What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] frozen computer (some type of trojan?) help, please. :)

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #32
I do believe that is what they do. I suppose that could be a last resort. Are any of the processes running from my last post effecting ComboFix?
Post #33
Hi faithiefaith, Hopefully it won't come to that. It could be the infection or just combofix being stubborn. Did you try running combofix again and ending that process when it appears combofix has stalled? Give me a bit, we'll see if we can go about this a little differently.
Post #34 last edited
It had no problem running this time and is now telling me to restart. It told me to write down these files: C:\WINDOWS\system32\drivers\H8SRTfhdyemtbqx.sys C:\WINDOWS\system32\H8SRTbpkkdibquj.dll C:\WINDOWS\system32\H8SRTdldwwqgixx.dat C:\WINDOWS\system32\H8SRTdnpsmkndyu.dll C:\WINDOWS\system32\H8SRTThrnaoylhti.dll edit: after the machine restarted itself it started doing another run of ComboFix. *fingers crossed*!
Post #36 last edited
It restarted again in regular windows (not safe mode.) It's preparing a log report. Is it normal for that to take about 10 minutes? Where will the report show up when it's ready? desktop? Also, how can I protect myself from this type of thing happening in the future? Are there any good programs that are free that will be able to stop something like this from happening again?
Post #37 last edited
Hi faithiefaith,

Yes it can take awhile sometimes for the log. It should pop up. If it doesn't after it has finished you can find it at C:\combofix.txt.

Give the program some time to finish the log.

Good that you are now in normal windows.

Also, how can I protect myself from this type of thing happening in the future? Are there any good programs that are free that will be able to stop something like this from happening again?

I'll give you some tips and programs when we are done.
Post #38
Here is my log: :woot:

ComboFix 10-01-04.01 - sonnguyen 01/06/2010 18:08:56.1.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1795 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\jgh.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\SONNGU~1\LOCALS~1\Temp\wscsvc32.exe
c:\program files\Malware Defense
c:\program files\Malware Defense\md.db
c:\program files\Malware Defense\mdext.dll
c:\program files\Malware Defense\uninstall.exe
c:\recycler\S-1-5-21-1173999312-543644709-1788315458-500
c:\recycler\S-1-5-21-1234092195-723852605-2495899693-500
c:\recycler\S-1-5-21-1645522239-842925246-682003330-500
c:\windows\Downloaded Program Files\poPCaploader.dll
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\setup.exe
c:\windows\system32\Data
c:\windows\system32\Data\CT0060W.DAT
c:\windows\system32\Data\CTP0060W.DAT
c:\windows\system32\Data\CTP0061W.DAT
c:\windows\system32\Data\CTP0070W.DAT
c:\windows\system32\Data\CTP0073W.DAT
c:\windows\system32\Data\CTP0090W.DAT
c:\windows\system32\Data\CTP0091W.DAT
c:\windows\system32\Data\CTP0092W.DAT
c:\windows\system32\Data\CTP0095W.DAT
c:\windows\system32\Data\CTP0100W.DAT
c:\windows\system32\Data\CTP0101W.DAT
c:\windows\system32\Data\CTP0102W.DAT
c:\windows\system32\Data\CTP0103W.DAT
c:\windows\system32\Data\CTP0105W.DAT
c:\windows\system32\Data\CTP0150W.DAT
c:\windows\system32\Data\CTP0161W.DAT
c:\windows\system32\Data\CTP0162W.DAT
c:\windows\system32\Data\CTP0170W.DAT
c:\windows\system32\Data\CTP017AW.DAT
c:\windows\system32\Data\CTP017BW.DAT
c:\windows\system32\Data\CTP017CW.DAT
c:\windows\system32\Data\CTP017DW.DAT
c:\windows\system32\Data\CTP017EW.DAT
c:\windows\system32\Data\CTP017FW.DAT
c:\windows\system32\Data\CTP017GW.DAT
c:\windows\system32\Data\CTP017HW.DAT
c:\windows\system32\Data\CTP0191W.DAT
c:\windows\system32\Data\CTP0192W.DAT
c:\windows\system32\Data\CTP0221W.DAT
c:\windows\system32\Data\CTP0222W.DAT
c:\windows\system32\Data\CTP0230W.DAT
c:\windows\system32\Data\CTP0231W.DAT
c:\windows\system32\Data\CTP0232W.DAT
c:\windows\system32\Data\CTP0238W.DAT
c:\windows\system32\Data\CTP0240W.DAT
c:\windows\system32\Data\CTP0242W.DAT
c:\windows\system32\Data\CTP0243W.DAT
c:\windows\system32\Data\CTP0244W.DAT
c:\windows\system32\Data\CTP0245W.DAT
c:\windows\system32\Data\CTP0249W.DAT
c:\windows\system32\Data\CTP0280W.DAT
c:\windows\system32\Data\CTP0320W.DAT
c:\windows\system32\Data\CTP0350W.DAT
c:\windows\system32\Data\CTP0352W.DAT
c:\windows\system32\Data\CTP0360W.DAT
c:\windows\system32\Data\CTP1140W.DAT
c:\windows\system32\Data\CTP4620W.DAT
c:\windows\system32\Data\CTP4670W.DAT
c:\windows\system32\Data\CTP4760W.DAT
c:\windows\system32\Data\CTP4780W.DAT
c:\windows\system32\Data\CTP4790W.DAT
c:\windows\system32\Data\CTP4820W.DAT
c:\windows\system32\Data\CTP4830W.DAT
c:\windows\system32\Data\CTP4831W.DAT
c:\windows\system32\Data\CTP4832W.DAT
c:\windows\system32\Data\CTP4840W.DAT
c:\windows\system32\Data\CTP4850W.DAT
c:\windows\system32\Data\CTP4870W.DAT
c:\windows\system32\Data\CTP4871W.DAT
c:\windows\system32\Data\CTP4872W.DAT
c:\windows\system32\Data\CTP4875W.DAT
c:\windows\system32\Data\CTP4890W.DAT
c:\windows\system32\Data\CTP4891W.DAT
c:\windows\system32\Data\CTP4893W.DAT
c:\windows\system32\Data\CTPDXW.DAT
c:\windows\system32\Data\CTPM002W.DAT
c:\windows\system32\drivers\H8SRTfhdyemtbqx.sys
c:\windows\system32\H8SRTbpkkdibquj.dll
c:\windows\system32\H8SRTdldwwqgixx.dat
c:\windows\system32\H8SRTdnpsmkndyu.dll
c:\windows\system32\H8SRThrnaoylhti.dll
c:\windows\system32\Thumbs.db

c:\windows\system32\proquota.exe was missing
Restored copy from - c:\windows\ServicePackFiles\i386\proquota.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_H8SRTd.sys
——-\Legacy_H8SRTd.sys


((((((((((((((((((((((((( Files Created from 2009-12-06 to 2010-01-06 )))))))))))))))))))))))))))))))
.

