Spyware / Malware / Virus Removal

[Resolved] BDS/Ruledor.J.1 virus

15 min read

Looking for the outcome? Ask AI

pamela4011

Post #16January 19, 2010, 3:04 PM UTC

Ok, here are the results of Eset scan: C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UWFX5_0001_N56M0311NetInstaller.exe a variant of Win32/Adware.WinFixer application C:\WINDOWS\Downloaded Program Files\CONFLICT.2\UWFX5_0001_N56M0311NetInstaller.exe a variant of Win32/Adware.WinFixer application. by the way, thank you for all your help.

pamela4011

Post #17January 19, 2010, 4:31 PM UTC

ok, here is Eset scan results: C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UWFX5_0001_N56M0311NetInstaller.exe a variant of Win32/Adware.WinFixer application C:\WINDOWS\Downloaded Program Files\CONFLICT.2\UWFX5_0001_N56M0311NetInstaller.exe a variant of Win32/Adware.WinFixer application thank you, for all your help.

RPMcMurphy

Post #18January 19, 2010, 6:43 PM UTC last edited January 21, 2010, 7:18 PM UTC

pamela4011,

You're very welcome. Is the computer running better? Here are your next instructions. If at any point you run into a problem or have a question, stop and post it for me:

🖼Click to load external image (Posted Image) Using Windows Explorer (Windows Key + E), locate the following files/folders, and DELETE them (if still present):

C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UWFX5_0001_N56M0311NetInstaller.exe 
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\UWFX5_0001_N56M0311NetInstaller.exe

🖼Click to load external image (Posted Image) Now, let’s update your operating system. This will probably take you a while:

Go to THIS SITE
Follow the prompts to Download and install all updates labeled Critical, Important or Recommended.
Repeat these steps until no more Critical, Important or Recommended updates appear.

🖼Click to load external image (Posted Image) Install an anti-virus program. I don't see any anti-virus software running on your computer. Choose one, (but no more) reputable AV program. If you need help chosing one, this site has good information. Avast, AVG, Avira and Microsoft all offer free AV products.

🖼Click to load external image (Posted Image) You need to update your Java application and clean out the old versions:

Go to http://java.com/en/
Click on Do I have Java? It’s near the center of the page.
Follow the instructions to download and install the latest version of Java.
Please download JavaRa from http://raproducts.org/click/click.php?id=1 to your desktop and unzip it to its own folder by double clicking the file you downloaded, then select extract all files.
Open the newly created JavaRa folder and run JavaRa by right clicking on it and selecting Run as administrator.
Pick the language of your choice and click Select.
Click Remove Older Versions.
Accept any prompts by clicking Yes or OK.
There is no need to save or post the log file that is produced.
Alternatively, you could uninstall all the older versions of Java through Start ->Control Panel -> Programs -> Uninstall a program, (JavaRa is more thorough however).

🖼Click to load external image (Posted Image) Your Adbobe reader needs to be updated. Please visit Adobe's site and grab the newest version.

Go HERE to scan for any other out of date and/or vulnerable applications on your computer and follow the instructions given for updating them.
Please include the following in your next post:

Let me know how the computer is running and how the updates went

pamela4011

Post #19January 22, 2010, 4:43 PM UTC

Ok, computer is running better, updates all installed went fine.
Here is the log after last code, if you needed the one after all the updates just let me know, it would not let me post both in the same reply. I deleted aol protection, causing problems and installed avira antivirus.
Ok Sarg, what is the next mission?

ComboFix 10-01-16.04 - Owner 01/19/2010 20:44:35.4.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.1.1252.1.1033.18.504.268 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
.

((((((((((((((((((((((((( Files Created from 2009-12-20 to 2010-01-20 )))))))))))))))))))))))))))))))
.

2010-01-19 01:22 . 2010-01-19 01:22 ——– dc—-w- c:\program files\ESET
2010-01-18 21:10 . 2010-01-18 21:10 ——– dc—-w- c:\documents and settings\Owner\Application Data\Research In Motion
2010-01-18 21:03 . 2010-01-18 21:03 ——– dc—-w- c:\documents and settings\All Users\Application Data\InstallShield
2010-01-18 21:03 . 2010-01-18 21:03 ——– dc—-w- c:\documents and settings\All Users\Application Data\Sonic
2010-01-18 21:00 . 2010-01-18 21:00 ——– dc—-w- c:\program files\Common Files\Sonic Shared
2010-01-18 21:00 . 2010-01-18 21:03 ——– dc—-w- c:\documents and settings\All Users\Application Data\Roxio
2010-01-18 21:00 . 2010-01-18 21:01 ——– dc—-w- c:\program files\Roxio
2010-01-18 21:00 . 2010-01-18 21:01 ——– dc—-w- c:\program files\Common Files\Roxio Shared
2010-01-18 20:48 . 2010-01-18 21:02 ——– d—–w- c:\windows\LastGood.Tmp
2010-01-18 20:47 . 2010-01-18 20:47 ——– dc—-w- c:\program files\Common Files\Research In Motion
2010-01-18 20:47 . 2010-01-18 20:47 ——– dc—-w- c:\program files\Research In Motion
2010-01-18 20:41 . 2010-01-18 20:41 ——– d-sh–w- c:\windows\ftpcache
2010-01-17 01:29 . 2001-08-17 18:48 12160 -c–a-w- c:\windows\system32\dllcache\mouhid.sys
2010-01-17 01:29 . 2001-08-17 18:48 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys
2010-01-17 01:29 . 2001-08-17 19:02 9600 -c–a-w- c:\windows\system32\dllcache\hidusb.sys
2010-01-17 01:29 . 2001-08-17 19:02 9600 —-a-w- c:\windows\system32\drivers\hidusb.sys
2010-01-10 06:41 . 2010-01-10 19:32 974 -c–a-w- c:\documents and settings\Owner\Application Data\Motive\Acme\plugin\maps\mmap.bat
2010-01-10 06:41 . 2010-01-10 19:32 413696 -c–a-w- c:\documents and settings\Owner\Application Data\Motive\Acme\plugin\maps\resources\deusr\bin\motkt.dll
2010-01-10 06:41 . 2010-01-10 19:32 311296 -c–a-w- c:\documents and settings\Owner\Application Data\Motive\Acme\plugin\maps\resources\deusr\bin\motivede.dll
2010-01-06 01:03 . 2010-01-10 07:05 ——– dc—-w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-18 21:20 . 2010-01-18 21:10 256 —-a-w- c:\windows\system32\pool.bin
2010-01-18 21:20 . 2010-01-18 21:20 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Bytemobile
2010-01-18 21:20 . 2010-01-18 21:20 ——– dc—-w- c:\documents and settings\Owner\Application Data\AT&T
2010-01-18 21:19 . 2010-01-18 21:19 ——– dc—-w- c:\documents and settings\Owner\Application Data\Sierra Wireless
2010-01-18 21:18 . 2010-01-18 21:18 ——– dc—-w- c:\program files\Common Files\Motorola Shared
2010-01-18 21:16 . 2010-01-18 21:16 ——– dc—-w- c:\program files\Sierra Wireless Inc
2010-01-18 21:16 . 2010-01-18 21:16 ——– dc—-w- c:\program files\AT&T
2010-01-18 21:16 . 2010-01-18 21:16 ——– dc—-w- c:\documents and settings\All Users\Application Data\AT&T
2010-01-18 21:13 . 2010-01-18 21:13 ——– dc—-w- c:\documents and settings\LocalService\Application Data\Roxio
2010-01-18 21:13 . 2010-01-18 21:13 ——– dc—-w- c:\documents and settings\Owner\Application Data\Roxio
2010-01-18 21:00 . 2003-07-24 09:32 ——– dc—-w- c:\program files\Common Files\InstallShield
2010-01-10 07:05 . 2003-07-26 08:57 ——– dc—-w- c:\documents and settings\Owner\Application Data\interMute
2010-01-05 22:07 . 2005-11-08 16:26 ——– dc—-w- c:\documents and settings\All Users\Application Data\McAfee.com
.

——- Sigcheck ——-

[-] 2004-08-04 . 49911DD39E023BB6C45E4E436CFBD297 . 13824 . . [5.1.2600.2180] . . c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\wscntfy.exe

[-] 2004-08-04 . EEF46DAB68229A14DA3D8E73C99E2959 . 129536 . . [5.1.2600.2180] . . c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\xmlprov.dll

c:\windows\System32\wscntfy.exe … is missing !!
c:\windows\System32\xmlprov.dll … is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"="nview.dll" [2003-05-03 835654]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-10-24 307200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440]
"StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 155648]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-03 4640768]
"nwiz"="nwiz.exe" [2003-05-03 323584]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-04 50176]
"PS2"="c:\windows\system32\ps2.exe" [2002-08-01 81920]
"mmtask"="c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2003-02-25 53248]
"HostManager"="c:\program files\Common Files\AOL\1131107367\ee\AOLSoftware.exe" [2008-06-24 41824]
"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-06-08 236016]
"AT&T Communication Manager"="c:\program files\AT&T\Communication Manager\ATTCM.exe" [2009-10-09 883272]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2003-02-21 10:50 40960 —-a-w- c:\program files\Softex\OmniPass\OPXPGina.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=c:\windows\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL Companion.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AOL Companion.lnk
backup=c:\windows\pss\AOL Companion.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk
backup=c:\windows\pss\Compaq Connections.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Event Planner Reminders Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Event Planner Reminders Tray Icon.lnk
backup=c:\windows\pss\Event Planner Reminders Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
2005-07-12 05:17 50776 -c–a-w- c:\program files\America Online 9.0\aol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection]
2004-10-18 22:42 79448 -c–a-w- c:\progra~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
2006-10-23 12:50 71216 -c–a-r- c:\program files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2008-06-24 18:34 14688 -c–a-w- c:\program files\Common Files\AOL\1131107367\EE\AOLHostManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2004-09-13 19:49 49152 -c–a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2002-08-21 05:08 1511453 -c—-w- c:\program files\Messenger\msmsgs.exe

S2 mrtRate;mrtRate; [x]
S3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\AT&T\Communication Manager\RcAppSvc.exe [10/9/2009 5:59 PM 121416]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://qus9.hpwis.com/
uDefault_Search_URL = hxxp://srch-qus9.hpwis.com/
mStart Page = hxxp://qus9.hpwis.com/
mSearch Bar = hxxp://srch-qus9.hpwis.com/
IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
LSP: bmnet.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-19 20:49
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-564863226-2137928799-652876964-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(440)
c:\windows\System32\ODBC32.dll
c:\program files\Softex\OmniPass\opxpgina.dll

- - - - - - - > 'lsass.exe'(496)
c:\windows\system32\bmnet.dll
c:\windows\System32\dssenh.dll
.
Completion time: 2010-01-19 20:51:19
ComboFix-quarantined-files.txt 2010-01-20 01:51
ComboFix2.txt 2010-01-20 01:32
ComboFix3.txt 2010-01-18 18:05
ComboFix4.txt 2010-01-18 05:12

Pre-Run: 25,308,803,072 bytes free
Post-Run: 25,306,161,152 bytes free

- - End Of File - - A80239457EE48ECC2E875F13BC3F7FCD

RPMcMurphy

Post #20January 22, 2010, 7:41 PM UTC

pamela4011,

Good work! We are almost done. Were you able to find and delete those two files ESET found?

🖼Click to load external image (Posted Image) Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

Please include the following in your next post:

MBAM log
Let me know if you were able to find and delete those two files

Run DDS again and post the new log

pamela4011

Post #21January 23, 2010, 5:05 AM UTC

ok, here is the MBAM log and the DDS log, eset results looked but unable to locate those two files by path . Malwarebytes' Anti-Malware 1.44 Database version: 3618 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 1/22/2010 9:04:54 PM mbam-log-2010-01-22 (21-04-54).txt Scan type: Full Scan (C:\|D:\|) Objects scanned: 194915 Time elapsed: 43 minute(s), 6 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\mediapass.installer (Adware.Winad) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\System Volume Information\_restore{10D4B4EE-7C0B-4339-9C74-3091462FA969}\RP516\A0072107.sys (Malware.Trace) -> Quarantined and deleted successfully. DDS (Ver_09-12-01.01) - NTFSx86 Run by [removed] at 21:18:31.64 on Fri 01/22/2010 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.504.213 [GMT -5:00] AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir Desktop\sched.exe svchost.exe C:\Program Files\Avira\AntiVir Desktop\avguard.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Softex\OmniPass\Omniserv.exe C:\WINDOWS\System32\HPZipm12.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\windows\system\hpsysdrv.exe C:\HP\KBD\KBD.EXE C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\WINDOWS\system32\igfxtray.exe C:\Program Files\Avira\AntiVir Desktop\avgnt.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\Program Files\Softex\OmniPass\OPXPApp.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\Documents and Settings\Owner\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://qus9.hpwis.com/ uDefault_Search_URL = hxxp://srch-qus9.hpwis.com/ mSearch Bar = hxxp://srch-qus9.hpwis.com/ uInternet Settings,ProxyOverride = localhost BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [NVIEW] rundll32.exe nview.dll,nViewLoadHook uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [KBD] c:\hp\kbd\KBD.EXE mRun: [StorageGuard] "c:\program files\common files\sonic\update manager\sgtray.exe" /r mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect mRun: [PS2] c:\windows\system32\ps2.exe mRun: [dpoqd5Ch$vùõš/‚²Æc:\program files\istsvc\istsvc.exe] c:\windows\wqdqcxlc.exe mRun: [HostManager] c:\program files\common files\aol\1131107367\ee\AOLSoftware.exe mRun: [AOLDialer] c:\program files\common files\aol\acs\AOLDial.exe mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe" mRun: [AT&T Communication Manager] "c:\program files\at&t\communication manager\ATTCM.exe" -a mRun: [AlcxMonitor] ALCXMNTR.EXE mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - {4982D40A-C53B-4615-B15B-B5B5E98D167C} LSP: bmnet.dll DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1263953054656 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1263953021171 DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Notify: igfxcui - igfxsrvc.dll Notify: OPXPGina - c:\program files\softex\omnipass\opxpgina.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll ============= SERVICES / DRIVERS =============== R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-1-21 11608] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-1-21 108289] R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-1-21 185089] R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-1-21 55656] S3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\at&t\communication manager\RcAppSvc.exe [2009-10-9 121416] =============== Created Last 30 ================ 2010-01-23 01:09:52 0 dc—-w- c:\docume~1\owner\applic~1\Malwarebytes 2010-01-23 01:09:42 0 dc—-w- c:\program files\Malwarebytes' Anti-Malware 2010-01-23 01:09:42 0 dc—-w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-01-22 04:31:16 27386256 -c–a-w- C:\AdbeRdr930_en_US.exe 2010-01-22 02:56:56 73728 —-a-w- c:\windows\system32\javacpl.cpl 2010-01-22 02:56:56 411368 —-a-w- c:\windows\system32\deploytk.dll 2010-01-22 02:34:15 919840 -c–a-w- c:\program files\JavaSetup6u18-rv.exe 2010-01-22 02:06:26 55656 —-a-w- c:\windows\system32\drivers\avgntflt.sys 2010-01-22 02:06:18 0 dc—-w- c:\program files\Avira 2010-01-22 02:06:18 0 dc—-w- c:\docume~1\alluse~1\applic~1\Avira 2010-01-22 01:04:49 30909992 -c–a-w- c:\program files\avira_antivir_personal_en.exe 2010-01-21 23:15:04 163840 —-a-w- c:\windows\system32\igfxres.dll 2010-01-21 21:05:22 1089593 -c—-w- c:\windows\system32\dllcache\ntprint.cat 2010-01-21 19:13:36 0 d—–w- c:\windows\system32\XPSViewer 2010-01-21 19:12:10 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2010-01-21 19:12:10 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2010-01-21 19:12:10 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll 2010-01-21 19:12:10 575488 ——w- c:\windows\system32\xpsshhdr.dll 2010-01-21 19:12:10 117760 ——w- c:\windows\system32\prntvpt.dll 2010-01-21 19:12:09 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll 2010-01-21 19:12:09 1676288 ——w- c:\windows\system32\xpssvcs.dll 2010-01-21 19:12:08 0 dc—-w- C:\b1af1112ab6c4be191f5 2010-01-21 19:05:24 0 dc—-w- c:\docume~1\owner\applic~1\Windows Desktop Search 2010-01-21 19:04:41 0 dc—-w- c:\program files\Windows Desktop Search 2010-01-21 19:04:41 0 d—–w- c:\windows\system32\GroupPolicy 2010-01-21 19:03:56 98304 -c—-w- c:\windows\system32\dllcache\nlhtml.dll 2010-01-21 19:03:56 29696 -c—-w- c:\windows\system32\dllcache\mimefilt.dll 2010-01-21 19:03:56 192000 -c—-w- c:\windows\system32\dllcache\offfilt.dll 2010-01-21 19:03:08 0 dc—-w- c:\program files\Windows Media Connect 2 2010-01-21 19:01:00 0 d—–w- c:\windows\system32\LogFiles 2010-01-21 18:58:09 92160 -c—-w- c:\windows\system32\dllcache\iecompat.dll 2010-01-21 06:43:49 0 d—–w- c:\windows\ie8updates 2010-01-21 06:35:57 594432 -c—-w- c:\windows\system32\dllcache\msfeeds.dll 2010-01-21 06:35:57 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll 2010-01-21 06:35:56 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll 2010-01-21 06:35:56 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll 2010-01-21 06:35:55 1985536 -c—-w- c:\windows\system32\dllcache\iertutil.dll 2010-01-21 06:35:51 11070464 -c—-w- c:\windows\system32\dllcache\ieframe.dll 2010-01-21 04:13:41 0 dcsh–w- c:\documents and settings\owner\PrivacIE 2010-01-21 04:06:02 0 dcsh–w- c:\documents and settings\owner\IETldCache 2010-01-21 03:38:35 0 dc—-w- c:\program files\MSXML 4.0 2010-01-21 03:34:43 0 dc-h–w- c:\windows\ie8 2010-01-21 03:15:42 0 dc—-w- c:\program files\Microsoft CAPICOM 2.1.0.2 2010-01-21 02:50:39 81920 -c—-w- c:\windows\system32\dllcache\fontsub.dll 2010-01-21 02:50:39 119808 -c—-w- c:\windows\system32\dllcache\t2embed.dll 2010-01-21 02:32:30 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll 2010-01-21 01:37:08 153088 -c—-w- c:\windows\system32\dllcache\triedit.dll 2010-01-21 00:58:30 1315328 -c—-w- c:\windows\system32\dllcache\msoe.dll 2010-01-21 00:52:19 128512 -c—-w- c:\windows\system32\dllcache\dhtmled.ocx 2010-01-21 00:06:35 401408 -c—-w- c:\windows\system32\dllcache\rpcss.dll 2010-01-21 00:06:35 284160 -c—-w- c:\windows\system32\dllcache\pdh.dll 2010-01-21 00:06:35 110592 -c—-w- c:\windows\system32\dllcache\services.exe 2010-01-21 00:06:34 473600 -c—-w- c:\windows\system32\dllcache\fastprox.dll 2010-01-21 00:06:34 453120 -c—-w- c:\windows\system32\dllcache\wmiprvsd.dll 2010-01-21 00:06:34 227840 -c—-w- c:\windows\system32\dllcache\wmiprvse.exe 2010-01-21 00:06:33 730112 -c—-w- c:\windows\system32\dllcache\lsasrv.dll 2010-01-21 00:06:33 714752 -c—-w- c:\windows\system32\dllcache\ntdll.dll 2010-01-21 00:06:33 617472 -c—-w- c:\windows\system32\dllcache\advapi32.dll 2010-01-21 00:06:32 2145280 -c—-w- c:\windows\system32\dllcache\ntkrnlmp.exe 2010-01-21 00:06:31 2189184 -c—-w- c:\windows\system32\dllcache\ntoskrnl.exe 2010-01-21 00:06:30 2023936 -c—-w- c:\windows\system32\dllcache\ntkrpamp.exe 2010-01-20 23:58:37 2560 ——w- c:\windows\system32\xpsp4res.dll 2010-01-20 23:58:36 215552 -c—-w- c:\windows\system32\dllcache\wordpad.exe 2010-01-20 23:58:36 1206508 -c—-w- c:\windows\system32\dllcache\sysmain.sdb 2010-01-20 23:54:44 333952 -c—-w- c:\windows\system32\dllcache\srv.sys 2010-01-20 23:49:43 455296 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys 2010-01-20 23:46:46 1172480 -c—-w- c:\windows\system32\dllcache\msxml3.dll 2010-01-20 23:45:01 337408 -c—-w- c:\windows\system32\dllcache\netapi32.dll 2010-01-20 23:43:51 331776 -c—-w- c:\windows\system32\dllcache\msadce.dll 2010-01-20 23:24:52 691712 -c—-w- c:\windows\system32\dllcache\inetcomm.dll 2010-01-20 23:20:28 272128 -c—-w- c:\windows\system32\dllcache\bthport.sys 2010-01-20 23:18:27 203136 -c—-w- c:\windows\system32\dllcache\rmcast.sys 2010-01-20 20:19:28 0 d—–w- c:\windows\system32\scripting 2010-01-20 20:19:26 0 d—–w- c:\windows\l2schemas 2010-01-20 20:19:25 0 d—–w- c:\windows\system32\en 2010-01-20 20:13:46 0 d—–w- c:\windows\network diagnostic 2010-01-20 19:59:59 403 -c—-w- c:\windows\system32\dllcache\npdrmv2.zip 2010-01-20 19:58:59 498742 -c—-w- c:\windows\system32\dllcache\dxmasf.dll 2010-01-20 03:11:42 0 d—–w- c:\windows\system32\wbem\AutoRecover 2010-01-20 02:53:29 0 d—–w- c:\windows\peernet 2010-01-20 02:53:27 0 d—–w- c:\windows\provisioning 2010-01-20 02:50:52 0 d—–w- c:\windows\ServicePackFiles 2010-01-20 02:42:50 0 d—–w- c:\windows\EHome 2010-01-20 02:07:20 21728 —-a-w- c:\windows\system32\wucltui.dll.mui 2010-01-20 02:07:20 17632 —-a-w- c:\windows\system32\wuaueng.dll.mui 2010-01-20 02:07:19 15072 —-a-w- c:\windows\system32\wuaucpl.cpl.mui 2010-01-20 02:07:18 15064 —-a-w- c:\windows\system32\wuapi.dll.mui 2010-01-20 02:07:18 0 d—–w- c:\windows\system32\SoftwareDistribution 2010-01-18 21:20:07 0 dc—-w- c:\docume~1\owner\applic~1\AT&T 2010-01-18 21:19:23 26760 —-a-r- c:\windows\system32\drivers\swmsflt.sys 2010-01-18 21:19:23 0 dc—-w- c:\docume~1\owner\applic~1\Sierra Wireless 2010-01-18 21:18:01 0 dc—-w- c:\program files\common files\Motorola Shared 2010-01-18 21:16:52 0 dc—-w- c:\program files\Sierra Wireless Inc 2010-01-18 21:16:52 0 dc—-w- c:\program files\AT&T 2010-01-18 21:16:52 0 dc—-w- c:\docume~1\alluse~1\applic~1\AT&T 2010-01-18 21:10:50 256 —-a-w- c:\windows\system32\pool.bin 2010-01-18 21:10:45 0 dc—-w- c:\docume~1\owner\applic~1\Research In Motion 2010-01-18 21:00:41 0 dc—-w- c:\program files\common files\Sonic Shared 2010-01-18 21:00:40 0 dc—-w- c:\program files\Roxio 2010-01-18 20:47:11 0 dc—-w- c:\program files\common files\Research In Motion 2010-01-18 20:47:04 0 dc—-w- c:\program files\Research In Motion 2010-01-18 20:41:55 0 d-sh–w- c:\windows\ftpcache 2010-01-18 05:03:58 98816 —-a-w- c:\windows\sed.exe 2010-01-18 05:03:58 77312 —-a-w- c:\windows\MBR.exe 2010-01-18 05:03:58 261632 —-a-w- c:\windows\PEV.exe 2010-01-18 05:03:58 161792 —-a-w- c:\windows\SWREG.exe 2010-01-17 01:29:39 12160 -c–a-w- c:\windows\system32\dllcache\mouhid.sys 2010-01-17 01:29:39 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys 2010-01-17 01:29:36 10368 -c–a-w- c:\windows\system32\dllcache\hidusb.sys 2010-01-17 01:29:36 10368 —-a-w- c:\windows\system32\drivers\hidusb.sys 2010-01-08 19:28:58 277 —-a-w- c:\windows\wininit.ini 2010-01-06 01:03:45 0 dc—-w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy ==================== Find3M ==================== 2009-12-21 19:14:05 916480 ——w- c:\windows\system32\wininet.dll ============= FINISH: 21:19:16.87 ===============

pamela4011

Post #22January 23, 2010, 3:50 PM UTC

Same as before? CODE C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UWFX5_0001_N56M0311NetInstaller.exe a variant of Win32/Adware.WinFixer application C:\WINDOWS\Downloaded Program Files\CONFLICT.2\UWFX5_0001_N56M0311NetInstaller.exe a variant of Win32/Adware.WinFixer application

pamela4011

Post #23January 23, 2010, 7:57 PM UTC

I have searched for the two files unable to locate, did find this in regedit, HKEY_current_USER SOFTWARE MICROSOFT SEARCH ASSISTANT acmRU 5604 001 ADWARE 002 WINFIXER 003 NETINSTALLER 004 UWFX 005 0001 006 UWFX5 5603 ALSO FOUND A FEW OF THE KEYWORDS

RPMcMurphy

Post #24January 24, 2010, 11:17 AM UTC

pamela4011,

OK, this script will take care of those two files and some remnants of the AOL software you uninstalled:

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

DDS::
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
mRun: [dpoqd5Ch$vùõš/‚²Æc:\program files\istsvc\istsvc.exe] c:\windows\wqdqcxlc.exe
mRun: [AlcxMonitor] ALCXMNTR.EXE
IE: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - {4982D40A-C53B-4615-B15B-B5B5E98D167C}

File::
C:\WINDOWS\Downloaded Program Files\CONFLICT.1\UWFX5_0001_N56M0311NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\CONFLICT.2\UWFX5_0001_N56M0311NetInstaller.exe

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Please include the following in your next post:

ComboFix log

Let me know if you are having any problems with the computer

pamela4011

Post #25January 24, 2010, 4:24 PM UTC

Computer seems to be running ok,
Here are the logs:
ComboFix 10-01-16.04 - Owner 01/24/2010 10:37:16.6.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.504.250 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

FILE ::
"c:\windows\Downloaded Program Files\CONFLICT.1\UWFX5_0001_N56M0311NetInstaller.exe"
"c:\windows\Downloaded Program Files\CONFLICT.2\UWFX5_0001_N56M0311NetInstaller.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\CONFLICT.1\UWFX5_0001_N56M0311NetInstaller.exe
c:\windows\Downloaded Program Files\CONFLICT.2\UWFX5_0001_N56M0311NetInstaller.exe

.
((((((((((((((((((((((((( Files Created from 2009-12-24 to 2010-01-24 )))))))))))))))))))))))))))))))
.

2010-01-23 14:41 . 2010-01-23 14:41 ——– dc—-w- c:\documents and settings\Owner\Application Data\Windows Search
2010-01-23 01:09 . 2010-01-23 01:09 ——– dc—-w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-01-23 01:09 . 2010-01-23 02:12 ——– dc—-w- c:\program files\Malwarebytes' Anti-Malware
2010-01-22 04:44 . 2010-01-22 04:44 ——– d—–w- c:\windows\Sun
2010-01-22 04:31 . 2010-01-22 04:31 27386256 -c–a-w- C:\AdbeRdr930_en_US.exe
2010-01-22 03:00 . 2010-01-22 03:00 503808 -c–a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-376e46cf-n\msvcp71.dll
2010-01-22 03:00 . 2010-01-22 03:00 499712 -c–a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-376e46cf-n\jmc.dll
2010-01-22 03:00 . 2010-01-22 03:00 348160 -c–a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-376e46cf-n\msvcr71.dll
2010-01-22 02:57 . 2010-01-22 02:57 61440 -c–a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6e5c0860-n\decora-sse.dll
2010-01-22 02:57 . 2010-01-22 02:57 12800 -c–a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6e5c0860-n\decora-d3d.dll
2010-01-22 02:57 . 2010-01-22 02:57 ——– dc—-w- c:\program files\Common Files\Java
2010-01-22 02:56 . 2010-01-22 02:56 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-01-22 02:34 . 2010-01-22 02:34 919840 -c–a-w- c:\program files\JavaSetup6u18-rv.exe
2010-01-22 02:06 . 2009-07-28 20:33 55656 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2010-01-22 02:06 . 2009-03-30 14:33 96104 —-a-w- c:\windows\system32\drivers\avipbb.sys
2010-01-22 02:06 . 2009-02-13 16:29 22360 —-a-w- c:\windows\system32\drivers\avgntmgr.sys
2010-01-22 02:06 . 2009-02-13 16:17 45416 —-a-w- c:\windows\system32\drivers\avgntdd.sys
2010-01-22 02:06 . 2010-01-22 02:06 ——– dc—-w- c:\program files\Avira
2010-01-22 02:06 . 2010-01-22 02:06 ——– dc—-w- c:\documents and settings\All Users\Application Data\Avira
2010-01-22 01:04 . 2010-01-22 01:04 30909992 -c–a-w- c:\program files\avira_antivir_personal_en.exe
2010-01-21 23:15 . 2004-11-02 13:58 163840 —-a-w- c:\windows\system32\igfxres.dll
2010-01-21 19:13 . 2010-01-21 19:13 ——– d—–w- c:\windows\system32\XPSViewer
2010-01-21 19:13 . 2010-01-21 19:13 ——– dc—-w- c:\program files\MSBuild
2010-01-21 19:13 . 2010-01-21 19:13 ——– dc—-w- c:\program files\Reference Assemblies
2010-01-21 19:12 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-01-21 19:12 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-01-21 19:12 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-01-21 19:12 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2010-01-21 19:12 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2010-01-21 19:12 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-01-21 19:12 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-01-21 19:12 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2010-01-21 19:12 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2010-01-21 19:12 . 2010-01-21 19:12 ——– dc—-w- C:\b1af1112ab6c4be191f5
2010-01-21 19:05 . 2010-01-21 19:05 ——– dcsh–w- c:\documents and settings\LocalService\IETldCache
2010-01-21 19:05 . 2010-01-21 19:05 ——– dc—-w- c:\documents and settings\Owner\Local Settings\Application Data\Identities
2010-01-21 19:05 . 2010-01-21 19:05 ——– dc—-w- c:\documents and settings\Owner\Application Data\Windows Desktop Search
2010-01-21 19:04 . 2010-01-21 21:40 ——– dc—-w- c:\program files\Windows Desktop Search
2010-01-21 19:04 . 2010-01-21 19:04 ——– d—–w- c:\windows\system32\GroupPolicy
2010-01-21 19:03 . 2008-03-07 17:02 98304 -c—-w- c:\windows\system32\dllcache\nlhtml.dll
2010-01-21 19:03 . 2008-03-07 17:02 29696 -c—-w- c:\windows\system32\dllcache\mimefilt.dll
2010-01-21 19:03 . 2008-03-07 17:02 192000 -c—-w- c:\windows\system32\dllcache\offfilt.dll
2010-01-21 19:03 . 2010-01-21 19:03 ——– dc—-w- c:\program files\Windows Media Connect 2
2010-01-21 19:01 . 2010-01-21 19:01 ——– d—–w- c:\windows\system32\drivers\UMDF
2010-01-21 19:01 . 2010-01-21 19:01 ——– d—–w- c:\windows\system32\LogFiles
2010-01-21 18:58 . 2009-10-02 04:44 92160 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2010-01-21 06:43 . 2010-01-21 21:47 ——– d—–w- c:\windows\ie8updates
2010-01-21 06:35 . 2009-12-21 19:14 594432 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2010-01-21 06:35 . 2009-12-21 19:14 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-01-21 06:35 . 2009-12-21 19:14 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2010-01-21 06:35 . 2009-12-21 19:14 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-21 06:35 . 2009-12-21 19:14 1985536 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2010-01-21 06:35 . 2009-12-21 19:14 11070464 -c—-w- c:\windows\system32\dllcache\ieframe.dll
2010-01-21 04:13 . 2010-01-21 04:13 ——– dcsh–w- c:\documents and settings\Owner\PrivacIE
2010-01-21 04:06 . 2010-01-21 04:06 ——– dcsh–w- c:\documents and settings\Owner\IETldCache
2010-01-21 03:38 . 2010-01-21 03:38 ——– dc—-w- c:\program files\MSXML 4.0
2010-01-21 03:34 . 2010-01-21 03:35 ——– dc-h–w- c:\windows\ie8
2010-01-21 03:15 . 2010-01-21 03:15 ——– dc—-w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-01-21 02:50 . 2009-10-15 16:28 81920 -c—-w- c:\windows\system32\dllcache\fontsub.dll
2010-01-21 02:50 . 2009-10-15 16:28 119808 -c—-w- c:\windows\system32\dllcache\t2embed.dll
2010-01-21 02:32 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2010-01-21 01:37 . 2009-06-21 21:44 153088 -c—-w- c:\windows\system32\dllcache\triedit.dll
2010-01-21 00:58 . 2009-07-10 13:27 1315328 -c—-w- c:\windows\system32\dllcache\msoe.dll
2010-01-21 00:06 . 2009-03-06 14:22 284160 -c—-w- c:\windows\system32\dllcache\pdh.dll
2010-01-21 00:06 . 2009-02-09 12:10 401408 -c—-w- c:\windows\system32\dllcache\rpcss.dll
2010-01-21 00:06 . 2009-02-06 11:11 110592 -c—-w- c:\windows\system32\dllcache\services.exe
2010-01-21 00:06 . 2009-02-09 12:10 473600 -c—-w- c:\windows\system32\dllcache\fastprox.dll
2010-01-21 00:06 . 2009-02-09 12:10 453120 -c—-w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-01-21 00:06 . 2009-02-06 10:10 227840 -c—-w- c:\windows\system32\dllcache\wmiprvse.exe
2010-01-21 00:06 . 2009-06-25 08:25 730112 -c—-w- c:\windows\system32\dllcache\lsasrv.dll
2010-01-21 00:06 . 2009-02-09 12:10 714752 -c—-w- c:\windows\system32\dllcache\ntdll.dll
2010-01-21 00:06 . 2009-02-09 12:10 617472 -c—-w- c:\windows\system32\dllcache\advapi32.dll
2010-01-21 00:06 . 2009-08-04 15:13 2145280 -c—-w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-21 00:06 . 2009-08-05 01:44 2189184 -c—-w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-01-21 00:06 . 2009-08-04 14:20 2023936 -c—-w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-20 23:58 . 2008-05-03 11:55 2560 ——w- c:\windows\system32\xpsp4res.dll
2010-01-20 23:58 . 2008-04-21 12:08 215552 -c—-w- c:\windows\system32\dllcache\wordpad.exe
2010-01-20 23:54 . 2008-12-11 10:57 333952 -c—-w- c:\windows\system32\dllcache\srv.sys
2010-01-20 23:49 . 2008-10-24 11:21 455296 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-20 23:46 . 2009-07-31 04:35 1172480 -c—-w- c:\windows\system32\dllcache\msxml3.dll
2010-01-20 23:45 . 2008-10-15 16:34 337408 -c—-w- c:\windows\system32\dllcache\netapi32.dll
2010-01-20 23:43 . 2008-05-01 14:33 331776 -c—-w- c:\windows\system32\dllcache\msadce.dll
2010-01-20 23:24 . 2008-04-11 19:04 691712 -c—-w- c:\windows\system32\dllcache\inetcomm.dll
2010-01-20 23:20 . 2008-06-13 11:05 272128 -c—-w- c:\windows\system32\dllcache\bthport.sys
2010-01-20 23:18 . 2008-05-08 14:02 203136 -c—-w- c:\windows\system32\dllcache\rmcast.sys
2010-01-20 20:19 . 2010-01-20 20:19 ——– d—–w- c:\windows\system32\scripting
2010-01-20 20:19 . 2010-01-20 20:19 ——– d—–w- c:\windows\l2schemas
2010-01-20 20:19 . 2010-01-20 20:19 ——– d—–w- c:\windows\system32\en
2010-01-20 19:59 . 2008-04-14 00:12 226816 -c—-w- c:\windows\system32\dllcache\npdrmv2.dll
2010-01-20 19:58 . 2008-04-14 00:11 498742 -c—-w- c:\windows\system32\dllcache\dxmasf.dll
2010-01-20 03:11 . 2010-01-21 19:16 ——– d—–w- c:\windows\system32\wbem\AutoRecover
2010-01-20 03:10 . 2010-01-20 03:10 ——– dc—-w- c:\documents and settings\NetworkService\Application Data\Bytemobile
2010-01-20 02:53 . 2010-01-20 20:19 ——– d—–w- c:\windows\peernet
2010-01-20 02:53 . 2010-01-20 02:53 ——– d—–w- c:\windows\provisioning
2010-01-20 02:50 . 2010-01-20 02:50 ——– d—–w- c:\windows\ServicePackFiles
2010-01-20 02:42 . 2010-01-20 20:07 ——– d—–w- c:\windows\EHome
2010-01-18 21:20 . 2010-01-18 21:20 ——– d—–w- c:\windows\system32\config\systemprofile\Application Data\Bytemobile
2010-01-18 21:20 . 2010-01-18 21:20 ——– dc—-w- c:\documents and settings\Owner\Application Data\AT&T
2010-01-18 21:19 . 2010-01-18 21:19 ——– dc—-w- c:\documents and settings\Owner\Application Data\Sierra Wireless
2010-01-18 21:19 . 2008-08-22 15:05 26760 —-a-r- c:\windows\system32\drivers\swmsflt.sys
2010-01-18 21:18 . 2010-01-18 21:18 ——– dc—-w- c:\windows\system32\DRVSTORE
2010-01-18 21:18 . 2010-01-18 21:18 ——– dc—-w- c:\program files\Common Files\Motorola Shared
2010-01-18 21:16 . 2010-01-18 21:16 ——– dc—-w- c:\program files\Sierra Wireless Inc
2010-01-18 21:16 . 2010-01-18 21:16 ——– dc—-w- c:\program files\AT&T
2010-01-18 21:16 . 2010-01-18 21:16 ——– dc—-w- c:\documents and settings\All Users\Application Data\AT&T
2010-01-18 21:13 . 2010-01-18 21:13 ——– dc—-w- c:\documents and settings\LocalService\Application Data\Roxio
2010-01-18 21:13 . 2010-01-18 21:13 ——– dc—-w- c:\documents and settings\Owner\Application Data\Roxio
2010-01-18 21:10 . 2010-01-18 21:20 256 —-a-w- c:\windows\system32\pool.bin
2010-01-18 21:10 . 2010-01-18 21:10 ——– dc—-w- c:\documents and settings\Owner\Application Data\Research In Motion
2010-01-18 21:03 . 2010-01-18 21:03 ——– dc—-w- c:\documents and settings\All Users\Application Data\InstallShield
2010-01-18 21:03 . 2010-01-18 21:03 ——– dc—-w- c:\documents and settings\All Users\Application Data\Sonic
2010-01-18 21:00 . 2010-01-18 21:00 ——– dc—-w- c:\program files\Common Files\Sonic Shared
2010-01-18 21:00 . 2010-01-18 21:03 ——– dc—-w- c:\documents and settings\All Users\Application Data\Roxio
2010-01-18 21:00 . 2010-01-18 21:01 ——– dc—-w- c:\program files\Roxio
2010-01-18 21:00 . 2010-01-18 21:01 ——– dc—-w- c:\program files\Common Files\Roxio Shared
2010-01-18 20:47 . 2010-01-18 20:47 ——– dc—-w- c:\program files\Common Files\Research In Motion
2010-01-18 20:47 . 2010-01-18 20:47 ——– dc—-w- c:\program files\Research In Motion
2010-01-18 20:41 . 2010-01-18 20:41 ——– d-sh–w- c:\windows\ftpcache
2010-01-17 01:29 . 2001-08-17 18:48 12160 -c–a-w- c:\windows\system32\dllcache\mouhid.sys
2010-01-17 01:29 . 2001-08-17 18:48 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys
2010-01-17 01:29 . 2008-04-13 18:45 10368 -c–a-w- c:\windows\system32\dllcache\hidusb.sys
2010-01-17 01:29 . 2008-04-13 18:45 10368 —-a-w- c:\windows\system32\drivers\hidusb.sys
2010-01-10 06:41 . 2010-01-10 19:32 974 -c–a-w- c:\documents and settings\Owner\Application Data\Motive\Acme\plugin\maps\mmap.bat
2010-01-10 06:41 . 2010-01-10 19:32 413696 -c–a-w- c:\documents and settings\Owner\Application Data\Motive\Acme\plugin\maps\resources\deusr\bin\motkt.dll
2010-01-10 06:41 . 2010-01-10 19:32 311296 -c–a-w- c:\documents and settings\Owner\Application Data\Motive\Acme\plugin\maps\resources\deusr\bin\motivede.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-22 04:34 . 2003-07-24 09:32 ——– dc—-w- c:\program files\Common Files\Adobe
2010-01-22 03:31 . 2004-09-15 01:29 75344 -c–a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-22 03:23 . 2003-07-24 09:37 ——– d—–w- c:\program files\MUSICMATCH
2010-01-22 03:23 . 2003-07-24 09:32 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-01-22 03:22 . 2003-07-24 09:53 ——– dc—-w- c:\program files\Hewlett-Packard
2010-01-22 03:10 . 2004-05-15 22:47 ——– dc—-w- c:\program files\Common Files\AOL
2010-01-22 03:05 . 2004-05-15 22:34 ——– d—–w- c:\program files\Java
2010-01-21 22:16 . 2003-07-24 09:47 ——– d—–w- c:\program files\Quicken
2010-01-21 22:14 . 2005-08-16 03:11 ——– dc—-w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-01-21 22:11 . 2005-01-08 15:45 ——– d—–w- c:\program files\Sierra
2010-01-20 20:25 . 2003-07-24 08:28 81151 —-a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-01-20 20:22 . 2010-01-20 20:22 420432 —-a-w- c:\windows\PCHealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS3EN\plugin\bin\pchplugin.zip
2010-01-20 20:22 . 2010-01-20 20:22 49152 —-a-w- c:\windows\PCHealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS3EN\plugin\bin\PCHI18N.dll
2010-01-20 20:21 . 2010-01-20 20:21 106496 —-a-w- c:\windows\PCHealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS3EN\plugin\bin\PluginCtrl.dll
2010-01-20 20:21 . 2010-01-20 20:21 77824 —-a-w- c:\windows\PCHealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS3EN\plugin\bin\WinVerifyTrust.dll
2010-01-20 20:21 . 2010-01-20 20:21 159744 —-a-w- c:\windows\PCHealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS3EN\plugin\bin\PCHButton.exe
2010-01-20 20:21 . 2010-01-20 20:21 122880 —-a-w- c:\windows\PCHealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS3EN\plugin\bin\SearchCtrl.dll
2010-01-20 20:21 . 2010-01-20 20:21 126976 —-a-w- c:\windows\PCHealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS3EN\plugin\bin\ContentUpdater.exe
2010-01-20 20:21 . 2010-01-20 20:21 1306152 —-a-w- c:\windows\PCHealth\HelpCtr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Presario\XPHNARS3EN\plugin\bin\motdeusr.zip
2010-01-18 21:00 . 2003-07-24 09:32 ——– dc—-w- c:\program files\Common Files\InstallShield
2010-01-10 07:05 . 2003-07-26 08:57 ——– dc—-w- c:\documents and settings\Owner\Application Data\interMute
2009-12-21 19:14 . 2003-08-08 17:32 916480 ——w- c:\windows\system32\wininet.dll
2009-11-21 15:51 . 2003-08-08 17:56 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
.

((((((((((((((((((((((((((((( SnapShot_2010-01-22_06.51.43 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-23 14:18 . 2010-01-23 14:18 16384 c:\windows\temp\Perflib_Perfdata_4bc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIEW"="nview.dll" [2003-05-03 835654]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440]
"StorageGuard"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-02-13 155648]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-05-03 4640768]
"nwiz"="nwiz.exe" [2003-05-03 323584]
"PS2"="c:\windows\system32\ps2.exe" [2002-08-01 81920]
"HostManager"="c:\program files\Common Files\AOL\1131107367\ee\AOLSoftware.exe" [2008-06-24 41824]
"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-06-08 236016]
"AT&T Communication Manager"="c:\program files\AT&T\Communication Manager\ATTCM.exe" [2009-10-09 883272]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina]
2003-02-21 10:50 40960 —-a-w- c:\program files\Softex\OmniPass\OPXPGina.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 8.0 Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 8.0 Tray Icon.lnk
backup=c:\windows\pss\America Online 8.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL Companion.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\AOL Companion.lnk
backup=c:\windows\pss\AOL Companion.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk
backup=c:\windows\pss\Compaq Connections.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Event Planner Reminders Tray Icon.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Event Planner Reminders Tray Icon.lnk
backup=c:\windows\pss\Event Planner Reminders Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Quicken Scheduled Updates.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Quicken Scheduled Updates.lnk
backup=c:\windows\pss\Quicken Scheduled Updates.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
2005-07-12 05:17 50776 -c–a-w- c:\program files\America Online 9.0\aol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection]
2004-10-18 22:42 79448 -c–a-w- c:\progra~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
2006-10-23 12:50 71216 -c–a-r- c:\program files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2008-06-24 18:34 14688 -c–a-w- c:\program files\Common Files\AOL\1131107367\EE\AOLHostManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2004-09-13 19:49 49152 -c–a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ——w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [1/21/2010 9:06 PM 108289]
S3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\AT&T\Communication Manager\RcAppSvc.exe [10/9/2009 5:59 PM 121416]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://qus9.hpwis.com/
uDefault_Search_URL = hxxp://srch-qus9.hpwis.com/
mSearch Bar = hxxp://srch-qus9.hpwis.com/
IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
LSP: bmnet.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-24 10:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-564863226-2137928799-652876964-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(456)
c:\program files\Softex\OmniPass\opxpgina.dll

- - - - - - - > 'lsass.exe'(512)
c:\windows\system32\bmnet.dll
.
Completion time: 2010-01-24 10:48:51
ComboFix-quarantined-files.txt 2010-01-24 15:48
ComboFix2.txt 2010-01-22 06:55
ComboFix3.txt 2010-01-20 01:51
ComboFix4.txt 2010-01-20 01:32
ComboFix5.txt 2010-01-24 15:36

Pre-Run: 20,420,313,088 bytes free
Post-Run: 20,399,374,336 bytes free

- - End Of File - - AFD80C3E6466E269D4A7408E01DF04ED

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:16:58 AM, on 1/24/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hkcmd.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 1 for HijackThis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus9.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=8116
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [dpoqd5Ch$vùõš/‚²ÆC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\wqdqcxlc.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1131107367\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [AT&T Communication Manager] "C:\Program Files\AT&T\Communication Manager\ATTCM.exe" -a
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - .DEFAULT User Startup: mod_sm.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: bmnet.dll
O10 - Unknown file in Winsock LSP: bmnet.dll
O10 - Unknown file in Winsock LSP: bmnet.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1263953054656
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1263953021171
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwa…ash/swflash.cab
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AT&T RcAppSvc (ATTRcAppSvc) - SmithMicro Inc. - C:\Program Files\AT&T\Communication Manager\RcAppSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

–
End of file - 7587 bytes

RPMcMurphy

Post #26January 24, 2010, 6:47 PM UTC

pamela4011,

We have a couple of files being real stubborn. Please try this:

🖼Click to load external image (Posted Image) Carefully follow these instructions:

1. Please download The Avenger2 by Swandog46 to your Desktop.

Right click on the Avenger.zip folder and select "Extract All…"
Follow the prompts and extract the avenger folder to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Begin copying here:
Registry values to delete:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run | dpoqd5Ch$vùõš/‚²ÆC:\Program Files\ISTsvc\istsvc.exe

Folders to delete:
C:\Program Files\ISTsvc

Files to delete:
C:\WINDOWS\wqdqcxlc.exe

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

Right click on the window under Input script here:, and select Paste.
You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
Click on Execute
Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh DDS log.

Please include the following in your next post:

Avenger log

Run DDS and after the Avenger and post the log

pamela4011

Post #27January 24, 2010, 8:17 PM UTC

Ok , here are the results of avenger log and dds log:

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 3)
Sun Jan 24 14:55:18 2010

14:55:11: Error: Invalid syntax in command:
"Files\ISTsvc\istsvc.exe"
Skipping line. (Registry value deletion mode)

//////////////////////////////////////////

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Error: folder "C:\Program Files\ISTsvc" not found!
Deletion of folder "C:\Program Files\ISTsvc" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
–> the object does not exist

Error: file "C:\WINDOWS\wqdqcxlc.exe" not found!
Deletion of file "C:\WINDOWS\wqdqcxlc.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
–> the object does not exist

Error: could not delete registry value "HKLM\Software\Microsoft\Windows\CurrentVersion\Run|dpoqd5Ch$vùõš/‚²ÆC:\Program"
Deletion of registry value "HKLM\Software\Microsoft\Windows\CurrentVersion\Run|dpoqd5Ch$vùõš/‚²ÆC:\Program" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
–> the object does not exist

Completed script processing.

*******************

Finished! Terminate.

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows XP (build 2600, Service Pack 3)
Sun Jan 24 15:00:43 2010

15:00:43: Error: Invalid script. A valid script must begin with a command directive.
Aborting execution!

//////////////////////////////////////////

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Error: folder "C:\Program Files\ISTsvc" not found!
Deletion of folder "C:\Program Files\ISTsvc" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
–> the object does not exist

Error: file "C:\WINDOWS\wqdqcxlc.exe" not found!
Deletion of file "C:\WINDOWS\wqdqcxlc.exe" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
–> the object does not exist

Registry value "HKLM\Software\Microsoft\Windows\CurrentVersion\Run|dpoqd5Ch$vùõš/‚²ÆC:\Program Files\ISTsvc\istsvc.exe" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

DDS (Ver_09-12-01.01) - NTFSx86
Run by [removed] at 15:09:47.70 on Sun 01/24/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.504.203 [GMT -5:00]

AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Common Files\AOL\1131107367\ee\AOLSoftware.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\WINDOWS\system32\igfxtray.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://qus9.hpwis.com/
uDefault_Search_URL = hxxp://srch-qus9.hpwis.com/
mSearch Bar = hxxp://srch-qus9.hpwis.com/
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [KBD] c:\hp\kbd\KBD.EXE
mRun: [StorageGuard] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
mRun: [PS2] c:\windows\system32\ps2.exe
mRun: [HostManager] c:\program files\common files\aol\1131107367\ee\AOLSoftware.exe
mRun: [AOLDialer] c:\program files\common files\aol\acs\AOLDial.exe
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [AT&T Communication Manager] "c:\program files\at&t\communication manager\ATTCM.exe" -a
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: bmnet.dll
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1263953054656
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1263953021171
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Notify: igfxcui - igfxsrvc.dll
Notify: OPXPGina - c:\program files\softex\omnipass\opxpgina.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-1-21 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-1-21 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-1-21 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-1-21 55656]
S3 ATTRcAppSvc;AT&T RcAppSvc;c:\program files\at&t\communication manager\RcAppSvc.exe [2009-10-9 121416]

=============== Created Last 30 ================

2010-01-23 19:09:29 0 -c–a-w- c:\documents and settings\owner\key 1
2010-01-23 14:41:52 0 dc—-w- c:\docume~1\owner\applic~1\Windows Search
2010-01-23 01:09:52 0 dc—-w- c:\docume~1\owner\applic~1\Malwarebytes
2010-01-23 01:09:42 0 dc—-w- c:\program files\Malwarebytes' Anti-Malware
2010-01-22 04:31:16 27386256 -c–a-w- C:\AdbeRdr930_en_US.exe
2010-01-22 02:56:56 73728 —-a-w- c:\windows\system32\javacpl.cpl
2010-01-22 02:56:56 411368 —-a-w- c:\windows\system32\deploytk.dll
2010-01-22 02:34:15 919840 -c–a-w- c:\program files\JavaSetup6u18-rv.exe
2010-01-22 02:06:26 55656 —-a-w- c:\windows\system32\drivers\avgntflt.sys
2010-01-22 02:06:18 0 dc—-w- c:\program files\Avira
2010-01-22 02:06:18 0 dc—-w- c:\docume~1\alluse~1\applic~1\Avira
2010-01-22 01:04:49 30909992 -c–a-w- c:\program files\avira_antivir_personal_en.exe
2010-01-21 23:15:04 163840 —-a-w- c:\windows\system32\igfxres.dll
2010-01-21 21:05:22 1089593 -c—-w- c:\windows\system32\dllcache\ntprint.cat
2010-01-21 19:13:36 0 d—–w- c:\windows\system32\XPSViewer
2010-01-21 19:12:10 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-01-21 19:12:10 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-01-21 19:12:10 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-01-21 19:12:10 575488 ——w- c:\windows\system32\xpsshhdr.dll
2010-01-21 19:12:10 117760 ——w- c:\windows\system32\prntvpt.dll
2010-01-21 19:12:09 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2010-01-21 19:12:09 1676288 ——w- c:\windows\system32\xpssvcs.dll
2010-01-21 19:12:08 0 dc—-w- C:\b1af1112ab6c4be191f5
2010-01-21 19:05:24 0 dc—-w- c:\docume~1\owner\applic~1\Windows Desktop Search
2010-01-21 19:04:41 0 dc—-w- c:\program files\Windows Desktop Search
2010-01-21 19:04:41 0 d—–w- c:\windows\system32\GroupPolicy
2010-01-21 19:03:56 98304 -c—-w- c:\windows\system32\dllcache\nlhtml.dll
2010-01-21 19:03:56 29696 -c—-w- c:\windows\system32\dllcache\mimefilt.dll
2010-01-21 19:03:56 192000 -c—-w- c:\windows\system32\dllcache\offfilt.dll
2010-01-21 19:03:08 0 dc—-w- c:\program files\Windows Media Connect 2
2010-01-21 19:01:00 0 d—–w- c:\windows\system32\LogFiles
2010-01-21 18:58:09 92160 -c—-w- c:\windows\system32\dllcache\iecompat.dll
2010-01-21 06:43:49 0 d—–w- c:\windows\ie8updates
2010-01-21 06:35:57 594432 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2010-01-21 06:35:57 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-01-21 06:35:56 246272 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2010-01-21 06:35:56 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2010-01-21 06:35:55 1985536 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2010-01-21 06:35:51 11070464 -c—-w- c:\windows\system32\dllcache\ieframe.dll
2010-01-21 04:13:41 0 dcsh–w- c:\documents and settings\owner\PrivacIE
2010-01-21 04:06:02 0 dcsh–w- c:\documents and settings\owner\IETldCache
2010-01-21 03:38:35 0 dc—-w- c:\program files\MSXML 4.0
2010-01-21 03:34:43 0 dc-h–w- c:\windows\ie8
2010-01-21 03:15:42 0 dc—-w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-01-21 02:50:39 81920 -c—-w- c:\windows\system32\dllcache\fontsub.dll
2010-01-21 02:50:39 119808 -c—-w- c:\windows\system32\dllcache\t2embed.dll
2010-01-21 02:32:30 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2010-01-21 01:37:08 153088 -c—-w- c:\windows\system32\dllcache\triedit.dll
2010-01-21 00:58:30 1315328 -c—-w- c:\windows\system32\dllcache\msoe.dll
2010-01-21 00:52:19 128512 -c—-w- c:\windows\system32\dllcache\dhtmled.ocx
2010-01-21 00:06:35 401408 -c—-w- c:\windows\system32\dllcache\rpcss.dll
2010-01-21 00:06:35 284160 -c—-w- c:\windows\system32\dllcache\pdh.dll
2010-01-21 00:06:35 110592 -c—-w- c:\windows\system32\dllcache\services.exe
2010-01-21 00:06:34 473600 -c—-w- c:\windows\system32\dllcache\fastprox.dll
2010-01-21 00:06:34 453120 -c—-w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-01-21 00:06:34 227840 -c—-w- c:\windows\system32\dllcache\wmiprvse.exe
2010-01-21 00:06:33 730112 -c—-w- c:\windows\system32\dllcache\lsasrv.dll
2010-01-21 00:06:33 714752 -c—-w- c:\windows\system32\dllcache\ntdll.dll
2010-01-21 00:06:33 617472 -c—-w- c:\windows\system32\dllcache\advapi32.dll
2010-01-21 00:06:32 2145280 -c—-w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-01-21 00:06:31 2189184 -c—-w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-01-21 00:06:30 2023936 -c—-w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-01-20 23:58:37 2560 ——w- c:\windows\system32\xpsp4res.dll
2010-01-20 23:58:36 215552 -c—-w- c:\windows\system32\dllcache\wordpad.exe
2010-01-20 23:58:36 1206508 -c—-w- c:\windows\system32\dllcache\sysmain.sdb
2010-01-20 23:54:44 333952 -c—-w- c:\windows\system32\dllcache\srv.sys
2010-01-20 23:49:43 455296 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys
2010-01-20 23:46:46 1172480 -c—-w- c:\windows\system32\dllcache\msxml3.dll
2010-01-20 23:45:01 337408 -c—-w- c:\windows\system32\dllcache\netapi32.dll
2010-01-20 23:43:51 331776 -c—-w- c:\windows\system32\dllcache\msadce.dll
2010-01-20 23:24:52 691712 -c—-w- c:\windows\system32\dllcache\inetcomm.dll
2010-01-20 23:20:28 272128 -c—-w- c:\windows\system32\dllcache\bthport.sys
2010-01-20 23:18:27 203136 -c—-w- c:\windows\system32\dllcache\rmcast.sys
2010-01-20 20:19:28 0 d—–w- c:\windows\system32\scripting
2010-01-20 20:19:26 0 d—–w- c:\windows\l2schemas
2010-01-20 20:19:25 0 d—–w- c:\windows\system32\en
2010-01-20 20:13:46 0 d—–w- c:\windows\network diagnostic
2010-01-20 19:59:59 403 -c—-w- c:\windows\system32\dllcache\npdrmv2.zip
2010-01-20 19:58:59 498742 -c—-w- c:\windows\system32\dllcache\dxmasf.dll
2010-01-20 03:11:42 0 d—–w- c:\windows\system32\wbem\AutoRecover
2010-01-20 02:53:29 0 d—–w- c:\windows\peernet
2010-01-20 02:53:27 0 d—–w- c:\windows\provisioning
2010-01-20 02:50:52 0 d—–w- c:\windows\ServicePackFiles
2010-01-20 02:42:50 0 d—–w- c:\windows\EHome
2010-01-20 02:07:20 21728 —-a-w- c:\windows\system32\wucltui.dll.mui
2010-01-20 02:07:20 17632 —-a-w- c:\windows\system32\wuaueng.dll.mui
2010-01-20 02:07:19 15072 —-a-w- c:\windows\system32\wuaucpl.cpl.mui
2010-01-20 02:07:18 15064 —-a-w- c:\windows\system32\wuapi.dll.mui
2010-01-20 02:07:18 0 d—–w- c:\windows\system32\SoftwareDistribution
2010-01-18 21:20:07 0 dc—-w- c:\docume~1\owner\applic~1\AT&T
2010-01-18 21:19:23 26760 —-a-r- c:\windows\system32\drivers\swmsflt.sys
2010-01-18 21:19:23 0 dc—-w- c:\docume~1\owner\applic~1\Sierra Wireless
2010-01-18 21:18:01 0 dc—-w- c:\program files\common files\Motorola Shared
2010-01-18 21:16:52 0 dc—-w- c:\program files\Sierra Wireless Inc
2010-01-18 21:16:52 0 dc—-w- c:\program files\AT&T
2010-01-18 21:16:52 0 dc—-w- c:\docume~1\alluse~1\applic~1\AT&T
2010-01-18 21:10:50 256 —-a-w- c:\windows\system32\pool.bin
2010-01-18 21:10:45 0 dc—-w- c:\docume~1\owner\applic~1\Research In Motion
2010-01-18 21:00:41 0 dc—-w- c:\program files\common files\Sonic Shared
2010-01-18 21:00:40 0 dc—-w- c:\program files\Roxio
2010-01-18 20:47:11 0 dc—-w- c:\program files\common files\Research In Motion
2010-01-18 20:47:04 0 dc—-w- c:\program files\Research In Motion
2010-01-18 20:41:55 0 d-sh–w- c:\windows\ftpcache
2010-01-18 05:03:58 98816 —-a-w- c:\windows\sed.exe
2010-01-18 05:03:58 77312 —-a-w- c:\windows\MBR.exe
2010-01-18 05:03:58 261632 —-a-w- c:\windows\PEV.exe
2010-01-18 05:03:58 161792 —-a-w- c:\windows\SWREG.exe
2010-01-17 01:29:39 12160 -c–a-w- c:\windows\system32\dllcache\mouhid.sys
2010-01-17 01:29:39 12160 —-a-w- c:\windows\system32\drivers\mouhid.sys
2010-01-17 01:29:36 10368 -c–a-w- c:\windows\system32\dllcache\hidusb.sys
2010-01-17 01:29:36 10368 —-a-w- c:\windows\system32\drivers\hidusb.sys
2010-01-08 19:28:58 277 —-a-w- c:\windows\wininit.ini
2010-01-06 01:03:45 0 dc—-w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy

==================== Find3M ====================

2009-12-21 19:14:05 916480 ——w- c:\windows\system32\wininet.dll

============= FINISH: 15:10:35.23 ===============

RPMcMurphy

Post #28January 24, 2010, 11:27 PM UTC

pamela4011,

Great work! Your logs look clean. Now we have some important housekeeping and cleanup to take care of:

🖼Click to load external image (Posted Image) Download TFC to your desktop

Close any open windows.
Double click the TFC icon to run the program
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

🖼Click to load external image (Posted Image) Uninstall ComboFix

Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens:
Combofix /Uninstall

🖼Click to load external image (Posted Image)

🖼Click to load external image (Posted Image) Now to remove most of the tools that we have used in fixing your machine:

Make sure you have an Internet Connection.
Download OTC to your desktop and run it
A list of tool components used in the cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
Click Yes to begin the cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.

🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:

Restart any anti-malware programs that we disabled while we were cleaning your machine.
Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
Consider using an alternate browser. Many experts feel that Firefox, Opera, or Google Chrome are safer than Internet Explorer.
Consider running in a limited user account. See this post for more information.
Please carefully review the information in our Security - Best Practices and Prevention forum located HERE

Please post once more so I know you are all set and I can close this thread. Good luck and stay safe! Thank you for your patience.

pamela4011

Post #29January 25, 2010, 6:18 AM UTC

ok, computer seems to be running fine, not freezing up now. Did as instructed for cleanup. Thank you so much for all your help and recommendations, Pamela

RPMcMurphy

Post #30January 25, 2010, 6:26 AM UTC

You are most welcome. Thanks again for your patience.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] BDS/Ruledor.J.1 virus

✨ Ask AI

Ask AI