . 2009-08-03 12:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-19 10:09 . 2009-08-19 10:09 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-08-19 10:09 . 2009-08-03 12:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-08-19 10:07 . 2009-08-19 10:07 ——– d—–w- c:\program files\SpywareBlaster
2009-08-19 09:24 . 2009-08-19 09:24 503808 —-a-w- c:\windows\Tranquil - Waterfalls.scr
2009-08-19 09:23 . 2009-08-19 09:23 606848 —-a-w- c:\windows\flashax.exe
2009-08-19 09:23 . 2009-08-19 09:23 12288 —-a-w- c:\windows\impborl.dll
2009-08-19 09:13 . 2009-08-19 09:13 ——– d—–w- c:\program files\Solar System 3D Screensaver
2009-08-19 09:13 . 2006-10-12 13:58 14667776 —-a-w- c:\windows\system32\Solar System 3D Screensaver.scr
2009-08-19 08:05 . 2009-08-25 18:34 ——– d—–w- c:\windows\ServicePackFiles
2009-08-19 08:04 . 2009-08-19 08:04 ——– d—–w- c:\program files\MSXML 4.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-28 20:24 . 2009-08-19 02:40 ——– d—–w- c:\program files\Java
2009-08-28 19:04 . 2009-08-19 02:40 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-08-28 13:57 . 2009-08-28 13:35 ——– d—–w- d:\documents and settings\bailey.048919120306\Application Data\LimeWire
2009-08-28 12:28 . 2009-08-19 02:40 ——– d—–w- c:\program files\Norton Internet Security
2009-08-27 18:39 . 2009-08-19 02:40 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-08-27 18:22 . 2009-08-19 02:40 ——– d—–w- c:\program files\Common Files\InstallShield
2009-08-23 14:02 . 2009-08-19 08:06 71144 —-a-w- d:\documents and settings\bailey.048919120306\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-20 21:20 . 2009-08-20 21:04 71144 —-a-w- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-19 10:08 . 2008-08-07 17:38 ——– d—a-w- d:\documents and settings\All Users\Application Data\TEMP
2009-08-19 02:47 . 2009-08-20 21:04 ——– d—–w- d:\documents and settings\leah.048919120306.000\Application Data\AOL
2009-08-19 02:47 . 2009-08-19 08:06 ——– d—–w- d:\documents and settings\bailey.048919120306\Application Data\AOL
2009-08-19 02:44 . 2005-10-17 19:31 ——– d—–w- d:\documents and settings\All Users\Application Data\AOL
2009-08-19 02:43 . 2009-08-19 02:40 ——– d—–w- c:\program files\Microsoft Works
2009-08-19 02:41 . 2009-08-19 02:40 ——– d—–w- c:\program files\Common Files\SureThing Shared
2009-08-19 02:41 . 2009-08-19 02:40 ——– d—–w- c:\program files\Common Files\Sonic Shared
2009-08-18 21:06 . 2009-08-18 21:06 ——– d—–w- c:\program files\NVIDIA Corporation
2009-08-18 21:03 . 2009-08-18 21:03 ——– d—–w- c:\program files\SystemRequirementsLab
2009-08-18 20:05 . 2009-08-18 19:47 ——– d—–w- c:\program files\Electronic Arts
2009-08-18 20:05 . 2009-08-18 20:05 ——– d—–w- c:\program files\Microsoft WSE
2009-08-18 19:34 . 2009-08-18 19:34 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-08-18 19:32 . 2009-08-19 02:40 ——– d—–w- c:\program files\Symantec
2009-08-18 19:31 . 2009-08-18 19:31 ——– d—–w- c:\program files\SymNetDrv
2009-08-18 19:26 . 2006-03-07 08:22 ——– d—–w- d:\documents and settings\All Users\Application Data\Skype
2009-08-18 19:25 . 2009-08-19 02:47 ——– d—–w- d:\documents and settings\All Users\Application Data\Symantec
2009-08-18 17:02 . 2009-08-18 17:02 ——– d—–w- d:\documents and settings\Lisa's Internett x\Application Data\Apple Computer
2009-08-18 15:40 . 2009-08-15 08:45 ——– d—–w- d:\documents and settings\Bailey\Application Data\OnlineArmor
2009-08-18 10:14 . 2009-08-18 10:14 0 —-a-w- d:\documents and settings\Lisa's Internett x\Application Data\wklnhst.dat
2009-08-17 19:14 . 2008-09-18 20:43 3942048 -c–a-w- d:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-17 19:14 . 2009-08-17 19:14 ——– d—–w- d:\documents and settings\Lisa's Internett x\Application Data\Malwarebytes
2009-08-12 19:21 . 2008-01-04 11:34 ——– d—–w- d:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-11 21:14 . 2009-08-11 21:14 ——– d—–w- d:\documents and settings\All Users\Application Data\NVIDIA Corporation
2009-08-11 19:31 . 2009-04-28 13:05 111472 —-a-w- d:\documents and settings\Lisa's Internett x\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-09 17:34 . 2008-02-09 16:15 111472 -c–a-w- d:\documents and settings\Renshai Warrior.048919120306.001\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-05 09:11 . 2004-08-10 15:38 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 09:08 . 2009-08-05 09:08 36864 —-a-w- d:\documents and settings\leah.048919120306.000\Application Data\Jenkat\Jenkat Games Arcade\upApp.exe
2009-08-01 19:21 . 2006-09-08 13:47 ——– d—–w- d:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-29 04:53 . 2004-08-10 15:38 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-07-29 04:53 . 2004-08-10 15:37 82432 —-a-w- c:\windows\system32\fontsub.dll
2009-07-28 10:43 . 2009-04-26 08:37 ——– d—–w- d:\documents and settings\All Users\Application Data\avg8
2009-07-26 15:44 . 2009-07-26 15:44 48448 —-a-w- c:\windows\system32\sirenacm.dll
2009-07-17 18:55 . 2004-08-10 15:37 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-14 18:54 . 2009-08-18 21:05 2189856 —-a-w- c:\windows\system32\nvcuvid.dll
2009-07-14 18:54 . 2009-08-18 21:05 1706528 —-a-w- c:\windows\system32\nvcuvenc.dll
2009-07-14 18:54 . 2009-08-18 21:05 868352 —-a-w- c:\windows\system32\nvapi.dll
2009-07-14 18:54 . 2009-08-18 21:05 2002944 —-a-w- c:\windows\system32\nvcuda.dll
2009-07-14 18:54 . 2009-08-18 21:05 1597690 —-a-w- c:\windows\system32\nvdata.bin
2009-07-14 18:54 . 2005-10-17 19:22 485920 —-a-w- c:\windows\system32\nvudisp.exe
2009-07-14 18:54 . 1979-12-31 23:00 7741664 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-07-14 18:54 . 1979-12-31 23:00 5842816 —-a-w- c:\windows\system32\nv4_disp.dll
2009-07-14 18:54 . 1979-12-31 23:00 151552 —-a-w- c:\windows\system32\nvcodins.dll
2009-07-14 18:54 . 1979-12-31 23:00 151552 —-a-w- c:\windows\system32\nvcod.dll
2009-07-14 18:54 . 1979-12-31 23:00 10457088 —-a-w- c:\windows\system32\nvoglnt.dll
2009-07-14 12:35 . 2009-07-14 12:35 2173472 —-a-w- c:\windows\system32\nvcplui.exe
2009-07-14 12:35 . 2009-07-14 12:35 81920 —-a-w- c:\windows\system32\nvwddi.dll
2009-07-14 12:35 . 2009-07-14 12:35 4026368 —-a-w- c:\windows\system32\nvvitvs.dll
2009-07-14 12:35 . 2009-07-14 12:35 3170304 —-a-w- c:\windows\system32\nvwss.dll
2009-07-14 12:34 . 2009-07-14 12:34 86016 —-a-w- c:\windows\system32\nvmctray.dll
2009-07-14 12:34 . 2009-07-14 12:34 4923392 —-a-w- c:\windows\system32\nvdisps.dll
2009-07-14 12:34 . 2009-07-14 12:34 3547136 —-a-w- c:\windows\system32\nvgames.dll
2009-07-14 12:34 . 2009-07-14 12:34 188416 —-a-w- c:\windows\system32\nvmccss.dll
2009-07-14 12:34 . 2009-07-14 12:34 168004 —-a-w- c:\windows\system32\nvsvc32.exe
2009-07-14 12:34 . 2009-07-14 12:34 143360 —-a-w- c:\windows\system32\nvcolor.exe
2009-07-14 12:34 . 2009-07-14 12:34 13877248 —-a-w- c:\windows\system32\nvcpl.dll
2009-07-14 12:34 . 2009-07-14 12:34 1286144 —-a-w- c:\windows\system32\nvmobls.dll
2009-07-14 12:34 . 2009-07-14 12:34 229376 —-a-w- c:\windows\system32\nvmccs.dll
2009-07-14 11:53 . 2009-07-14 11:53 ——– d—–w- d:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-07-13 13:22 . 2009-07-13 13:22 75048 —-a-w- d:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-07-13 09:08 . 2004-08-10 15:38 286720 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-10 20:23 . 2009-07-10 20:23 ——– d—–w- d:\documents and settings\All Users\Application Data\Electronic Arts
2009-07-10 11:15 . 2009-07-10 11:15 306544 —-a-w- c:\windows\WLXPGSS.SCR
2009-07-10 06:01 . 2005-10-17 19:22 485920 —-a-w- c:\windows\system32\NVUNINST.EXE
2009-06-29 16:12 . 2004-08-10 15:38 827392 ——w- c:\windows\system32\wininet.dll
2009-06-29 16:12 . 2004-08-10 15:37 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-06-29 16:12 . 2004-08-10 15:37 17408 ——w- c:\windows\system32\corpol.dll
2009-06-26 16:18 . 2004-08-10 15:38 474112 —-a-w- c:\windows\system32\shlwapi(2).dll
2009-06-26 16:18 . 2004-08-10 15:37 1023488 —-a-w- c:\windows\system32\browseui(2).dll
2009-06-25 08:44 . 2004-08-10 15:38 59392 —-a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:44 . 2004-08-10 15:38 59392 —-a-w- c:\windows\system32\wdigest(2).dll
2009-06-25 08:44 . 2004-08-10 15:38 56320 —-a-w- c:\windows\system32\secur32.dll
2009-06-25 08:44 . 2004-08-10 15:38 56320 —-a-w- c:\windows\system32\secur32(2).dll
2009-06-25 08:44 . 2004-08-10 15:38 168448 —-a-w- c:\windows\system32\schannel.dll
2009-06-25 08:44 . 2004-08-10 15:38 133632 —-a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:44 . 2004-08-10 15:37 724480 —-a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:44 . 2004-08-10 15:37 298496 —-a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:44 . 2004-08-10 15:37 298496 —-a-w- c:\windows\system32\kerberos(2).dll
2009-06-22 11:34 . 2004-08-10 15:37 92544 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-13 19:41 . 2009-06-13 19:41 75048 —-a-w- d:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-12 11:50 . 2004-08-10 15:38 76288 —-a-w- c:\windows\system32\telnet.exe
2009-06-10 14:21 . 2004-08-10 15:37 84992 —-a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:32 . 2004-08-10 15:38 132096 —-a-w- c:\windows\system32\wkssvc.dll
2009-06-07 00:54 . 2009-06-07 00:54 252856 —-a-w- d:\documents and settings\LocalService.NT AUTHORITY.014\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-06-05 07:42 . 2004-08-10 15:54 655872 —-a-w- c:\windows\system32\mstscax.dll
2009-06-03 19:27 . 2004-08-10 15:38 1290752 —-a-w- c:\windows\system32\quartz.dll
2009-06-03 19:27 . 2004-08-10 15:38 1290752 —-a-w- c:\windows\system32\quartz(2).dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-26_21.02.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-27 18:43 . 2004-08-03 23:56 53760 c:\windows\system32\vfwwdm32.dll
+ 2008-10-22 09:47 . 2009-07-14 11:03 46080 c:\windows\system32\tzchange.exe
- 2005-10-17 19:26 . 2008-07-08 13:02 17272 c:\windows\system32\spmsg.dll
+ 2005-10-17 19:26 . 2009-05-26 11:40 17272 c:\windows\system32\spmsg.dll
+ 2004-01-08 09:30 . 2004-01-08 09:30 11170 c:\windows\system32\PA207USD.DLL
+ 2009-08-27 18:43 . 2004-08-03 22:10 19328 c:\windows\system32\drivers\WSTCODEC.SYS
+ 2009-08-27 18:43 . 2004-08-03 22:10 15360 c:\windows\system32\drivers\StreamIP.sys
+ 2009-08-27 18:43 . 2004-08-03 22:10 11136 c:\windows\system32\drivers\SLIP.sys
+ 2009-08-27 18:43 . 2004-08-03 22:10 10880 c:\windows\system32\drivers\NdisIP.sys
+ 2009-08-27 18:43 . 2004-08-03 22:10 85376 c:\windows\system32\drivers\NABTSFEC.sys
+ 2009-08-27 18:43 . 2004-08-03 22:10 17024 c:\windows\system32\drivers\CCDECODE.sys
+ 2009-08-27 18:43 . 2004-08-03 22:10 19328 c:\windows\system32\dllcache\wstcodec.sys
+ 2009-08-27 18:43 . 2004-08-03 23:56 53760 c:\windows\system32\dllcache\vfwwdm32.dll
+ 2009-08-27 18:43 . 2004-08-03 22:10 15360 c:\windows\system32\dllcache\streamip.sys
+ 2009-08-27 18:43 . 2004-08-03 22:10 11136 c:\windows\system32\dllcache\slip.sys
+ 2009-08-27 18:43 . 2004-08-03 22:10 10880 c:\windows\system32\dllcache\ndisip.sys
+ 2009-08-27 18:43 . 2004-08-03 22:10 85376 c:\windows\system32\dllcache\nabtsfec.sys
+ 2009-08-27 18:43 . 2004-08-03 22:10 17024 c:\windows\system32\dllcache\ccdecode.sys
+ 2009-08-27 18:37 . 2007-03-12 13:25 33728 c:\windows\STK02N\x86\STK02NW1.sys
+ 2009-08-27 18:37 . 2002-07-16 17:41 78336 c:\windows\STK02N\twunk_32.exe
+ 2009-08-27 18:37 . 2002-07-16 17:41 48560 c:\windows\STK02N\twunk_16.exe
+ 2009-08-27 18:37 . 2002-07-16 17:41 77312 c:\windows\STK02N\twain_32.dll
+ 2009-08-27 18:37 . 2002-07-16 17:41 87392 c:\windows\STK02N\twain.dll
+ 2009-08-27 18:37 . 2002-07-16 17:41 38400 c:\windows\STK02N\STK02NW2K2.exe
+ 2009-08-27 18:37 . 2002-07-16 17:41 35851 c:\windows\STK02N\STK02NW2K1.exe
+ 2009-08-27 18:37 . 2007-07-18 14:46 40960 c:\windows\STK02N\STK02NK.exe
+ 2009-08-27 18:37 . 2007-02-12 18:09 80896 c:\windows\STK02N\devcon64.exe
+ 2009-08-27 18:37 . 2007-02-12 18:08 74752 c:\windows\STK02N\devcon32.exe
+ 2009-08-27 18:37 . 2007-03-12 13:26 28416 c:\windows\STK02N\amd64\STK02NW1.sys
+ 2004-01-15 15:01 . 2004-01-15 15:01 61440 c:\windows\PAC207\StillImg.exe
+ 2001-11-05 15:50 . 2001-11-05 15:50 69632 c:\windows\PAC207\AMCap.exe
+ 2009-08-27 18:23 . 2009-08-27 18:23 40960 c:\windows\Installer\{63E88B74-6BE9-4F21-BDE6-2EE21D031C3B}\NewShortcut1_63E88B746BE94F21BDE62EE21D031C3B.exe
+ 2009-08-27 18:23 . 2009-08-27 18:23 10134 c:\windows\Installer\{63E88B74-6BE9-4F21-BDE6-2EE21D031C3B}\ARPPRODUCTICON.exe
+ 2009-08-27 18:43 . 2004-08-03 21:58 5504 c:\windows\system32\drivers\MSTEE.sys
+ 2009-08-27 18:43 . 2004-08-03 21:58 5504 c:\windows\system32\dllcache\mstee.sys
+ 2009-08-27 18:37 . 2007-03-12 13:32 294912 c:\windows\twain_32\STK02N\CresCap.dll
+ 2004-03-24 08:22 . 2004-03-24 08:22 138396 c:\windows\system32\drivers\PFC027.SYS
+ 2009-08-27 18:37 . 2007-03-12 13:25 101520 c:\windows\STK02N\x86\STK02NW2.sys
+ 2009-08-27 18:37 . 2007-03-21 17:50 163840 c:\windows\STK02N\STK02NM.exe
+ 2009-08-27 18:37 . 2007-03-21 17:50 274432 c:\windows\STK02N\STK02ND.exe
+ 2009-08-27 18:37 . 2007-03-12 13:32 294912 c:\windows\STK02N\CresCap.dll
+ 2009-08-27 18:37 . 2007-03-12 13:26 106496 c:\windows\STK02N\amd64\STK02NW2.sys
+ 2009-08-27 18:23 . 2009-08-27 18:23 3998208 c:\windows\Installer\1c10fc0.msi
+ 2009-08-27 18:22 . 2009-08-27 18:22 5264384 c:\windows\Downloaded Installations\{EA09EC2C-68E2-4918-A8B9-9A3505EC1519}\Mini-Cam USB Camera (SC-120).msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-01-17 58728]
"Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 90112]
"PCMService"="c:\apps\Powercinema\PCMService.exe" [2005-05-11 127118]
"ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 24576]
"EmailChecker"="c:\apps\EmailChecker\ech.exe" [2003-07-02 40960]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2009-08-18 100056]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-07-08 1657376]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-14 13877248]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-07-14 86016]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"IObit Security 360"="c:\program files\IObit\IObit Security 360\IS360tray.exe" [2009-08-20 943888]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-18 149280]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" - c:\windows\system32\Hdaudpropshortcut.exe [2004-03-17 61952]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SoundMan.exe [2004-09-10 77824]
"AlcWzrd"="ALCWZRD.EXE" - c:\windows\ALCWZRD.EXE [2004-09-15 2557952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

d:\documents and settings\lisa.SN048919120306\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2006-1-30 225280]

d:\documents and settings\All Users\Start Menu\Programs\Startup\
STK02N 2.3 PNP Monitor.lnk - c:\windows\STK02N\STK02NM.exe [2009-8-27 163840]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%ProgramFiles%\\AOL 9.0\\aol.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\APPS\\skype\\phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [20/08/2009 22:19 54752]
R2 IS360service;IS360service;c:\program files\IObit\IObit Security 360\is360srv.exe [21/08/2009 18:50 305936]
S3 DCamUSBSTK02N;Standard Camera;c:\windows\system32\drivers\STK02NW2.sys [27/08/2009 19:37 101520]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
.
Contents of the 'Scheduled Tasks' folder

2009-08-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-08-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3965977090-3551812889-490671574-1007Core.job
- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-20 21:09]

2009-08-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3965977090-3551812889-490671574-1007UA.job
- d:\documents and settings\leah.048919120306.000\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-08-20 21:09]

2009-08-18 c:\windows\Tasks\Registration reminder 3.job
- c:\windows\system32\OOBE\oobebaln.exe [2004-08-10 13:00]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.kibagames.com/Game/Boys/Spiderman_Dress_Up
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-29 12:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2009-08-29 12:53
ComboFix-quarantined-files.txt 2009-08-29 11:53
ComboFix2.txt 2009-08-27 10:52
ComboFix3.txt 2009-08-26 21:03

Pre-Run: 15,430,205,440 bytes free
Post-Run: 15,390,433,280 bytes free

385 — E O F — 2009-08-27 00:21

The pc seems ok it did shut it self off last night and i am constantly getting the program not responding boxes so windows needs to shut down which is a pain when i'm in the middle of something. During combofix scan There was a message saying there was a corrupt file from the printer and i need to run chk disk so hopefully all should be well after that. can you tell me how to get the pc to do a chk disk as its been so long since i last did it. Thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] windows has gone crazy!

✨ Ask AI

Ask AI