2010-01-06 23:18 . 2008-04-14 00:12 50176 —-a-w- c:\windows\system32\proquota.exe
2010-01-06 21:00 . 2010-01-06 21:01 ——– d—–w- C:\jgh24072j
2010-01-06 12:49 . 2010-01-06 12:50 ——– d—–w- C:\jgh
2010-01-06 06:01 . 2010-01-06 06:01 871 —-a-w- c:\windows\system32\krl32mainweq.dll
2009-12-24 01:15 . 2009-12-29 06:02 ——– d—–w- c:\documents and settings\sonnguyen\Local Settings\Application Data\Tific
2009-12-24 01:15 . 2009-12-24 01:15 ——– d—–w- c:\documents and settings\sonnguyen\Application Data\Tific
2009-12-24 01:15 . 2009-12-24 01:15 ——– d—–w- c:\windows\system32\drivers\NortonPCCheckup
2009-12-24 01:15 . 2009-12-24 01:15 ——– d—–w- c:\documents and settings\All Users\Application Data\Norton
2009-12-24 01:14 . 2009-12-24 01:15 ——– d—–w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-12-24 01:14 . 2009-12-24 01:14 ——– d—–w- c:\program files\NortonInstaller
2009-12-22 23:59 . 2009-12-22 23:59 41872 —-a-w- c:\windows\system32\xfcodec.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-06 20:56 . 2008-09-29 16:45 ——– d—–w- c:\documents and settings\sonnguyen\Application Data\MegauploadToolbar
2010-01-06 06:20 . 2008-07-26 15:09 384 —-a-w- c:\windows\system32\DVCStateBkp-{00000006-00000000-00000001-00001102-00000004-20021102}.dat
2010-01-06 06:20 . 2008-07-26 15:09 384 —-a-w- c:\windows\system32\DVCState-{00000006-00000000-00000001-00001102-00000004-20021102}.dat
2010-01-05 18:46 . 2008-11-09 11:55 ——– d—–w- c:\program files\Xfire
2010-01-05 01:37 . 2008-11-09 11:55 ——– d—–w- c:\documents and settings\sonnguyen\Application Data\Xfire
2009-12-24 01:15 . 2008-09-14 21:22 ——– d—–w- c:\program files\Norton PC Checkup
2009-10-29 05:38 . 2004-12-01 18:28 667136 —-a-w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-12-01 18:28 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-12-01 18:28 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-03 23:00 265728 —-a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:30 . 2004-12-01 18:28 270336 —-a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2004-12-01 18:28 149504 —-a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-12-01 18:28 79872 —-a-w- c:\windows\system32\raschap.dll
2009-02-24 19:34 . 2009-02-24 19:34 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-C39E-35F1D2A32EC8}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteCenter"="c:\program files\Creative\MediaSource\RemoteControl\RCMan.EXE" [2003-10-08 139264]
"igndlm.exe"="c:\program files\Download Manager\DLM.exe" [2007-03-05 1103480]
"Google Update"="c:\documents and settings\sonnguyen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-09 133104]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2004-04-13 88363]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-29 344064]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-17 61952]
"CreateCD_Reminder"="c:\windows\Sonysys\VAIO Recovery\reminder.exe" [2004-07-16 53248]
"SoundMan"="SOUNDMAN.EXE" [2004-10-21 77824]
"AlcWzrd"="ALCWZRD.EXE" [2004-10-22 2744832]
"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2004-09-22 151552]
"VAIO Recovery"="c:\windows\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-20 28672]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"CTSysVol"="c:\program files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
"CTDVDDET"="c:\program files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE" [2003-06-18 45056]
"CTHelper"="CTHELPER.EXE" [2003-10-06 24576]
"SBDrvDet"="c:\program files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 45056]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0\bin\jusched.exe" [2004-12-01 36972]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-05-16 648504]
"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2008-05-21 451896]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2008-08-14 536576]
"D-Link AirPlus Xtreme G"="c:\program files\D-Link\AirPlus Xtreme G\AirPlusCFG.exe" [2003-11-04 2502656]
"ANIWZCSService"="c:\program files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe" [2003-08-21 32768]
"D-Link AirPlus XtremeG DWL-G520"="c:\program files\D-Link\AirPlus XtremeG DWL-G520\AirPlusCFG.exe" [2007-06-21 1327104]
"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

c:\documents and settings\sonnguyen\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2008-11-4 256000]
Xfire.lnk - c:\program files\Xfire\xfire.exe [2009-12-22 3192720]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-7-26 66864]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\nexon\Combat Arms\CombatArms.exe"= c:\nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe
"c:\nexon\Combat Arms\Engine.exe"= c:\nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe
"c:\\Nexon\\Combat Arms\\NMService.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Xfire\\xfire.exe"=
"c:\\Documents and Settings\\sonnguyen\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\sonnguyen\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\VentSrv\\ventrilo_srv.exe"=
"c:\\Documents and Settings\\sonnguyen\\Local Settings\\Application Data\\Dyyno Receiver\\DPPM.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service

R2 Norton PC Checkup Application Launcher;Norton PC Checkup Application Launcher;c:\program files\Norton PC Checkup\Norton PC Checkup\Engine\2.0.2.506\SymcPCCULaunchSvc.exe [12/23/2009 8:15 PM 103280]
R2 PCCUJobMgr;Common Client Job Manager Service;c:\program files\Norton PC Checkup\Norton PC Checkup\Engine\2.0.2.506\ccSvcHst.exe [12/23/2009 8:15 PM 126392]
R2 PfDetNT;PfDetNT;c:\windows\system32\drivers\PfModNT.sys [7/26/2008 9:56 AM 15840]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [8/1/2008 10:45 PM 24652]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [10/20/2009 2:52 PM 472832]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [9/7/2008 8:02 PM 21920]
S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys –> c:\windows\system32\Drivers\SSPORT.sys [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service –> c:\windows\system32\GameMon.des -service [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/16/2009 9:37 AM 721904]
.
Contents of the 'Scheduled Tasks' folder

2010-01-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-417312340-3947967205-3010690940-1005Core.job
- c:\documents and settings\sonnguyen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-09 02:00]

2010-01-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-417312340-3947967205-3010690940-1005UA.job
- c:\documents and settings\sonnguyen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-09 02:00]
.
.
——- Supplementary Scan ——-
.
IE: &Google; Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html
IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html
IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html
IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html
Trusted Zone: aol.com\free
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} - hxxps://secure.gopetslive.com/dev/GoPetsWeb.cab
FF - ProfilePath - c:\documents and settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q;=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.samuraioflegend.com/login.php
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q;=
FF - component: c:\documents and settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\extensions\[removed]\components\DTToolbarFF.dll
FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\documents and settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\extensions\[removed]\plugins\npDyyno.dll
FF - plugin: c:\documents and settings\sonnguyen\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\sonnguyen\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Download Manager\npfpdlm.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava11.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava12.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava13.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava14.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJava32.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPJPI150.dll
FF - plugin: c:\program files\Java\jre1.5.0\bin\NPOJI610.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAskSBr.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Aim6 - (no file)
HKCU-Run-PlayNC Launcher - (no file)
AddRemove-Malwarebytes' Anti-Malware_is1 - c:\program files\Malwarebytes' Anti-Malware\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-06 18:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PCCUJobMgr]
"ImagePath"="\"c:\program files\Norton PC Checkup\Norton PC Checkup\Engine\2.0.2.506\ccSvcHst.exe\" /s \"PCCUJobMgr\" /m \"c:\program files\Norton PC Checkup\Norton PC Checkup\Engine\2.0.2.506\diMaster.dll\" /prefetch:1"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(808)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(9356)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\program files\Xfire\xfire_toucan_40700.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\windows\system32\CTsvcCDA.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\PnkBstrA.exe
c:\program files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe
c:\program files\Sony\Sony TV Tuner Library\SMceMan.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
c:\program files\VentSrv\ventrilo_svc.exe
c:\program files\VentSrv\ventrilo_srv.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\windows\system32\MsPMSPSv.exe
c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
c:\windows\system32\dllhost.exe
c:\program files\Sony\Sony TV Tuner Library\RM_SV.exe
c:\windows\system32\wscntfy.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\windows\AGRSMMSG.exe
c:\windows\SOUNDMAN.EXE
c:\windows\eHome\ehmsas.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\logitech\quickcam\lu\lulnchr.exe
c:\program files\common files\logitech\lu\lulnchr.exe
c:\program files\common files\logitech\lu\LogitechUpdate.exe
.
**************************************************************************
.
Completion time: 2010-01-06 18:40:34 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-06 23:40

Pre-Run: 44,017,610,752 bytes free
Post-Run: 43,952,091,136 bytes free

- - End Of File - - 9A274E07D0E2A9C8FF7EEDBCA6750E58
Post #39 last edited
Hi Faithiefaith,

Good job. Are you posting from the infectected computer? If so please limit it's on line activity to this thread and downloading tools.

I don't see an antivirus program installed on this computer. What where you using for an antivirus program?

I do see

LimeWire and Vuze
You have LimeWire and Vuze, P2P/file sharing programs installed on your computer. P2P applications like it are the largest source of malware we see. You'll be doing yourself a favor by removing it. It's not the programs themselves that are the problem, but what can be downloaded with them, usually from an unknown source.

References for the risk of these programs can be found in these links:
http://www.microsoft.com/windows/ie/commun…protection.mspx

http://www.internetworldstats.com/articles…cles/art053.htm

I would recommend that you uninstall [bLimeWire and Vuze, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you wish to keep it, please do not use it until your computer is cleaned.


Next, Double click on OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Reg

:Files
c:\windows\system32\krl32mainweq.dll

:Commands
[resethosts]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.
Please post the OTL fix log.


Next

Download and save to your desktop Malwarebytes Anti-Malware

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


Please post back with
  • OTL fix lox
  • MBAM log
  • new OTL log, there will only be a OTL.txt this time
Thanks
Post #40
I am posted from the infected computer, but I only have this webpage open. I should be safe, I hope. There isn't any antivirus program on this computer. I've never thought it was very safe to use the computer without it! I just got finished deleting Vuze and Limewire, even though they hardly ever get used, I'd much rather be safe than sorry. I'm going to go through the other steps you posted and come back with the logs. :)
Post #42
here is my OTL quick fix : All processes killed ========== REGISTRY ========== ========== FILES ========== c:\windows\system32\krl32mainweq.dll moved successfully. ========== COMMANDS ========== C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32835 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32835 bytes User: sonnguyen ->Temp folder emptied: 129025 bytes ->Temporary Internet Files folder emptied: 3764815 bytes ->Java cache emptied: 34861917 bytes ->FireFox cache emptied: 39134215 bytes ->Google Chrome cache emptied: 27924118 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 19569 bytes %systemroot%\System32 .tmp files removed: 2577 bytes Windows Temp folder emptied: 109080 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 67 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 101.00 mb OTL by OldTimer - Version 3.1.21.0 log created on 01062010_193328 Files\Folders moved on Reboot… File move failed. C:\WINDOWS\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot. Registry entries deleted on Reboot… and here is my mbam log (it said I have no infected files :)): Malwarebytes' Anti-Malware 1.43 Database version: 3506 Windows 5.1.2600 Service Pack 3 Internet Explorer 6.0.2900.5512 1/6/2010 7:47:24 PM mbam-log-2010-01-06 (19-47-24).txt Scan type: Quick Scan Objects scanned: 120442 Time elapsed: 5 minute(s), 56 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) I don't have another OTL log, just the original one from last night. Should I run OTL again with the original instructions?
Post #44
Here it is:

OTL logfile created on: 1/6/2010 8:00:31 PM - Run 2
OTL by OldTimer - Version 3.1.21.0 Folder = C:\Documents and Settings\sonnguyen\Desktop
Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 73.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 87.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 227.87 Gb Total Space | 41.06 Gb Free Space | 18.02% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 59.69 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SON_NGUYEN
Current User Name: sonnguyen
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\sonnguyen\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Xfire\xfire.exe (Xfire Inc.)
PRC - C:\Program Files\Norton PC Checkup\Norton PC Checkup\Engine\2.0.2.506\SymcPCCULaunchSvc.exe (Symantec Corporation)
PRC - C:\Program Files\Norton PC Checkup\Norton PC Checkup\Engine\2.0.2.506\ccSvcHst.exe (Symantec Corporation)
PRC - c:\Program Files\Common Files\Logitech\LU\LogitechUpdate.exe (Logitech, Inc.)
PRC - c:\Program Files\Common Files\Logitech\LU\LULnchr.exe (Logitech, Inc.)
PRC - C:\Program Files\VentSrv\ventrilo_srv.exe ()
PRC - C:\WINDOWS\system32\PnkBstrA.exe ()
PRC - C:\Program Files\VentSrv\ventrilo_svc.exe ()
PRC - C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe (Logitech Inc.)
PRC - C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe ()
PRC - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)
PRC - C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)
PRC - C:\Program Files\Pure Networks\Network Magic\nmapp.exe (Pure Networks, Inc.)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Pure Networks, Inc.)
PRC - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Pure Networks, Inc.)
PRC - C:\WINDOWS\system32\wscntfy.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - c:\Program Files\Logitech\QuickCam\LU\LULnchr.exe (Logitech, Inc.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Advanced Micro Devices Inc.)
PRC - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ATI Technologies Inc.)
PRC - C:\Program Files\D-Link\AirPlus XtremeG DWL-G520\AirPlusCFG.exe (D-Link)
PRC - C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe (Wireless Service)
PRC - C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
PRC - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation)
PRC - C:\Program Files\Java\jre1.5.0\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation)
PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe (Sony Corporation)
PRC - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
PRC - C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe (Sony Corporation)
PRC - C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe (Sony Corporation)
PRC - C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
PRC - C:\Program Files\D-Link\AirPlus Xtreme G\AirPlusCFG.exe (D-Link)
PRC - C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe (Creative Technology Ltd)
PRC - C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
PRC - C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe (Alpha Networks Inc.)
PRC - C:\Program Files\Sony\Sony TV Tuner Library\SMceMan.exe (Sony Corporation)
PRC - C:\Program Files\Sony\Sony TV Tuner Library\RM_SV.exe (Sony Corporation)
PRC - C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.exe (Creative Technology Ltd)
PRC - C:\WINDOWS\system32\MsPMSPSv.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\CTSVCCDA.EXE (Creative Technology Ltd)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\sonnguyen\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\Xfire\xfire_toucan_40700.dll (Xfire Inc.)
MOD - C:\WINDOWS\temp\logishrd\LVPrcInj01.dll (Logitech Inc.)
MOD - C:\WINDOWS\system32\wsock32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\serwvdrv.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\umdmxfrm.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msvcr71.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (Norton PC Checkup Application Launcher) – C:\Program Files\Norton PC Checkup\Norton PC Checkup\Engine\2.0.2.506\SymcPCCULaunchSvc.exe (Symantec Corporation)
SRV - (PCCUJobMgr) – C:\Program Files\Norton PC Checkup\Norton PC Checkup\Engine\2.0.2.506\ccSvcHst.exe (Symantec Corporation)
SRV - (npggsvc) – C:\WINDOWS\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (PnkBstrA) – C:\WINDOWS\system32\PnkBstrA.exe ()
SRV - (Ventrilo) – C:\Program Files\VentSrv\ventrilo_svc.exe ()
SRV - (LVPrcSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (LVCOMSer) – C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)
SRV - (Ati HotKey Poller) – C:\WINDOWS\system32\ati2evxx.exe (ATI Technologies Inc.)
SRV - (ATI Smart) – C:\WINDOWS\system32\ati2sgag.exe ()
SRV - (nmraapache) – C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe (Pure Networks, Inc.)
SRV - (nmservice) – C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe (Pure Networks, Inc.)
SRV - (ANIWZCSdService) – C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe (Wireless Service)
SRV - (Viewpoint Manager Service) – C:\Program Files\Viewpoint\Common\ViewpointService.exe (Viewpoint Corporation)
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE (Symantec Corporation)
SRV - (Automatic LiveUpdate Scheduler) – C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (Symantec Corporation)
SRV - (IDriverT) – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (VAIOMediaPlatform-IntegratedServer-AppServer) – C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe (Sony Corporation)
SRV - (VAIO Entertainment TV Device Arbitration Service) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe (Sony Corporation)
SRV - (VzCdbSvc) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe (Sony Corporation)
SRV - (VzFw) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe (Sony Corporation)
SRV - (Vcsw) – C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-VideoServer-UPnP) VAIO Media Video Server (UPnP) – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-IntegratedServer-UPnP) VAIO Media Integrated Server (UPnP) – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-VideoServer-HTTP) VAIO Media Video Server (HTTP) – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-IntegratedServer-HTTP) VAIO Media Integrated Server (HTTP) – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-Mobile-Gateway) – C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe (Sony Corporation)
SRV - (SonicStageMonitoring) – C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-VideoServer-AppServer) – C:\Program Files\Sony\VAIO Media Integrated Server\Video\GPVSvr.exe (Sony Corporation)
SRV - (Sony TVTA Manager) – C:\Program Files\Sony\Sony TV Tuner Library\SMceMan.exe (Sony Corporation)
SRV - (Sony TV Tuner Controller) – C:\Program Files\Sony\Sony TV Tuner Library\halsv.exe (Sony Corporation)
SRV - (Sony TV Tuner Manager) – C:\Program Files\Sony\Sony TV Tuner Library\RM_SV.exe (Sony Corporation)
SRV - (ose) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (WMDM PMSP Service) – C:\WINDOWS\system32\MsPMSPSv.exe (Microsoft Corporation)
SRV - (Creative Service for CDROM Access) – C:\WINDOWS\system32\CTSVCCDA.EXE (Creative Technology Ltd)


========== Driver Services (SafeList) ==========

DRV - (sptd) – C:\WINDOWS\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (SCREAMINGBDRIVER) – C:\WINDOWS\system32\drivers\ScreamingBAudio.sys (Screaming Bee LLC)
DRV - (FilterService) – C:\WINDOWS\system32\drivers\lvuvcflt.sys (Logitech Inc.)
DRV - (LVUVC) QuickCam Communicate Deluxe(UVC) – C:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVUSBSta) – C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (LVRS) – C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)
DRV - (LVPr2Mon) – C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()
DRV - (PxHelp20) – C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (pnarp) – C:\WINDOWS\system32\drivers\pnarp.sys (Pure Networks, Inc.)
DRV - (purendis) – C:\WINDOWS\system32\drivers\purendis.sys (Pure Networks, Inc.)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (gameenum) – C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (Secdrv) – C:\WINDOWS\system32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (lvpopflt) – C:\WINDOWS\system32\drivers\lvpopflt.sys (Logitech Inc.)
DRV - (A3AB) D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB) – C:\WINDOWS\system32\drivers\A3AB.sys (D-Link Corporation)
DRV - (speedfan) – C:\WINDOWS\system32\speedfan.sys (Windows ® 2000 DDK provider)
DRV - (DgiVecp) – C:\WINDOWS\system32\drivers\DGIVECP.SYS (Samsung Electronics Co., Ltd.)
DRV - (ANIO) – C:\WINDOWS\system32\ANIO.sys (Alpha Networks Inc.)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Ptilink) – C:\WINDOWS\system32\drivers\ptilink.sys (Parallel Technologies, Inc.)
DRV - (smrt) – C:\WINDOWS\system32\drivers\smrt.sys (Sony Corporation)
DRV - (AgereSoftModem) – C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)
DRV - (HdAudAddService) – C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows ® Server 2003 DDK provider)
DRV - (E100B) Intel® – C:\WINDOWS\system32\drivers\e100b325.sys (Intel Corporation)
DRV - (ctaud2k) Creative Audio Driver (WDM) – C:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctac32k) – C:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (ha10kx2k) – C:\WINDOWS\system32\drivers\ha10kx2k.sys (Creative Technology Ltd)
DRV - (hap16v2k) – C:\WINDOWS\system32\drivers\haP16v2k.sys (Creative Technology Ltd)
DRV - (ctdvda2k) – C:\WINDOWS\system32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (emupia) – C:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k) – C:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (ctprxy2k) – C:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ossrv) – C:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (PfDetNT) – C:\WINDOWS\system32\drivers\PfModNT.sys (Creative Technology Ltd.)
DRV - (MODEMCSA) – C:\WINDOWS\system32\drivers\MODEMCSA.sys (Microsoft Corporation)
DRV - (DMICall) – C:\WINDOWS\system32\drivers\DMICall.sys (Sony Corporation)
DRV - (giveio) – C:\WINDOWS\system32\giveio.sys ()


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Live Search"
FF - prefs.js..browser.search.defaulturl: "http://search.live.com/results.aspx?FORM=IEFM1&q;="
FF - prefs.js..browser.search.order.1: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "megaup"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "megaup"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.samuraioflegend.com/login.php"
FF - prefs.js..extensions.enabledItems: [removed]:1.0.8.0552
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.24
FF - prefs.js..keyword.URL: "http://search.live.com/results.aspx?FORM=IEFM1&q;="


FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/01/06 00:59:56 | 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/06 00:59:56 | 00,000,000 | —D | M]

[2008/07/26 10:20:17 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Extensions
[2010/01/06 01:29:33 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\extensions
[2008/11/06 07:44:19 | 00,000,000 | —D | M] (NeffyPlugin Launcher) – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\extensions\{5601B994-0E9B-4ce2-8AB9-AD1155F2ABBD}
[2009/07/06 09:41:59 | 00,000,000 | —D | M] (Foxkeh Theme) – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\extensions\{57407AE0-868F-11DC-AD21-49A755D89593}
[2009/06/16 09:47:40 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\extensions\[removed]
[2009/05/16 19:14:54 | 00,000,000 | —D | M] – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\extensions\[removed]
[2009/06/16 09:47:33 | 00,002,399 | —- | M] () – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\searchplugins\daemon-search.xml
[2009/01/31 17:35:23 | 00,001,632 | —- | M] () – C:\Documents and Settings\sonnguyen\Application Data\Mozilla\Firefox\Profiles\1u31z8fz.default\searchplugins\live-search.xml
[2008/07/26 10:20:08 | 00,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2008/08/03 23:28:37 | 00,024,683 | —- | M] (Ask.com) – C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll
[2007/04/16 12:07:12 | 00,180,293 | —- | M] () – C:\Program Files\Mozilla Firefox\plugins\npViewpoint.dll

O1 HOSTS File: (98 bytes) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Megaupload Toolbar) - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\Program Files\MegauploadToolbar\megauploadtoolbar.dll (MEGAUPLOAD )
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O2 - BHO: (Ask Toolbar BHO) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (Ask.com)
O3 - HKLM\..\Toolbar: (&Google;) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (Megaupload Toolbar) - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\Program Files\MegauploadToolbar\megauploadtoolbar.dll (MEGAUPLOAD )
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (Ask.com)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (&Google;) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Megaupload Toolbar) - {A057A204-BACC-4D26-C39E-35F1D2A32EC8} - C:\Program Files\MegauploadToolbar\megauploadtoolbar.dll (MEGAUPLOAD )
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL (Ask.com)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AGRSMMSG] C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe (Wireless Service)
O4 - HKLM..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe (Alpha Networks Inc.)
O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.)
O4 - HKLM..\Run: [CreateCD_Reminder] C:\WINDOWS\SONYSYS\VAIO Recovery\Reminder.exe (Sony Electronics, Inc)
O4 - HKLM..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\System32\CTHELPER.EXE (Creative Technology Ltd)
O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [D-Link AirPlus Xtreme G] C:\Program Files\D-Link\AirPlus Xtreme G\AirPlusCFG.exe (D-Link)
O4 - HKLM..\Run: [D-Link AirPlus XtremeG DWL-G520] C:\Program Files\D-Link\AirPlus XtremeG DWL-G520\AirPlusCFG.exe (D-Link)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\Hdaudpropshortcut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [nmapp] C:\Program Files\Pure Networks\Network Magic\nmapp.exe (Pure Networks, Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Pure Networks, Inc.)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VAIO Recovery] C:\WINDOWS\SONYSYS\VAIO Recovery\PartSeal.exe (Sony Electronics Inc)
O4 - HKLM..\Run: [VAIO Update 2] C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe (Sony Corporation)
O4 - HKCU..\Run: [Google Update] C:\Documents and Settings\sonnguyen\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)
O4 - HKCU..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe (IGN Entertainment)
O4 - HKCU..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RcMan.exe (Creative Technology Ltd)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech Inc.)
O4 - Startup: C:\Documents and Settings\sonnguyen\Start Menu\Programs\Startup\PowerReg Scheduler.exe ()
O4 - Startup: C:\Documents and Settings\sonnguyen\Start Menu\Programs\Startup\Xfire.lnk = C:\Program Files\Xfire\xfire.exe (Xfire Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Google; Search - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Backward Links - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Cached Snapshot of Page - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Print - C:\Program Files\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Similar Pages - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O8 - Extra context menu item: Translate into English - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\NPJPI150.dll (Sun Microsystems, Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKCU\..Trusted Domains: 2 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab (Solitaire Showdown Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Java Plug-in 1.5.0)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab (Minesweeper Flags Class)
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} https://secure.gopetslive.com/dev/GoPetsWeb.cab (GoPetsWeb Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Pure Networks, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/12/01 14:43:52 | 00,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/01/06 19:39:16 | 00,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/01/06 19:39:14 | 00,019,160 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/01/06 19:39:14 | 00,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/01/06 19:38:38 | 05,061,520 | —- | C] (Malwarebytes Corporation ) – C:\Documents and Settings\sonnguyen\Desktop\mbam-setup.exe
[2010/01/06 19:33:34 | 00,000,000 | -HSD | C] – C:\RECYCLER
[2010/01/06 19:33:28 | 00,000,000 | —D | C] – C:\_OTL
[2010/01/06 18:18:10 | 00,050,176 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\proquota.exe
[2010/01/06 18:18:10 | 00,000,000 | —D | C] – C:\WINDOWS\temp
[2010/01/06 16:00:59 | 00,000,000 | —D | C] – C:\jgh24072j
[2010/01/06 07:49:51 | 00,000,000 | RHSD | C] – C:\cmdcons
[2010/01/06 07:49:11 | 00,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2010/01/06 07:49:11 | 00,161,792 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2010/01/06 07:49:11 | 00,136,704 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2010/01/06 07:49:11 | 00,031,232 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2010/01/06 07:49:03 | 00,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/01/06 07:49:02 | 00,000,000 | —D | C] – C:\jgh
[2010/01/06 07:48:45 | 00,000,000 | —D | C] – C:\Qoobox
[2010/01/06 07:46:02 | 04,608,744 | —- | C] (Microsoft Corporation) – C:\Documents and Settings\sonnguyen\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[2010/01/06 04:42:36 | 00,513,536 | —- | C] (OldTimer Tools) – C:\Documents and Settings\sonnguyen\Desktop\OTL.exe
[2010/01/06 03:25:24 | 00,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2009/12/23 20:15:16 | 00,000,000 | —D | C] – C:\Documents and Settings\sonnguyen\Local Settings\Application Data\Tific
[2009/12/23 20:15:15 | 00,000,000 | —D | C] – C:\Documents and Settings\sonnguyen\Application Data\Tific
[2009/12/23 20:15:01 | 00,000,000 | —D | C] – C:\WINDOWS\System32\drivers\NortonPCCheckup
[2009/12/23 20:15:01 | 00,000,000 | —D | C] – C:\WINDOWS\System32\drivers\NortonPCCheckup\0200020.1FA
[2009/12/23 20:15:00 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Norton
[2009/12/23 20:14:57 | 00,000,000 | —D | C] – C:\Program Files\NortonInstaller
[2009/12/23 20:14:57 | 00,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\NortonInstaller
[2009/12/21 03:13:56 | 00,000,000 | —D | C] – C:\Config.Msi
[2009/12/18 18:39:42 | 00,000,000 | —D | C] – C:\Documents and Settings\sonnguyen\Desktop\desktop
[2009/02/08 14:28:35 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\SACore
[2009/02/08 12:12:37 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Xfire
[2008/11/10 13:58:17 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Application Data\Xfire
[2008/10/23 23:26:48 | 00,000,000 | —D | M] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2008/09/14 16:22:09 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2008/09/14 16:22:09 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Application Data\Adobe
[2008/07/26 10:01:20 | 00,065,536 | —- | C] ( ) – C:\WINDOWS\System32\a3d.dll
[2004/12/01 14:49:31 | 00,000,000 | —D | M] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2004/12/01 14:43:51 | 00,000,000 | –SD | M] – C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2004/12/01 14:43:51 | 00,000,000 | –SD | M] – C:\Documents and Settings\LocalService\Application Data\Microsoft

========== Files - Modified Within 30 Days ==========

[2010/01/06 19:39:18 | 00,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/06 19:38:57 | 05,061,520 | —- | M] (Malwarebytes Corporation ) – C:\Documents and Settings\sonnguyen\Desktop\mbam-setup.exe
[2010/01/06 19:36:00 | 00,000,994 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-417312340-3947967205-3010690940-1005UA.job
[2010/01/06 19:35:59 | 00,290,484 | —- | M] () – C:\WINDOWS\System32\CTHELPER.RPT
[2010/01/06 19:35:33 | 00,003,284 | —- | M] () – C:\WINDOWS\System32\ANIWZCS{356C534A-D8DA-4494-9843-56CB82CAA1CB}
[2010/01/06 19:35:27 | 00,000,010 | —- | M] () – C:\WINDOWS\System32\ANIWZCSUSERNAME{356C534A-D8DA-4494-9843-56CB82CAA1CB}
[2010/01/06 19:35:21 | 00,000,007 | —- | M] () – C:\WINDOWS\System32\ANIWZCSUSERNAME
[2010/01/06 19:35:03 | 00,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/01/06 19:35:01 | 00,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/01/06 19:34:58 | 21,462,22080 | -HS- | M] () – C:\hiberfil.sys
[2010/01/06 19:34:04 | 00,029,520 | —- | M] () – C:\WINDOWS\System32\BMXStateBkp-{00000006-00000000-00000001-00001102-00000004-20021102}.rfx
[2010/01/06 19:34:04 | 00,029,520 | —- | M] () – C:\WINDOWS\System32\BMXState-{00000006-00000000-00000001-00001102-00000004-20021102}.rfx
[2010/01/06 19:34:04 | 00,026,304 | —- | M] () – C:\WINDOWS\System32\BMXCtrlState-{00000006-00000000-00000001-00001102-00000004-20021102}.rfx
[2010/01/06 19:34:04 | 00,026,304 | —- | M] () – C:\WINDOWS\System32\BMXBkpCtrlState-{00000006-00000000-00000001-00001102-00000004-20021102}.rfx
[2010/01/06 19:34:04 | 00,001,080 | —- | M] () – C:\WINDOWS\System32\settingsbkup.sfm
[2010/01/06 19:34:04 | 00,001,080 | —- | M] () – C:\WINDOWS\System32\settings.sfm
[2010/01/06 19:34:04 | 00,000,384 | —- | M] () – C:\WINDOWS\System32\DVCStateBkp-{00000006-00000000-00000001-00001102-00000004-20021102}.dat
[2010/01/06 19:34:04 | 00,000,384 | —- | M] () – C:\WINDOWS\System32\DVCState-{00000006-00000000-00000001-00001102-00000004-20021102}.dat
[2010/01/06 19:33:42 | 04,980,736 | -H– | M] () – C:\Documents and Settings\sonnguyen\NTUSER.DAT
[2010/01/06 19:33:42 | 00,000,278 | -HS- | M] () – C:\Documents and Settings\sonnguyen\ntuser.ini
[2010/01/06 19:33:29 | 00,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2010/01/06 18:36:01 | 00,000,942 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-417312340-3947967205-3010690940-1005Core.job
[2010/01/06 18:29:41 | 00,000,227 | —- | M] () – C:\WINDOWS\system.ini
[2010/01/06 07:50:01 | 00,000,279 | RHS- | M] () – C:\boot.ini
[2010/01/06 07:46:31 | 00,000,176 | —- | M] () – C:\Documents and Settings\sonnguyen\defogger_reenable
[2010/01/06 07:31:40 | 03,819,182 | R— | M] () – C:\Documents and Settings\sonnguyen\Desktop\jgh.exe
[2010/01/06 04:34:10 | 00,513,536 | —- | M] (OldTimer Tools) – C:\Documents and Settings\sonnguyen\Desktop\OTL.exe
[2010/01/06 00:59:26 | 00,000,008 | —- | M] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/05 14:14:11 | 00,018,944 | —- | M] () – C:\Documents and Settings\sonnguyen\Desktop\Clan Donations.xls
[2009/12/30 14:55:24 | 00,038,224 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/12/30 14:54:58 | 00,019,160 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2009/12/27 15:26:07 | 00,027,648 | —- | M] () – C:\Documents and Settings\sonnguyen\Desktop\Affliction.xls
[2009/12/23 20:15:08 | 00,002,171 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Norton PC Checkup.lnk
[2009/12/22 18:59:32 | 00,041,872 | —- | M] () – C:\WINDOWS\System32\xfcodec.dll
[2009/12/21 10:11:50 | 00,001,620 | —- | M] () – C:\Documents and Settings\sonnguyen\Desktop\Mozilla Firefox.lnk
[2009/12/21 10:11:41 | 00,444,028 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2009/12/21 10:11:41 | 00,071,904 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2009/12/21 10:11:36 | 00,525,770 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2009/12/21 10:09:48 | 00,287,704 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/12/21 03:12:12 | 00,001,393 | —- | M] () – C:\WINDOWS\imsins.BAK
[2009/12/21 03:10:19 | 00,000,624 | —- | M] () – C:\WINDOWS\win.ini
[2009/12/20 18:21:47 | 00,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2009/12/15 11:24:48 | 00,293,376 | —- | M] () – C:\Documents and Settings\sonnguyen\Desktop\gfmer.exe
[2009/12/09 22:54:07 | 00,261,632 | —- | M] () – C:\WINDOWS\PEV.exe

========== Files Created - No Company Name ==========

[2010/01/06 19:39:18 | 00,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/01/06 18:28:34 | 21,462,22080 | -HS- | C] () – C:\hiberfil.sys
[2010/01/06 07:50:00 | 00,000,209 | —- | C] () – C:\Boot.bak
[2010/01/06 07:49:56 | 00,260,272 | —- | C] () – C:\cmldr
[2010/01/06 07:49:11 | 00,261,632 | —- | C] () – C:\WINDOWS\PEV.exe
[2010/01/06 07:49:11 | 00,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2010/01/06 07:49:11 | 00,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2010/01/06 07:49:11 | 00,077,312 | —- | C] () – C:\WINDOWS\MBR.exe
[2010/01/06 07:49:11 | 00,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2010/01/06 07:46:11 | 00,000,176 | —- | C] () – C:\Documents and Settings\sonnguyen\defogger_reenable
[2010/01/06 07:45:59 | 03,819,182 | R— | C] () – C:\Documents and Settings\sonnguyen\Desktop\jgh.exe
[2010/01/06 07:36:04 | 00,050,621 | —- | C] () – C:\Documents and Settings\sonnguyen\Desktop\Defogger.exe
[2010/01/06 04:42:36 | 00,293,376 | —- | C] () – C:\Documents and Settings\sonnguyen\Desktop\gfmer.exe
[2010/01/06 00:59:26 | 00,000,008 | —- | C] () – C:\Documents and Settings\All Users\Application Data\sysReserve.ini
[2010/01/01 05:20:44 | 00,018,944 | —- | C] () – C:\Documents and Settings\sonnguyen\Desktop\Clan Donations.xls
[2009/12/24 01:50:52 | 00,027,648 | —- | C] () – C:\Documents and Settings\sonnguyen\Desktop\Affliction.xls
[2009/12/23 20:15:08 | 00,002,171 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Norton PC Checkup.lnk
[2009/12/23 20:15:01 | 00,000,172 | —- | C] () – C:\WINDOWS\System32\drivers\NortonPCCheckup\0200020.1FA\isolate.ini
[2009/12/22 18:59:32 | 00,041,872 | —- | C] () – C:\WINDOWS\System32\xfcodec.dll
[2009/12/21 10:11:50 | 00,001,620 | —- | C] () – C:\Documents and Settings\sonnguyen\Desktop\Mozilla Firefox.lnk
[2009/12/20 18:29:46 | 00,003,284 | —- | C] () – C:\WINDOWS\System32\ANIWZCS{356C534A-D8DA-4494-9843-56CB82CAA1CB}
[2009/12/20 18:23:30 | 00,000,010 | —- | C] () – C:\WINDOWS\System32\ANIWZCSUSERNAME{356C534A-D8DA-4494-9843-56CB82CAA1CB}
[2009/10/20 14:52:28 | 00,049,152 | —- | C] () – C:\WINDOWS\System32\JJAKEn.dll
[2009/10/06 15:31:21 | 00,000,000 | —- | C] () – C:\WINDOWS\VAIOUpdt.INI
[2009/10/06 15:27:38 | 00,651,264 | R— | C] () – C:\WINDOWS\System32\libeay32.dll
[2009/10/06 15:27:38 | 00,147,456 | R— | C] () – C:\WINDOWS\System32\ssleay32.dll
[2009/09/16 15:19:41 | 00,000,032 | —- | C] () – C:\WINDOWS\basefx.INI
[2009/09/09 10:46:29 | 00,000,118 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2008/11/16 17:38:19 | 00,000,262 | —- | C] () – C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2008/11/04 08:37:44 | 00,022,328 | —- | C] () – C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2008/10/06 12:13:38 | 00,000,050 | —- | C] () – C:\WINDOWS\MegaManager.INI
[2008/07/26 14:34:17 | 00,063,488 | —- | C] () – C:\Documents and Settings\sonnguyen\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/07/26 14:20:30 | 00,066,482 | —- | C] () – C:\WINDOWS\System32\lvcoinst.ini
[2008/07/26 13:16:00 | 00,002,154 | —- | C] () – C:\WINDOWS\System32\ssmute.ini
[2008/07/26 13:12:43 | 00,000,176 | —- | C] () – C:\WINDOWS\Quicken.ini
[2008/07/26 13:12:00 | 00,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2008/07/26 13:12:00 | 00,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2008/07/26 13:12:00 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2008/07/26 13:12:00 | 00,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2008/07/26 13:12:00 | 00,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2008/07/26 13:11:59 | 00,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2008/07/26 13:10:49 | 00,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/07/26 13:04:53 | 00,019,968 | —- | C] () – C:\WINDOWS\System32\Cpuinf32.dll
[2008/07/26 12:19:20 | 00,000,000 | —- | C] () – C:\WINDOWS\OpPrintServer.INI
[2008/07/26 12:15:55 | 00,006,656 | —- | C] () – C:\WINDOWS\System32\CNMVS58.DLL
[2008/07/26 10:03:57 | 00,000,231 | —- | C] () – C:\WINDOWS\AC3API.INI
[2008/07/26 10:02:23 | 00,043,517 | —- | C] () – C:\WINDOWS\System32\e10kxwdm.ini
[2008/07/26 10:02:23 | 00,000,175 | —- | C] () – C:\WINDOWS\System32\ctzapxx.ini
[2008/07/26 10:01:36 | 00,005,515 | —- | C] () – C:\WINDOWS\System32\ENSDEF.INI
[2008/07/26 10:01:36 | 00,000,194 | —- | C] () – C:\WINDOWS\System32\KILL.INI
[2008/07/26 09:58:12 | 00,000,136 | —- | C] () – C:\WINDOWS\SBWIN.INI
[2008/07/26 09:50:40 | 00,000,132 | —- | C] () – C:\Documents and Settings\sonnguyen\Local Settings\Application Data\fusioncache.dat
[2008/07/26 08:25:02 | 00,025,624 | —- | C] () – C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2008/07/23 11:50:52 | 03,596,288 | —- | C] () – C:\WINDOWS\System32\qt-dx331.dll
[2008/07/23 11:47:34 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dtu100.dll.manifest
[2008/07/23 11:47:34 | 00,000,416 | —- | C] () – C:\WINDOWS\System32\dpl100.dll.manifest
[2008/07/23 11:46:38 | 00,012,288 | —- | C] () – C:\WINDOWS\System32\DivXWMPExtType.dll
[2004/12/01 16:43:00 | 00,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/12/01 16:16:58 | 00,156,672 | —- | C] () – C:\WINDOWS\System32\RTLCPAPI.dll
[2004/12/01 14:51:57 | 00,000,811 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/12/01 13:29:23 | 00,012,288 | —- | C] () – C:\WINDOWS\System32\e100bmsg.dll
[2004/12/01 13:28:46 | 00,000,790 | —- | C] () – C:\WINDOWS\System32\oeminfo.ini
[2004/10/22 15:10:08 | 00,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2003/01/07 14:05:08 | 00,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/06/12 12:21:12 | 00,049,152 | R— | C] () – C:\WINDOWS\System32\winchip.dll
[2001/10/24 19:00:40 | 00,524,288 | —- | C] () – C:\WINDOWS\System32\TDI-SonyOMG.dll
[1996/04/03 14:33:26 | 00,005,248 | —- | C] () – C:\WINDOWS\System32\giveio.sys
< End of report >
Post #45 last edited
Hi faithiefaith,

It looks like Norton(Symantec) was installed on this computer at one time.

Do you know what this program is used for? NortonPCCheckup It looks like a recent addition.

You has some very old vulnerable java installed on this computer.
  • Go to http://java.sun.com/javase/downloads/index.jsp
  • Scroll down to "Java Runtime Environment (JRE) 6 Update 17"
  • Click the download button on the right.
If Information Bar pop-ups up, right-click on it and say it's OK to display the blocked content.
  • Select the platform (Windows, in your case), mutli language.
  • Accept the license agreement, click continue.
You do not have to install the Java Web Start ActiveX Control
  • Scroll down and click on Windows Offline Installation,
  • Save the file jre-6u17-windows-i586-p.exe to your desktop;
Do not select Run . Do not install it yet.

When the download is complete, close your browser.

Open Control Panel > Add/Remove Programs and uninstall

J2SE Runtime Environment 5.0

Do not uninstall Java TM 6 Update 17 if found! :yeah:

Reboot your computer.

  • Double-click on the saved file ( jre-6u17-windows-i586-p.exe) to install the update.
  • Delete the downloaded installation file after completing the above procedure and reboot if not prompted to do so.

Next, clear the java cache

To clear the Java Plug-in cache:
  • Click Start > Control Panel.
  • Double-click the Java icon in the control panel.
  • On the General tab, Click Settings under Temporary Internet Files.
  • On the Temporary Files Settings screen, Click Delete Files.
  • check all boxes
  • Click OK


This next scan will take a considerable amount of time, but it is well worth it given this PC has been unprotected.

Please go to Kaspersky website and perform an online antivirus scan.
  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions.
  • You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button
    • Spyware, Adware, Dialers, and other potentially dangerous programs
    • Archives
    • Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As….
  • Change the Files of type to Text file (.txt)
  • Set the Save In to Desktop
  • click the Save button.
  • Please post this log in your next reply.



Please post back with the Kaspersky log.

Thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI