What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] MBAM detected & removed Trojans NIS 2010 missed; still

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46

Well lets not jump to conclusions just yet as those infections may be backups of what we already removed.

True. I was just quoting ESET's status window. The bulk of these detects seemed to occur while it was digging through my archived email.
Post #47

Post the ESET log and a new HJT log

Here are the new logs:

ESET:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=855cae07cd87af4e99396f76df3bb0cc
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-02-05 05:09:02
# local_time=2010-02-05 12:09:02 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=256 16777215 100 0 59823990 59823990 0 0
# compatibility_mode=512 16777215 100 0 52287384 52287384 0 0
# compatibility_mode=768 16777215 100 0 40588270 40588270 0 0
# compatibility_mode=2304 16777215 100 0 0 0 0 0
# compatibility_mode=3328 16777175 100 0 50479936 50479936 0 0
# compatibility_mode=3584 16777175 100 0 0 0 0 0
# compatibility_mode=4864 16777215 100 0 6027766 6027766 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# compatibility_mode=9217 16777214 0 9 6124876 32639975 0 0
# scanned=520748
# found=68
# cleaned=38
# scan_time=55133
C:\Documents and Settings\Roland\Application Data\Thunderbird\Profiles\78g69to9.default\Mail\pop.gmx-17.net\Inbox HTML/Phishing.gen trojan (contained infected files) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\!!! infected !!!.dbx multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\2003-07.dbx Win32/Sobig.E worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\2003-09.dbx Win32/Swen.A worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\2003-10.dbx Win32/Klez.J worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\2003-11.dbx Win32/Swen.A worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\2004-04.dbx probably a variant of Win32/Agent trojan (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\2004-05.dbx multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\2004-06.dbx Win32/Netsky.Q worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\2004-08.dbx Win32/Netsky.Q worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\2004-09.dbx Win32/Netsky.Q worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\2005-09.dbx Win32/Surila.X trojan (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\2005-10.dbx Win32/Sober.R worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\2005-11.dbx multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\2005-12.dbx Win32/Sober.Y worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\xxxx_Archive.dbx Win32/Mimail.A worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\CA Anti-Spam (1).dbx a variant of Win32/Kryptik.CEM trojan (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\xxxx.bak multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\xxxx.dbx multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\old_phish.dbx multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\xxxxxxxxxxx_Feedback.dbx Win32/Bagle.drp.gen worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\Sent_Items_2005.dbx multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\Sent_Items_2006.dbx multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\Sent_Items_2008.dbx multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\Spam_2004.dbx Win32/Bagle.AB worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\Spam_2007.dbx multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\Spam_2008.dbx multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\Spam_2009.dbx multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\Translation_Inbox.dbx Win32/Netsky.Q worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\_eMail_personal_.dbx Win32/Bagle.gen.zip worm (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Identities\{C5E7AA2A-2D5A-4CF5-998D-C45D599CDEC4}\Microsoft\Outlook Express\___suspicious___.dbx multiple threats (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\00990124-0000000C.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\030A301C-0000001E.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\09027BB9-00000036.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\097537E6-00000062.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\0FC90E12-00000054.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\127E0035-0000005B.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\1A495F32-00000025.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\26CA3699-00000035.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\305E440D-0000000D.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\32E6401D-0000004D.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\3807773B-0000006E.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\3BF63A9E-00000026.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\3CD513E9-0000003B.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\3D6C2CD6-00000003.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\40805DB2-0000003C.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\482318BE-00000001.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\57D3458F-00000061.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\58786B36-00000023.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\5CFD3E12-00000024.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\5D037A5A-00000015.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\5F1E2833-00000055.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\5FA42059-0000005A.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\61726B72-0000004C.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\66D86C10-0000018C.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\67844AE1-00000002.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\Local Settings\Application Data\Microsoft\Windows Live Mail\Gmx (Bodaci a54\Junk E-mail\767D4509-00000016.eml HTML/Phishing.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\My Documents\Stuff to be sorted\Employers\xxxx\1st Time\MyFiles\suspect\Full_fel.exe Win32/Joke.ScreenMate application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Documents and Settings\Roland\My Documents\Stuff to be sorted\From_FileServer\Documents\Roland\xxxx\MyFiles\suspect\Full_fel.exe Win32/Joke.ScreenMate application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\Program Files\ACD Systems\ACDSee\5.0\patch.exe a variant of Win32/Tool.TPE.A application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
I:\From Backups\Documents\Roland\xxxx\MyFiles\suspect\Full_fel.exe Win32/Joke.ScreenMate application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
I:\From Backups\KEEP\Txt\Jobs\xxxx\MyFiles\suspect\Full_fel.exe Win32/Joke.ScreenMate application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
I:\Install\CAT_Tools\IntelliWebSearch\IWS3install.exe probably a variant of Win32/Agent trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
I:\Install\CD\Nero-6.6.1.15a.exe Win32/Toolbar.AskSBar application (deleted - quarantined) 00000000000000000000000000000000 C
I:\Install\Firewalls\ZoneAlarm\zlsSetup_70_462_000_en.exe a variant of Win32/AdInstaller application (deleted - quarantined) 00000000000000000000000000000000 C
I:\Install\Firewalls\ZoneAlarm\zlsSetup_70_470_000_en.exe a variant of Win32/AdInstaller application (deleted - quarantined) 00000000000000000000000000000000 C
I:\Install\Firewalls\ZoneAlarm\zlsSetup_70_483_000_en.exe a variant of Win32/AdInstaller application (deleted - quarantined) 00000000000000000000000000000000 C
I:\Install\Viewers\ACDSee\ACDSee_5.0_PowerPack_Trial.zip a variant of Win32/Tool.TPE.A application (deleted - quarantined) 00000000000000000000000000000000 C


HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:56:12 AM, on 2/5/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Acer\Empowering Technology\admServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\Program Files\OpenDNS Updater\OpenDNS Updater.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\HDTUNE~1\HDTune.exe
C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.33\QOELoader.exe
C:\Program Files\Norton Ghost\Agent\VProTray.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Privoxy\privoxy.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
c:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wunderground.com/cgi-bin/findwe…orecast?addfav=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshiba.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8118;https=127.0.0.1:8118
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\IPSBHO.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HD Tune] C:\PROGRA~1\HDTUNE~1\HDTune.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.33\QOELoader.exe"
O4 - HKLM\..\Run: [Norton Ghost 12.0] "C:\Program Files\Norton Ghost\Agent\VProTray.exe"
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [NortonUtilities] C:\Program Files\Norton Utilities 14\nu.exe /H
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: Miranda IM.lnk = C:\Program Files\Miranda IM\miranda32.exe
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Global Startup: Perstray.lnk = C:\Program Files\PerSono\PersTray.exe
O4 - Global Startup: Privoxy.lnk = C:\Program Files\Privoxy\privoxy.exe
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute Lite Edition\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute Lite Edition\vrie.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} -
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as…abs/tgctlsr.cab
O16 - DPF: {5727FF4C-EF4E-4d96-A96C-03AD91910448} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_ind.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1161283260468
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161283404265
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion…canner37380.cab
O16 - DPF: {9E214F45-89C2-4DE3-94A9-530EB1D05F7E} - http://www.quest3d.com/Quest3D_WebInstall.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/67/install/gtdownls.cab
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.6.0_01) -
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.6.0_02) -
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: Google Update Service (gupdate1c9f76546783d54) (gupdate1c9f76546783d54) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: OpenDNS Updater (OpenDNS Updater.exe) - OpenDNS - C:\Program Files\OpenDNS Updater\OpenDNS Updater.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel® PROSet/Wireless WiFi Service (S24EventMonitor) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe

–
End of file - 14040 bytes

Post #48
It looks like the only things that ESET did not remove where from Outlook Express Mail, I think what I would do is bite the bullet and delete all the mail from your sent, inbox mail and any other folders that you may have created to save mail How are things running now ?
Post #49

It looks like the only things that ESET did not remove where from Outlook Express Mail, I think what I would do is bite the bullet and delete all the mail from your sent, inbox mail and any other folders that you may have created to save mail

I'd be more inclined to migrate to Windows Live Mail, given that Outlook Express is not going to be an option any more once I migrate to a new laptop down the line.
Since Windows Live Mail stores each and every email in a separate file, a scan would then also be able to detect AND delete the infected attachments.

How are things running now ?

Pretty much like before. Booting is still slow. Other than that, I didn't experience any symptoms.
Oh, and ever since we ran ATF Cleaner, IE8 seems to be a lot faster.
What's bothering me, though, is that IE8 did itself not cooperate when we tried to install the ESET ActiveX control.
I had to use the IE Tab add-on in Firefox to do that.
Also, given the fact that ESET found several items that NIS 2010 missed, would you recommend to switch to ESET instead?
Another thing on my mind is that we were not able to run some of the rootkit detectors/eliminators.
Is this normal, or should we investigate this further?
I just would like to be reasonably sure that the rootkit you identified has been completely disabled/removed and that there's no other surprise left on the system.
Thanks, Ken, for all your help and patience,
Roland
Post #50
Lets do this, did some further investagations


Backup Your Registry with ERUNT:
  • Download erunt.zip to your Desktop from here:
    http://aumha.org/downloads/erunt.zip
  • Right-click erunt.zip, select Extract All… and follow the prompts to extract ERUNT to a new folder on your Desktop
  • Inside the new folder, double-click ERUNT.exe to start the program
  • OK all the prompts to back up your registry to the default location.
Note: to restore your registry, go to the backup folder and start ERDNT.exe




Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above Killall::


KILLALL::

Driver::
PsSdk30

File::
c:\windows\system32\166.tmp

Rootkit::
c:\windows\system32\Drivers\PsSdk30.drv

Registry::
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"=-

[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PsSdk30]

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
Post #51 last edited

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

ComboFix still believes that F-Prot AntiVirus is running, even though I uninstalled F-Prot months ago.
It then also told me that there was a newer version of ComboFix available so I let it update itself.
From there ComboFix went on to restart itself.
It is now performing a scan, presently at Stage_4

What I am not clear about, though, is whether or not the self-restarted ComboFix is still aware of the CFScript that was dropped on its older version.

Edit 02/05/2010 1:39 pm - System is rebooting. Somewhere around Stage_40, a standard Windows popup error screen was displayed indicating

PEV.exe has encountered a problem and needs to close
We are sorry for the inconvenience

After the reboot, ComboFix reported something along the lines of

Could not find driver ComboFix.sys

Sorry, the message disappeared before I could properly jot it down.
ComboFix has not yet finished.
Post #53

post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Is there reason to be concerned that PEV.exe (presumably part of ComboFix) crashed while CF was running?
Should I rerun CF in Safe Mode?

Here are the requested logs.

ComboFix:

ComboFix 10-02-05.01 - Roland 02/05/2010 13:23:28.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3062.2259 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Roland\Desktop\CFScript
AV: F-PROT Antivirus for Windows *On-access scanning enabled* (Updated) {3F8BAFFE-D251-4DC6-ACF9-81FDF61FB9C9}
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

FILE ::
"c:\windows\system32\166.tmp"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

J:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_PSSDK30
——-\Legacy_uacFlt
——-\Service_uacFlt


((((((((((((((((((((((((( Files Created from 2010-01-05 to 2010-02-05 )))))))))))))))))))))))))))))))
.

2010-02-04 13:44 . 2010-02-04 13:44 ——– d—–w- c:\program files\ESET
2010-01-31 14:07 . 2010-01-31 14:07 ——– d—–w- C:\rsit
2010-01-29 02:32 . 2010-01-29 03:48 ——– d—–w- C:\Rooter$
2010-01-29 01:54 . 2010-01-29 01:54 ——– d—–w- c:\program files\Sophos
2010-01-28 20:29 . 2010-01-28 20:59 ——– d—–w- c:\program files\Norton Utilities 14
2010-01-26 20:46 . 2010-01-26 20:49 ——– d—–w- c:\program files\ERUNT
2010-01-20 22:27 . 2004-08-04 09:00 14848 —-a-w- c:\windows\system32\drivers\kbdhid.sys
2010-01-20 22:27 . 2004-08-04 09:00 14848 —-a-w- c:\windows\system32\dllcache\kbdhid.sys
2010-01-20 18:26 . 2010-01-20 18:26 ——– d—–w- c:\documents and settings\Roland\Application Data\Malwarebytes
2010-01-20 18:26 . 2010-01-07 21:07 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-20 18:26 . 2010-01-20 18:26 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-01-20 18:26 . 2010-01-07 21:07 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-20 18:26 . 2010-01-20 18:26 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-01-20 04:08 . 2010-01-20 04:08 ——– d—–w- c:\program files\VS Revo Group
2010-01-13 22:21 . 2010-01-13 22:21 229224 —-a-w- c:\windows\system32\drivers\VMM.sys
2010-01-13 07:38 . 2009-11-21 15:51 471552 ——w- c:\windows\system32\dllcache\aclayers.dll
2010-01-12 15:48 . 2010-01-12 15:48 ——– d—–w- c:\documents and settings\Roland\Local Settings\Application Data\Microsoft Corporation
2010-01-12 15:46 . 2010-01-12 15:46 ——– d—–w- c:\program files\Microsoft Windows 7 Upgrade Advisor
2010-01-12 15:12 . 2010-01-12 15:13 ——– d—–w- c:\program files\Microsoft Virtual PC
2010-01-09 17:57 . 2010-01-09 17:57 ——– d—–w- c:\documents and settings\Roland\Application Data\TVU Networks

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-05 18:48 . 2008-03-02 21:18 ——– d—–w- c:\documents and settings\Roland\Application Data\Skype
2010-02-05 18:46 . 2008-03-03 19:13 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-05 13:55 . 2004-12-10 21:56 2048 —-a-w- c:\windows\PC-BIB.DAT
2010-02-05 13:53 . 2008-06-10 16:21 55 —h–w- c:\windows\system32\t3zroland.sys
2010-02-04 12:55 . 2008-03-03 11:37 ——– d—–w- c:\program files\Google
2010-01-29 20:39 . 2008-06-19 12:56 ——– d—–w- c:\documents and settings\Roland\Application Data\The Bat!
2010-01-29 20:36 . 2008-06-19 12:45 ——– d—–w- c:\program files\The Bat!
2010-01-29 18:12 . 2008-03-03 11:50 ——– d—–w- c:\program files\PerSono
2010-01-27 03:49 . 2008-03-03 11:19 ——– d—–w- c:\program files\Common Files\Java
2010-01-27 02:47 . 2008-03-03 11:40 ——– d—–w- c:\program files\Java
2010-01-23 21:45 . 2008-12-08 15:54 ——– d—–w- c:\program files\Citrix
2010-01-23 21:41 . 2008-03-02 20:29 ——– d—–w- c:\documents and settings\All Users\Application Data\Viewpoint
2010-01-23 12:03 . 2008-03-03 12:04 ——– d—–w- c:\program files\Thoosje Sidebar V2.3
2010-01-23 11:46 . 2008-03-03 11:55 ——– d—–w- c:\program files\ScanSoft
2010-01-23 11:46 . 2008-03-02 20:19 ——– d—–w- c:\documents and settings\All Users\Application Data\ScanSoft
2010-01-23 11:46 . 2008-03-02 21:18 ——– d—–w- c:\documents and settings\Roland\Application Data\ScanSoft
2010-01-20 05:05 . 2010-01-05 19:49 ——– d—–w- c:\program files\Canon
2010-01-20 04:26 . 2008-03-02 20:31 ——– d—–w- c:\documents and settings\Roland\Application Data\Desktop Sidebar
2010-01-17 15:24 . 2009-09-18 14:08 ——– d—–w- c:\documents and settings\Roland\Application Data\U3
2010-01-14 16:53 . 2005-01-17 05:14 ——– d—–w- c:\program files\Common Files\Adobe
2010-01-07 22:12 . 2008-03-03 11:49 ——– d—–w- c:\program files\OE-QuoteFix
2010-01-05 19:49 . 2010-01-05 19:46 ——– d—–w- c:\program files\Common Files\Canon
2010-01-03 22:13 . 2010-01-01 00:30 ——– d—–w- c:\program files\Common Files\ArcSoft
2010-01-03 22:10 . 2005-01-17 05:08 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-01-01 19:12 . 2010-01-01 00:27 ——– d—–w- c:\documents and settings\Roland\Application Data\ArcSoft
2010-01-01 19:06 . 2010-01-01 00:35 ——– d—–w- c:\documents and settings\All Users\Application Data\ArcSoft
2010-01-01 00:27 . 2005-01-17 05:07 ——– d—–w- c:\program files\Common Files\InstallShield
2009-12-24 23:44 . 2008-03-03 12:07 ——– d—–w- c:\program files\Winamp
2009-12-24 23:43 . 2009-12-24 23:43 ——– d—–w- c:\program files\Winamp Detect
2009-12-23 03:37 . 2008-11-23 16:51 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-12-23 01:32 . 2009-12-23 01:32 ——– d—–w- c:\documents and settings\All Users\Application Data\ATRIL
2009-12-21 19:14 . 2004-08-04 09:00 916480 ——w- c:\windows\system32\wininet.dll
2009-12-17 22:14 . 2008-12-12 04:45 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-12-12 17:22 . 2008-03-03 11:38 ——– d—–w- c:\program files\HD Tune
2009-12-12 03:11 . 2009-12-12 03:11 ——– d—–w- c:\program files\ConvertHelper
2009-12-11 01:42 . 2009-12-11 01:42 ——– d—–w- c:\documents and settings\Roland\Application Data\Symantec
2009-12-11 01:34 . 2009-12-11 00:52 ——– d—–w- c:\program files\Norton Ghost
2009-12-11 01:06 . 2008-03-02 20:29 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2009-12-11 00:49 . 2009-11-15 23:30 ——– d—–w- c:\program files\Symantec
2009-12-11 00:49 . 2008-03-03 11:22 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-11-21 15:51 . 2004-08-04 09:00 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-15 23:30 . 2009-11-15 23:30 60808 —-a-w- c:\windows\system32\S32EVNT1.DLL
2009-11-15 23:30 . 2009-11-15 23:30 124976 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-11-13 21:43 . 2008-08-27 11:37 2983579 —-a-w- c:\windows\Internet Logs\tvDebug.Zip
2007-11-01 17:35 . 2007-11-01 17:35 2293712 —-a-w- c:\program files\FLV PlayerFCSetup.exe
2009-09-25 16:41 . 2009-09-25 16:41 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2008-02-28 18:30 . 2007-04-14 13:58 8784 —-a-w- c:\program files\mozilla firefox\plugins\ractrlkeyhook.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2008-02-28 18:33 . 2007-04-14 13:58 245408 —-a-w- c:\program files\mozilla firefox\plugins\unicows.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"NortonUtilities"="c:\program files\Norton Utilities 14\nu.exe" [2010-01-28 4105576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-07-20 729177]
"HD Tune"="c:\progra~1\HDTUNE~1\HDTune.exe" [2008-02-09 401408]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-02-28 63048]
"IntelZeroConfig"="c:\program files\Intel\WiFi\bin\ZCfgSvc.exe" [2008-10-16 1368064]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2008-10-16 1191936]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"QOELOADER"="c:\program files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.33\QOELoader.exe" [2009-11-16 14088]
"Norton Ghost 12.0"="c:\program files\Norton Ghost\Agent\VProTray.exe" [2008-11-12 2037096]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2005-12-13 344064]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\Roland\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
Miranda IM.lnk - c:\program files\Miranda IM\miranda32.exe [2010-1-28 696928]
Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2009-8-21 900816]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Perstray.lnk - c:\program files\PerSono\PersTray.exe [2007-7-9 32768]
Privoxy.lnk - c:\program files\Privoxy\privoxy.exe [2009-10-10 325632]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"HideClock"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Qualcomm\Eudora\EuShlExt.dll" [2005-06-07 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-05-28 16:32 87352 —-a-w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck PDBoot.exe\0autocheck autochk *\0autocheck lsdelete

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^eFax 4.3.lnk]
backup=c:\windows\pss\eFax 4.3.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NCProTray.lnk]
backup=c:\windows\pss\NCProTray.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Perstray.lnk]
backup=c:\windows\pss\Perstray.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SDL Trados 2007 Speed Launcher.lnk]
backup=c:\windows\pss\SDL Trados 2007 Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Roland^Start Menu^Programs^Startup^eFax 4.4.lnk]
backup=c:\windows\pss\eFax 4.4.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchApp]
Alaunch [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acer ePower Management]
2005-11-18 20:06 3079680 —-a-w- c:\acer\Empowering Technology\ePower\Acer ePower Management.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
2004-12-14 06:12 483328 —-a-w- c:\program files\Adobe\Acrobat 7.0\Distillr\acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ADMTray.exe]
2005-10-24 20:45 2462208 —-a-w- c:\acer\Empowering Technology\admtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-12-11 20:57 948672 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-12-22 06:57 35760 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2005-05-03 22:43 69632 —-a-w- c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrMfcWnd]
2007-03-23 18:14 663552 ——w- c:\program files\Brother\Brmfcmon\BrMfcWnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cctray]
2009-11-16 05:00 181488 —-a-w- c:\program files\CA\CA Internet Security Suite\cctray\cctray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter2.0]
2007-01-26 20:58 65536 —-a-w- c:\program files\Brother\ControlCenter2\BrCtrCen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter3]
2007-12-21 05:57 86016 ——w- c:\program files\Brother\ControlCenter3\BrCtrCen.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyLinkAdvisor]
2007-03-15 22:16 454784 —-a-w- c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDataSecurity Loader]
2005-10-19 13:30 69632 —-a-w- c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eFax 4.3]
2007-03-06 17:21 116224 —-a-w- c:\program files\eFax Messenger 4.3\J2GDllCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eFax 4.4]
2008-10-07 20:25 95744 —-a-w- c:\program files\eFax Messenger 4.4\J2GDllCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ePower_DMC]
2005-12-13 21:08 344064 —-a-w- c:\acer\Empowering Technology\ePower\ePower_DMC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-02-15 16:46 159744 —-a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-02-15 16:46 135168 —-a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2004-08-04 09:00 208952 —-a-w- c:\windows\ime\imjp8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
2007-01-30 02:10 46632 —-a-w- c:\program files\ScanSoft\PaperPort\IndexSearch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-10-29 00:21 141600 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LManager]
2005-11-24 16:45 589824 —-a-w- c:\progra~1\LAUNCH~1\LManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]
2010-01-07 21:07 429392 —-a-w- c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MaxMenuMgr]
2009-01-16 20:31 181544 —-a-w- c:\program files\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
2004-08-04 09:00 59392 —-a-w- c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2006-01-12 20:40 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpScheduler]
2004-03-09 01:36 114688 —-a-w- c:\program files\ScanSoft\OmniPagePro14.0\OpScheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Opware14]
2004-03-09 01:33 57344 —-a-w- c:\program files\ScanSoft\OmniPagePro14.0\opware14.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
2007-01-30 02:12 30248 —-a-w- c:\program files\ScanSoft\PaperPort\pptd40nt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Pitstop Optimize Scheduler]
2007-10-26 20:53 2577120 —-a-w- c:\program files\PCPitstop\Optimize\PCPOptimize.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-02-15 16:46 131072 —-a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2004-08-04 09:00 455168 —-a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2004-08-04 09:00 455168 —-a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPort11reminder]
2007-02-01 18:46 255528 —-a-w- c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 05:54 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-03 00:24 32768 —-a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2005-11-17 15:27 15600128 —-a-w- c:\windows\RTHDCPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 14:03 210472 —-a-w- c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-07-04 02:58 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TheLaptopLock]
2007-02-01 22:46 397312 —-a-w- c:\program files\The LaptopLock\LaptopLock.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2009-09-28 15:31 198160 —-a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WorkFlowTray]
2004-06-29 21:56 155748 —-a-w- c:\program files\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Miranda IM\\miranda32.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1105000.07F\symds.sys [1/21/2010 8:29 PM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1105000.07F\symefa.sys [1/21/2010 8:29 PM 172592]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\BASHDefs\20100130.002\BHDrvx86.sys [2/2/2010 5:35 PM 529456]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1105000.07F\cchpx86.sys [1/21/2010 8:29 PM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1105000.07F\ironx86.sys [1/21/2010 8:29 PM 116272]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [9/25/2009 11:32 PM 189736]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [2/28/2008 2:31 PM 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [9/30/2007 11:23 AM 45848]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.5.0.127\ccsvchst.exe [1/21/2010 8:29 PM 126392]
R2 OpenDNS Updater.exe;OpenDNS Updater;c:\program files\OpenDNS Updater\OpenDNS Updater.exe –run –> c:\program files\OpenDNS Updater\OpenDNS Updater.exe –run [?]
R3 dfmirage;dfmirage;c:\windows\system32\drivers\dfmirage.sys [11/25/2005 4:43 PM 31896]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [11/15/2009 10:00 PM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\Definitions\IPSDefs\20100128.002\IDSXpx86.sys [1/29/2010 6:05 PM 329592]
R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [6/17/2009 7:20 AM 12648]
S2 gupdate1c9f76546783d54;Google Update Service (gupdate1c9f76546783d54);c:\program files\Google\Update\GoogleUpdate.exe [6/27/2009 3:24 PM 133104]
S3 HWACCESS;HWACCESS;c:\windows\system32\HWACCESS.SYS [12/4/2006 4:47 PM 6808]
S3 LLUSBFLT;LLUSBFLT;c:\windows\system32\drivers\llusbflt.sys [5/3/2006 9:19 AM 4736]
S3 MEMSWEEP2;MEMSWEEP2; [x]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [11/6/2007 3:22 PM 34064]
S3 PLUsbbc2;High-Speed USB Bridge Cable Driver;c:\windows\system32\drivers\usbbc2.sys [5/3/2006 9:19 AM 8960]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
.
Contents of the 'Scheduled Tasks' folder

2010-01-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:34]

2010-02-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-27 20:24]

2010-02-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-27 20:24]

2010-01-23 c:\windows\Tasks\Norton Internet Security - Roland - Full System Scan.job
- c:\program files\Norton Internet Security\Engine\17.5.0.127\navw32.exe [2010-01-22 06:08]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.wunderground.com/cgi-bin/findweather/getForecast?addfav=
uInternet Connection Wizard,ShellNext = hxxp://www.toshiba.com/
uInternet Settings,ProxyServer = http=127.0.0.1:8118;https=127.0.0.1:8118
uInternet Settings,ProxyOverride = *.local;
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - hxxp://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37380.cab
DPF: {9E214F45-89C2-4DE3-94A9-530EB1D05F7E} - hxxp://www.quest3d.com/Quest3D_WebInstall.cab
FF - ProfilePath - c:\documents and settings\Roland\Application Data\Mozilla\Firefox\Profiles\zsoc8zgr.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:blank
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 8118
FF - prefs.js: network.proxy.socks - localhost
FF - prefs.js: network.proxy.socks_port - 9050
FF - prefs.js: network.proxy.ssl - localhost
FF - prefs.js: network.proxy.ssl_port - 8118
FF - prefs.js: network.proxy.type - 1
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.0.0.136\IPSFFPlgn\components\IPSFFPl.dll
FF - component: c:\documents and settings\Roland\Application Data\Mozilla\Firefox\Profiles\zsoc8zgr.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - component: c:\documents and settings\Roland\Application Data\Mozilla\Firefox\Profiles\zsoc8zgr.default\extensions\[removed]\components\nsTwitterFoxSign.dll
FF - plugin: c:\documents and settings\Roland\Application Data\Mozilla\Firefox\Profiles\zsoc8zgr.default\extensions\[removed]\plugins\npTVUAx.dll
FF - plugin: c:\documents and settings\Roland\Application Data\Mozilla\Firefox\Profiles\zsoc8zgr.default\extensions\[removed]\plugins\npCoralIETab.dll
FF - plugin: c:\documents and settings\Roland\Application Data\Mozilla\Firefox\Profiles\zsoc8zgr.default\extensions\[removed]\plugins\npRACtrl.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npRACtrl.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)
MSConfigStartUp-IntelliWebSearch - c:\program files\IntelliWebSearch\IntelliWebSearch.exe
MSConfigStartUp-YouSendIt - c:\program files\YouSendIt\Express\YouSendIt.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-05 13:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.5.0.127\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{3B6C15BE-F9FD-7E15-F865-ABA8E2A09915}]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{53DD8041-88D3-4E6A-8D6D-87521E47D41A}]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{72CD75CB-6227-4A2A-937F-2B21E33A740E}]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E3F11959-8714-D3CF-54BE-D0F537A9C25C}]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Easy Systems Japan Ltd.\Setting]
@DACL=(02 0000)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1244)
c:\windows\system32\LMIinit.dll

- - - - - - - > 'explorer.exe'(4484)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\acer\Empowering Technology\ePower\SysHook.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\program files\Microsoft Virtual PC\VPCShExH.DLL
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\LMIRfsClientNP.dll
c:\windows\system32\netprovcredman.dll
.
———————— Other Running Processes ————————
.
c:\program files\Intel\WiFi\bin\S24EvMon.exe
c:\windows\system32\brss01a.exe
c:\windows\system32\msdtc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\acer\Empowering Technology\admServ.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\dllhost.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Norton Ghost\Agent\VProSvc.exe
c:\program files\OpenDNS Updater\OpenDNS Updater.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
c:\windows\System32\vssvc.exe
c:\windows\system32\fxssvc.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-02-05 14:02:17 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-05 19:01
ComboFix2.txt 2010-01-29 16:10

Pre-Run: 35,626,951,168 bytes free
Post-Run: 35,585,603,584 bytes free

- - End Of File - - 158A5691808B54427C0569081E8A3EB3


HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:08:31 PM, on 2/5/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Acer\Empowering Technology\admServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
C:\Program Files\Norton Ghost\Agent\VProSvc.exe
C:\Program Files\OpenDNS Updater\OpenDNS Updater.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\HDTUNE~1\HDTune.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe
C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.33\QOELoader.exe
C:\Program Files\Norton Ghost\Agent\VProTray.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Norton Utilities 14\nu.exe
C:\Program Files\PerSono\PersTray.exe
C:\Program Files\Privoxy\privoxy.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\Miranda IM\miranda32.exe
C:\Program Files\Secunia\PSI\psi.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wunderground.com/cgi-bin/findwe…orecast?addfav=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshiba.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:8118;https=127.0.0.1:8118
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\IPSBHO.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HD Tune] C:\PROGRA~1\HDTUNE~1\HDTune.exe
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.33\QOELoader.exe"
O4 - HKLM\..\Run: [Norton Ghost 12.0] "C:\Program Files\Norton Ghost\Agent\VProTray.exe"
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [NortonUtilities] C:\Program Files\Norton Utilities 14\nu.exe /H
O4 - HKUS\S-1-5-21-576473586-1925554329-64292164-500\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup (User 'Administrator')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O4 - Startup: Miranda IM.lnk = C:\Program Files\Miranda IM\miranda32.exe
O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
O4 - Global Startup: Perstray.lnk = C:\Program Files\PerSono\PersTray.exe
O4 - Global Startup: Privoxy.lnk = C:\Program Files\Privoxy\privoxy.exe
O9 - Extra button: Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute Lite Edition\vrie.dll
O9 - Extra 'Tools' menuitem: VisualRoute Trace - {04849C74-016E-4a43-8AA5-1F01DE57F4A1} - C:\Program Files\VisualRoute Lite Edition\vrie.dll
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} -
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/as…abs/tgctlsr.cab
O16 - DPF: {5727FF4C-EF4E-4d96-A96C-03AD91910448} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_ind.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1161283260468
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1161283404265
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotion…canner37380.cab
O16 - DPF: {9E214F45-89C2-4DE3-94A9-530EB1D05F7E} - http://www.quest3d.com/Quest3D_WebInstall.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/67/install/gtdownls.cab
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.6.0_01) -
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.6.0_02) -
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - Unknown owner - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
O23 - Service: Google Update Service (gupdate1c9f76546783d54) (gupdate1c9f76546783d54) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: OpenDNS Updater (OpenDNS Updater.exe) - OpenDNS - C:\Program Files\OpenDNS Updater\OpenDNS Updater.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel® Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Intel® PROSet/Wireless WiFi Service (S24EventMonitor) - Intel® Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc - C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe

–
End of file - 14219 bytes

Post #55 last edited
Well, those instructions require editing the registry, if you remove the wrong entry you can disable your system. I do not see any entries related to F-Prot on any of your logs. I think what I would do is a search like you did for an F-Prot forum and see if you can get one of the helpers on the forum to assist you. Usually when a program like your Anti virus runs it will show up on a HJT log under the 023 entries which are running services and F-Prot is not listed. This is something you will have to resolve with F-Prot as we just do malware removal on this forum


You also have Norton and CA Internet Security Suite installed, you need to remove one of these as more than one AV is overkill and will hamper system performance.


Lets update your Java to make your system more secure

Go to your Control Panel and click on the Java Icon ( looks like a little coffee cup ) click on About and you should have Version 6 Update 18, if not proceed with the instructions.

Download the latest version Here save it, do not install it yet.

Java SE Runtime Environment (JRE)JRE 6 Update 18 <–The wording is confusing but this is what you need

  • Go to your Add Remove Programs in the Control Panel and uninstall any previous versions of Java
  • Reboot your computer
  • Install the latest version
You can verify the installation Here


Everything else looks fine malwarewise :thumbup:
Post #56

Well, those instructions require editing the registry, if you remove the wrong entry you can disable your system.

Done. Some of the entries in the registry were still around, even though all the files, except for empty directories, were already gone.

I think what I would do is a search like you did for an F-Prot forum and see if you can get one of the helpers on the forum to assist you.

Will do, if that behavior persists.

Was wondering what you think of running CF one more time now that I removed those registry entries. Then we would see if CF still reports on F-Prot allegedly running or not. Or do you know what CF does base its warning on?

You also have Norton and CA Internet Security Suite installed, you need to remove one of these as more than one AV is overkill and will hamper system performance.

I have all components of Norton Internet Security running, except of its AntiSpam component.

Of the CA Internet Security Suite, I only installed its AntiSpam component, since it is far superior to that of NIS.

Hence, there is only one AV running.

Lets update your Java to make your system more secure

My Java already is at the most recent version (Version 6 Update 18).

How can I get rid of the old plugins?

Everything else looks fine malwarewise :thumbup:

Thanks. I am still quite worried about the PEV.EXE crash, though, given that it makes me think that part of CF might not have been able to finish running (based on the fact that various web resources indicate that PEV.EXE is a part of CF).
Post #57
Hi,

Was wondering what you think of running CF one more time now that I removed those registry entries. Then we would see if CF still reports on F-Prot allegedly running or not. Or do you know what CF does base its warning on? Not a good idea, CF is a very powerful malware removal tool and its not used for diagnostics.

Go to Start > Run and type in services.msc and hit enter , when it opens see if F-Prot is still listed, let me know and we can remove it



How can I get rid of the old plugins?
You can uninstall all of them except Version 6 Update 18 via Add Remove Programs in the Control Panel
Post #58 last edited

Go to Start > Run and type in services.msc and hit enter , when it opens see if F-Prot is still listed, let me know and we can remove it

Doesn't show up there.

How can I get rid of the old plugins?
You can uninstall all of them except Version 6 Update 18 via Add Remove Programs in the Control Panel

Version 6 Update 18 is the only one listed under Add/Remove Programs.
However, the HJT log included

O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.6.0_01) -
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.6.0_02) -

Post #59
Great, looks like F-Prot is gone. After you removed all the earlier versions of Java, reboot, run HJT and if these are present just have HJT remove them, these are just cab files that may still be present

O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.5.0_11) -
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.6.0_01) -
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.6.0_02) -
Post #60

Great, looks like F-Prot is gone. After you removed all the earlier versions of Java, reboot, run HJT and if these are present just have HJT remove them, these are just cab files that may still be present

Done. :thumbup:

BTW, I started various programs one by one and ended them to determine which one might be causing the crf*.tmp files that NIS2010 is flagging as suspicious activity and is automatically deleting.

As it turns out, those are generated once I start my Langenscheidt e-dictionaries, the very same app for which one of the dictionaries also requires the dreaded StarForce copy protection.

Unfortunately I haven't found a way, yet, to tell NIS to ignore those files if they are generated by this app. As a result, ever since I started using NIS, I have to insert the original CD as proof of ownership, whereas otherwise (if said files were not automatically deleted), it would only ask for the CD every once in a blue moon.

But that's something to figure out in a different forum and not in Malware Removal.

Thanks for all your help :notworthy:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI