What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] ZIP files locked by explorer.exe

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi,

let's use a different tool,

Please do the following:


Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #17
I downloaded the file, and when I try to run it, I get this:

[external image: Posted Image]

and then the combofix.exe locks up and has to be ended via the task manager.
Post #18 last edited
OK

Please delete the copy you have from your desktop, make sure your antivirus is disabled for the download, download a fresh copy.

try renaming it to combo.com before saving it to your desktop, then run it.

try running it in safe mode if it won't run in normal mode
Post #20
Hi,

That is unusual, let's make sure there are no file infectors on board

please do the following:

  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:


    c:\windows\system32\userinit.exe

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.

Please do the same for the following files:

c:\windows\explorer.exe
c:\windows\system32\ctfmon.exe
c:\windows\system32\spoolsv.exe
Post #22
OK this may have something to do with the zip file issue Do you have access to another machine? Please delete the copy of CF from your desktop Use another machine to download a fresh ComboFix, rename it before you save it to combo.com then save it onto a USB stick transfer to your machine and run ComboFix directly from the USB stick, see if it will run
Post #23

OK

this may have something to do with the zip file issue

Do you have access to another machine?

Please delete the copy of CF from your desktop

Use another machine to download a fresh ComboFix, rename it before you save it to combo.com

then save it onto a USB stick

transfer to your machine and run ComboFix directly from the USB stick, see if it will run


OK, that worked. Here is the log file.

ComboFix 10-03-17.06 - Ignacio 03/17/2010 21:45:53.1.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2570 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.com
AV: avast! antivirus 4.8.1368 [VPS 100317-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\a3kebook.ini
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\patch.exe
c:\windows\run.log
c:\windows\system32\csftxctl.ocx
c:\windows\system32\exlywrqw.ini
c:\windows\system32\Ijl11.dll
c:\windows\system32\tmp.reg
c:\windows\system32\ufbenuld.ini
c:\windows\system32\zlibwapi.dll
c:\windows\YAHELITE.INI

.
((((((((((((((((((((((((( Files Created from 2010-02-18 to 2010-03-18 )))))))))))))))))))))))))))))))
.

2010-03-18 01:21 . 2010-03-18 01:21 ——– d—–w- c:\program files\uTorrent
2010-03-17 21:33 . 2009-06-30 13:37 28552 —-a-w- c:\windows\system32\drivers\pavboot.sys
2010-03-17 21:33 . 2010-03-17 21:33 ——– d—–w- c:\program files\Panda Security
2010-03-17 17:32 . 2010-03-17 17:32 ——– d—–w- c:\program files\ESET
2010-03-17 17:01 . 2010-03-17 17:01 88 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\3\libfftw3f-3-1-1a_upx.dll
2010-03-17 17:01 . 2010-03-17 17:01 100 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\3\setiathome_6.03_windows_intelx86.exe
2010-03-17 17:01 . 2010-03-17 17:01 88 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\2\libfftw3f-3-1-1a_upx.dll
2010-03-17 17:01 . 2010-03-17 17:01 88 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\1\libfftw3f-3-1-1a_upx.dll
2010-03-17 17:01 . 2010-03-17 17:01 100 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\2\setiathome_6.03_windows_intelx86.exe
2010-03-17 17:01 . 2010-03-17 17:01 100 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\1\setiathome_6.03_windows_intelx86.exe
2010-03-16 23:55 . 2010-03-17 08:38 88 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\0\libfftw3f-3-1-1a_upx.dll
2010-03-16 23:55 . 2010-03-17 08:38 100 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\0\setiathome_6.03_windows_intelx86.exe
2010-03-16 15:31 . 2010-03-16 15:31 ——– d—–w- c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2010-03-16 15:29 . 2010-03-16 15:29 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-03-16 15:28 . 2010-03-16 15:28 86016 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-03-16 15:28 . 2010-03-16 15:39 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-03-16 00:52 . 2010-03-16 00:52 ——– d—–w- c:\documents and settings\Ignacio\Application Data\fretsonfire
2010-03-16 00:51 . 2010-03-16 00:51 ——– d—–w- C:\Frets on Fire
2010-03-14 14:15 . 2010-03-14 14:15 ——– d—–w- c:\program files\ERUNT
2010-03-06 17:43 . 2010-03-18 01:50 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\LogMeIn Hamachi
2010-03-06 17:43 . 2010-03-10 04:26 ——– d—–w- c:\documents and settings\Ignacio\Local Settings\Application Data\LogMeIn Hamachi
2010-03-06 17:42 . 2010-03-06 17:42 ——– d—–w- c:\program files\LogMeIn Hamachi
2010-03-06 14:50 . 2010-03-06 14:50 ——– d—–w- C:\rtww
2010-03-06 14:50 . 2009-12-13 00:53 390826 —-a-w- c:\windows\WildWestUninstall.exe
2010-03-06 01:38 . 2010-03-06 13:42 ——– d—–w- c:\documents and settings\Ignacio\Application Data\Xfire
2010-03-06 01:38 . 2010-03-06 01:42 ——– d—–w- c:\program files\Xfire
2010-02-19 14:52 . 2005-02-02 21:15 196409 —-a-w- c:\windows\system32\drivers\V0060Vid.sys
2010-02-19 14:52 . 2005-01-24 22:26 1133578 —-a-w- c:\windows\system32\drivers\V0060Evx.sys
2010-02-19 14:52 . 2005-01-10 06:01 49152 —-a-w- c:\windows\system32\V0060Hwx.dll
2010-02-19 14:52 . 2005-01-10 06:01 20480 —-a-w- c:\windows\V0060Cfg.exe
2010-02-19 14:52 . 2004-12-14 02:02 26560 —-a-w- c:\windows\system32\drivers\V0060USB.sys
2010-02-19 14:52 . 2004-11-01 14:00 36864 —-a-w- c:\windows\system32\V0060Pin.dll
2010-02-19 14:51 . 2010-02-19 14:51 ——– d—–w- C:\WebCam
2010-02-17 15:32 . 2004-11-15 01:00 32768 ——w- c:\windows\system32\V0060sti.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-18 01:42 . 2009-04-10 08:23 ——– d—–w- c:\documents and settings\Ignacio\Application Data\DNA
2010-03-18 01:38 . 2008-10-01 21:11 ——– d—–w- c:\documents and settings\Ignacio\Application Data\uTorrent
2010-03-18 01:13 . 2009-06-25 16:55 ——– d—–w- c:\documents and settings\All Users\Application Data\BOINC
2010-03-18 01:12 . 2009-04-10 08:23 ——– d—–w- c:\program files\DNA
2010-03-17 22:40 . 2005-05-26 13:28 ——– d—–w- c:\documents and settings\Ignacio\Application Data\Skype
2010-03-16 15:43 . 2005-03-11 02:34 ——– d—–w- c:\program files\Java
2010-03-16 15:43 . 2007-07-25 21:49 ——– d—–w- c:\program files\Common Files\Java
2010-03-16 15:31 . 2005-03-23 13:46 ——– d—–w- c:\program files\Common Files\Adobe
2010-03-10 00:00 . 2009-10-12 18:05 ——– d—–w- c:\documents and settings\Ignacio\Application Data\PrimoPDF
2010-03-07 02:53 . 2007-10-21 13:24 48 —-a-w- c:\windows\popcinfot.dat
2010-03-06 23:51 . 2005-10-30 17:52 ——– d—–w- c:\documents and settings\Ignacio\Application Data\iPodder
2010-03-06 17:42 . 2009-01-07 05:40 ——– d—–w- c:\documents and settings\Ignacio\Application Data\Hamachi
2010-03-06 15:50 . 2008-06-19 04:43 138784 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-03-06 15:49 . 2008-06-19 04:43 202008 —-a-w- c:\windows\system32\PnkBstrB.exe
2010-03-01 16:58 . 2010-03-01 16:58 361600 —-a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2010-03-01 16:58 . 2001-08-23 12:00 361600 —-a-w- c:\windows\system32\drivers\TCPIP.SYS
2010-03-01 16:47 . 2009-09-20 22:46 ——– d—–r- c:\program files\Skype
2010-02-13 02:37 . 2005-08-07 12:54 ——– d—–w- c:\documents and settings\Ignacio\Application Data\CamfrogWEB
2010-02-12 17:31 . 2010-02-12 17:31 60816 —ha-w- c:\windows\system32\mlfcache.dat
2010-02-11 03:19 . 2010-02-11 03:19 41872 —-a-w- c:\windows\system32\xfcodec.dll
2010-02-08 13:27 . 2009-07-15 23:25 ——– d—–w- c:\program files\iTunes
2010-02-08 13:27 . 2005-10-30 17:56 ——– d—–w- c:\program files\iPod
2010-02-08 13:26 . 2007-10-06 18:46 ——– d—–w- c:\program files\Common Files\Apple
2010-02-08 13:25 . 2005-10-30 17:56 ——– d—–w- c:\program files\QuickTime
2010-02-08 13:20 . 2010-02-08 13:20 72488 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-02-08 13:17 . 2010-02-08 13:17 ——– d—–w- c:\program files\Safari
2010-02-08 13:15 . 2010-02-08 13:15 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe
2010-02-07 16:41 . 2010-02-07 16:41 86016 —-a-w- c:\windows\system32\frapsvid.dll
2010-02-07 15:50 . 2010-02-07 15:48 8636928 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\cufft_23_win32.dll
2010-02-07 15:48 . 2010-02-07 15:48 2859008 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\setiathome_6.09_windows_intelx86__cuda23.exe
2010-02-07 15:48 . 2010-02-07 15:48 285696 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\cudart_23_win32.dll
2010-02-07 13:39 . 2010-02-07 13:37 ——– d—–w- c:\program files\NVIDIA Corporation
2010-02-07 13:39 . 2007-10-10 01:57 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-02-07 13:38 . 2008-12-31 20:53 ——– d—–w- c:\program files\AGEIA Technologies
2010-02-07 13:07 . 2010-02-07 13:07 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-02-07 13:05 . 2010-02-07 13:05 ——– d—–w- c:\program files\Phyxion.net
2010-02-07 01:55 . 2007-03-08 13:28 ——– d—–w- c:\documents and settings\Ignacio\Application Data\IGN_DLM
2010-02-07 01:55 . 2010-02-07 01:55 ——– d—–w- c:\program files\Download Manager
2010-02-06 22:36 . 2005-03-09 02:54 ——– d—–w- c:\program files\Google
2010-02-02 17:14 . 2008-08-09 13:42 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-01-27 13:33 . 2010-01-27 13:33 503808 —-a-w- c:\documents and settings\Ignacio\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3e5e96cd-n\msvcp71.dll
2010-01-27 13:33 . 2010-01-27 13:33 499712 —-a-w- c:\documents and settings\Ignacio\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3e5e96cd-n\jmc.dll
2010-01-27 13:33 . 2010-01-27 13:33 348160 —-a-w- c:\documents and settings\Ignacio\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3e5e96cd-n\msvcr71.dll
2010-01-27 13:33 . 2010-01-27 13:33 61440 —-a-w- c:\documents and settings\Ignacio\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7d976b00-n\decora-sse.dll
2010-01-27 13:33 . 2010-01-27 13:33 12800 —-a-w- c:\documents and settings\Ignacio\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7d976b00-n\decora-d3d.dll
2010-01-22 14:10 . 2006-10-17 23:51 ——– d—–w- c:\program files\Microsoft ActiveSync
2010-01-17 14:02 . 2005-02-25 05:54 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-01-17 00:27 . 2009-04-27 23:53 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-17 00:23 . 2010-01-16 13:37 3888 —-a-w- c:\windows\system32\drivers\NTHANDLE.SYS
2010-01-12 04:03 . 2010-02-07 13:37 61440 —-a-w- c:\windows\system32\OpenCL.dll
2010-01-12 04:03 . 2010-02-07 13:37 10276768 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-01-12 04:03 . 2010-02-07 13:37 4104192 —-a-w- c:\windows\system32\nvcuda.dll
2010-01-12 04:03 . 2010-02-07 13:37 4077672 —-a-w- c:\windows\system32\nvcuvenc.dll
2010-01-12 04:03 . 2010-02-07 13:37 2259560 —-a-w- c:\windows\system32\nvcuvid.dll
2010-01-12 04:03 . 2010-02-07 13:37 14458880 —-a-w- c:\windows\system32\nvoglnt.dll
2010-01-12 04:03 . 2010-02-07 13:37 6359168 —-a-w- c:\windows\system32\nv4_disp.dll
2010-01-12 04:03 . 2010-02-07 13:37 2283526 —-a-w- c:\windows\system32\nvdata.bin
2010-01-12 04:03 . 2010-02-07 13:37 182888 —-a-w- c:\windows\system32\nvcodins.dll
2010-01-12 04:03 . 2010-02-07 13:37 182888 —-a-w- c:\windows\system32\nvcod.dll
2010-01-12 04:03 . 2010-02-07 13:37 11632640 —-a-w- c:\windows\system32\nvcompiler.dll
2010-01-12 04:03 . 2010-02-07 13:37 1081344 —-a-w- c:\windows\system32\nvapi.dll
2010-01-12 03:17 . 2010-01-12 03:17 278120 —-a-w- c:\windows\system32\nvmccs.dll
2010-01-12 03:17 . 2010-01-12 03:17 154216 —-a-w- c:\windows\system32\nvsvc32.exe
2010-01-12 03:17 . 2010-01-12 03:17 145000 —-a-w- c:\windows\system32\nvcolor.exe
2010-01-12 03:17 . 2010-01-12 03:17 13666408 —-a-w- c:\windows\system32\nvcpl.dll
2010-01-12 03:17 . 2010-01-12 03:17 110696 —-a-w- c:\windows\system32\nvmctray.dll
2010-01-12 03:17 . 2010-01-12 03:17 81920 —-a-w- c:\windows\system32\nvwddi.dll
2010-01-07 21:07 . 2009-02-05 03:21 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2009-02-05 03:21 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 19:28 . 2010-01-05 19:20 1885464 —-a-w- c:\windows\system32\AutoPartNt.exe
2010-01-05 18:59 . 2010-01-05 18:59 44384 —-a-w- c:\windows\system32\drivers\tifsfilt.sys
2010-01-05 18:59 . 2010-01-05 18:59 441760 —-a-w- c:\windows\system32\drivers\timntr.sys
2010-01-05 18:59 . 2010-01-05 18:59 132480 —-a-w- c:\windows\system32\drivers\snapman.sys
2010-01-05 18:58 . 2010-01-05 18:58 368480 —-a-w- c:\windows\system32\drivers\tdrpman.sys
2009-12-25 14:24 . 2009-12-25 14:24 28696928 —-a-w- c:\documents and settings\All Users\Application Data\Leapfrog\LeapFrog Connect\Updates\UPCInstaller.exe
2009-12-25 14:23 . 2009-12-25 14:23 6969680 —-a-w- c:\documents and settings\All Users\Application Data\Leapfrog\LeapFrog Connect\Updates\TagJuniorPlugin.exe
2009-12-22 05:21 . 2004-12-07 21:37 667136 —-a-w- c:\windows\system32\wininet.dll
2009-12-22 05:20 . 2004-08-04 07:56 81920 —-a-w- c:\windows\system32\ieencode.dll
2009-09-25 16:41 . 2009-09-25 16:41 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2005-07-14 19:31 . 2006-05-24 17:37 27648 –sha-w- c:\windows\system32\AVSredirect.dll
2006-05-03 10:06 . 2007-11-26 03:00 163328 –sha-r- c:\windows\system32\flvDX.dll
2007-03-17 20:24 . 2007-03-03 22:11 12208 –sh–w- c:\windows\system32\KGyGaAvL.sys
2007-02-21 11:47 . 2007-11-26 03:00 31232 –sha-r- c:\windows\system32\msfDX.dll
2007-12-17 13:43 . 2008-03-24 13:36 27648 –sha-w- c:\windows\system32\Smab0.dll
.

——- Sigcheck ——-

[-] 2010-03-01 . D24EA301E2B36C4E975FD216CA85D8E7 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\TCPIP.SYS
[-] 2010-03-01 . D24EA301E2B36C4E975FD216CA85D8E7 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\TCPIP.SYS
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\TCPIP.SYS
[-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
[-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2005-05-25 . 63FDFEA54EB53DE2D863EE454937CE1E . 359936 . . [5.1.2600.2685] . . c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
[-] 2005-05-25 . 88763A98A4C26C409741B4AA162720C9 . 359808 . . [5.1.2600.2685] . . c:\windows\$NtUninstallKB917953$\tcpip.sys
[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB893066$\tcpip.sys
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2005-06-11 16:35 . 2002-12-03 22:06 45056 c:\program files\Creative\SB Drive Det\bak\SBDrvDet.exe

2005-06-11 16:32 . 2003-06-18 05:00 45056 c:\program files\Creative\SBAudigy2\DVDAudio\bak\CTDVDDet.EXE

2005-06-11 16:32 . 2003-09-17 14:43 57344 c:\program files\Creative\SBAudigy2\Surround Mixer\bak\CTSysVol.exe

2007-01-06 21:44 . 2004-11-18 02:50 258048 c:\program files\Creative\Shared Files\bak\CamTray.exe
2010-02-19 14:57 . 2005-10-27 23:00 299008 c:\program files\Creative\Shared Files\CamTray.exe

2007-01-05 12:11 . 2006-11-09 20:07 49263 c:\program files\Java\jre1.5.0_10\bin\bak\jusched.exe

2006-06-26 20:13 . 2006-06-26 20:13 1207080 c:\program files\Microsoft ActiveSync\bak\wcescomm.exe
2006-06-26 21:13 . 2006-06-26 21:13 1207080 c:\program files\Microsoft ActiveSync\wcescomm.exe

2005-04-08 20:39 . 2005-04-08 20:39 221184 c:\program files\NovaStor\NovaBACKUP\bak\NbkCtrl.exe
2005-04-08 21:39 . 2005-04-08 21:39 221184 c:\program files\NovaStor\NovaBACKUP\NBKCTRL.exe

2005-10-30 17:57 . 2005-10-30 17:57 155648 c:\program files\QuickTime\bak\qttask.exe
2009-11-11 04:08 . 2009-11-11 04:08 417792 c:\program files\QuickTime\QTTask.exe

2006-11-09 13:40 . 2006-07-27 14:49 544768 c:\program files\Sprite Software\Sprite Backup\bak\SpriteService.exe

2004-09-15 23:48 . 2005-11-26 00:51 819262 c:\program files\Trend Micro\Internet Security 2005\bak\pccguide.exe

2005-06-11 16:35 . 2000-05-11 05:00 90112 c:\windows\bak\UpdReg.EXE

2006-01-07 15:48 . 2003-12-31 22:39 40960 c:\windows\bak\vsnpstd.exe
2006-01-07 15:48 . 2003-12-31 22:39 40960 c:\windows\vsnpstd.exe

2006-09-11 22:24 . 2002-09-05 14:05 45056 c:\windows\system32\spool\drivers\w32x86\3\bak\LMPDPSRV.EXE

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2009-04-17 95536]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-13 323392]
"igndlm.exe"="c:\program files\Download Manager\DLM.exe" [2009-10-27 1103216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="c:\program files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [N/A]
"CTDVDDET"="c:\program files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [N/A]
"SBDrvDet"="c:\program files\Creative\SB Drive Det\SBDrvDet.exe" [N/A]
"CTHelper"="CTHELPER.EXE" [2005-12-08 16384]
"CTXFIREG"="CTxfiReg.exe" [N/A]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 94208]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 94208]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [N/A]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2009-04-17 54576]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"boincmgr"="c:\program files\BOINC\boincmgr.exe" [2009-06-10 4182784]
"boinctray"="c:\program files\BOINC\boinctray.exe" [2009-06-10 58112]
"snpstd"="c:\windows\vsnpstd.exe" [2003-12-31 40960]
"Monitor"="c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2009-11-10 443728]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2009-06-10 1326080]
"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2009-06-10 904840]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2009-06-10 136472]
"nwiz"="nwiz.exe" [N/A]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-12 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-12 13666408]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]
"VF0060 STISvc"="V0060Pin.dll" [2004-11-01 36864]
"wildwestscan"="c:\rtww\WildWestStarter\wwstart.exe" [2009-12-13 184320]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [N/A]

c:\documents and settings\Ignacio\Start Menu\Programs\Startup\
Check for OneTouch Updates.lnk - c:\program files\Visioneer OneTouch\WiseUpdt.exe [2009-8-13 166518]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
UltraMon.lnk - c:\program files\UltraMon\UltraMon.exe [2004-5-10 177664]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\Program Files
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\c:\program files\1&1
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\c:\program files\1&1\1&1 EasyLogin

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\c:\program files\1&1\1&1 EasyLogin\EasyLogin.exe]
1&1 EasyLogin HIDE [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\1&1 EasyLogin]
2009-08-18 10:30 2200576 —-a-w- c:\program files\1&1\1&1 EasyLogin\EasyLogin.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Probe]
c:\program files\ASUS\Probe\AsusProb.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dvd43]
2008-04-09 14:00 826880 —-a-w- c:\program files\dvd43\DVD43_Tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
c:\documents and settings\Ignacio\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gStart]
c:\garmin\gStart.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-23 00:16 141608 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
c:\windows\system32\NeroCheck.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NovaBackup 7 Tray Control]
2005-04-08 21:39 221184 ——w- c:\program files\NovaStor\NovaBACKUP\NBKCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [N/A]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\sid meier's civilization iv\\Civilization4.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\call of duty world at war\\CoDWaW.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\call of duty world at war\\CoDWaWmp.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\plants vs zombies\\PlantsVsZombies.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\trine\\trine_launcher.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\serious sam hd the first encounter\\Bin\\SamHD.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\left 4 dead\\srcds.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\operation flashpoint dragon rising\\OFDR.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57439:TCP"= 57439:TCP:Pando Media Booster
"57439:UDP"= 57439:UDP:Pando Media Booster

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [3/17/2010 5:33 PM 28552]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [4/21/2009 10:15 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/21/2009 10:15 PM 20560]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [10/29/2009 1:27 PM 1074568]
R2 iPodDrv;iPodDrv;c:\windows\system32\drivers\iPodDrv.sys [12/12/2009 3:19 AM 6656]
R2 UltraMonUtility;UltraMon Utility Driver;c:\windows\system32\UltraMonUtility.sys [4/12/2004 5:37 PM 10288]
R3 UltraMonMirror;UltraMonMirror;c:\windows\system32\drivers\UltraMonMirror.sys [4/12/2004 5:38 PM 8240]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/6/2010 7:28 PM 135664]
S3 CCCP106;CIF USB Camera (2110A);c:\windows\system32\DRIVERS\cccp106.sys –> c:\windows\system32\DRIVERS\cccp106.sys [?]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [12/25/2009 10:25 AM 18560]
S3 nuvaudio;NUVision Audio Service;c:\windows\system32\drivers\nuvaudio.sys [1/12/2007 7:47 PM 22848]
S3 NUVision;NUVision Video Service;c:\windows\system32\drivers\NUVision.sys [1/12/2007 7:47 PM 135424]
S3 PIXMCV;JVC Communication PIX-MCV Driver;c:\windows\system32\drivers\pixmcvc.sys [4/10/2005 1:58 PM 32000]
S3 PIXMCVA;JVC PIX-MCV Audio Capture;c:\windows\system32\drivers\pixmcva.sys [4/10/2005 1:56 PM 28057]
S3 PIXMCVV;JVC PIX-MCV Video Capture;c:\windows\system32\drivers\pixmcvv.sys [4/10/2005 1:56 PM 21081]
.
Contents of the 'Scheduled Tasks' folder

2010-03-18 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-09 17:14]

2010-03-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 23:28]

2010-03-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 23:28]

2010-03-18 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 19:07]

2005-02-25 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2005-02-25 20:06]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei;=utf-8&fr;=b1ie7
mStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: aol.com\free
Trusted Zone: the-wildwest.com
TCP: {28A47114-C3F0-4EEE-827F-45F4EB6308D3} = 192.168.1.1
TCP: {370E624D-60AB-4E91-A51C-A77E39F82EC2} = 192.168.1.254
TCP: {D0D8C33C-FB24-4186-9BAC-7C17606BD69F} = 192.168.2.1
TCP: {F67AE8CF-2E3D-45F3-A0CC-81E07CF4D150} = 192.168.1.1
DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - hxxp://activex.camfrogweb.com/advanced/2.0.2.3/cfweb_activex.camfrogweb.com-advanced-2.0.2.3_instmodule.exe
FF - ProfilePath - c:\documents and settings\Ignacio\Application Data\Mozilla\Firefox\Profiles\fjdi59q7.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.bing.com/
FF - prefs.js: keyword.URL -
FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\documents and settings\Ignacio\Local Settings\Application Data\Yahoo!\BrowserPlus\2.5.1\Plugins\npybrowserplus_2.5.1.dll
FF - plugin: c:\program files\Download Manager\npfpdlm.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1851.5542\npCIDetect14.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

Notify-avgrsstarter - avgrsstx.dll
AddRemove-SShockDeinstallKey - c:\sshock2_mp\SShocku.log
AddRemove-TCPMP - c:\program files\Microsoft ActiveSync\TCPMP\Uninstall.exe
AddRemove-WildWest1.6 - d:\wildwest 16xx\Uninst1613.isu



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-17 21:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-484763869-789336058-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-484763869-789336058-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:6a,aa,77,bf,39,15,c3,5e,0a,03,28,8d,22,74,d1,2e,fe,08,fe,a8,8b,0a,2e,
45,49,0b,c6,0b,6d,21,75,4b,4e,26,50,7f,d6,84,0b,1f,a0,50,91,b9,ff,48,39,39,\
"??"=hex:a7,29,ff,60,c6,66,be,fb,a4,fe,a2,8c,7e,08,f5,80
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(892)
c:\windows\system32\relog_ap.dll
.
Completion time: 2010-03-17 21:54:51
ComboFix-quarantined-files.txt 2010-03-18 01:54
ComboFix2.txt 2007-07-24 22:33

Pre-Run: 508,601,180,160 bytes free
Post-Run: 508,766,007,296 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn /usepmtimer

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 37F14C45526623ADBCD0C8D0290A0F6C
Post #24
Hi,

Please do the following:


  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

AWF::
c:\program files\Creative\SBAudigy2\Surround Mixer\bak\CTSysVol.exe
c:\program files\Creative\SB Drive Det\bak\SBDrvDet.exe\
c:\program files\Creative\SBAudigy2\DVDAudio\bak\CTDVDDet.

Folder::
c:\windows\system32\spool\drivers\w32x86\3\bak
c:\program files\Creative\Shared Files\bak
c:\program files\Java\jre1.5.0_10\bin\bak
c:\program files\Microsoft ActiveSync\bak
c:\program files\NovaStor\NovaBACKUP\bak
c:\program files\QuickTime\bak
c:\windows\bak
c:\program files\Trend Micro\Internet Security 2005\bak
c:\program files\Sprite Software\Sprite Backup\bak

DDS::
Trusted Zone: aol.com\free
Trusted Zone: the-wildwest.com

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


NEXT

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.
Post #25
Again, I am having trouble getting CF to complete successfully. It launches when I drag the script file onto it, and I get quite a bit of disk activity initially, but then it seems to stop with only an occasional drive light flicker and it stays like that for at least 15 minutes, so I closed it and ran MBAM, which said it did not find anything. Malwarebytes' Anti-Malware 1.44 Database version: 3880 Windows 5.1.2600 Service Pack 3 Internet Explorer 6.0.2900.5512 3/18/2010 9:11:03 AM mbam-log-2010-03-18 (09-11-03).txt Scan type: Quick Scan Objects scanned: 138366 Time elapsed: 3 minute(s), 54 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Should I continue to try to get CF to finish?
Post #27
OK, CF completely successfully in Safe Mode, log attached.

Now, oddly enough, my Avast AV is no longer showing up in my system tray. It has been there until I ran the CF in Safe Mode. It looks like it is running in the task manager, but the icons aren't in the system tray any more.

*****************************************

ComboFix 10-03-17.07 - Ignacio 03/18/2010 9:34.2.4 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2986 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.com
Command switches used :: c:\docume~1\Ignacio\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100318-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Creative\Shared Files\bak
c:\program files\Creative\Shared Files\bak\CamTray.exe
c:\program files\Java\jre1.5.0_10\bin\bak
c:\program files\Java\jre1.5.0_10\bin\bak\jusched.exe
c:\program files\Microsoft ActiveSync\bak
c:\program files\Microsoft ActiveSync\bak\wcescomm.exe
c:\program files\NovaStor\NovaBACKUP\bak
c:\program files\NovaStor\NovaBACKUP\bak\NbkCtrl.exe
c:\program files\QuickTime\bak
c:\program files\QuickTime\bak\qttask.exe
c:\program files\Sprite Software\Sprite Backup\bak
c:\program files\Sprite Software\Sprite Backup\bak\SpriteService.exe
c:\program files\Trend Micro\Internet Security 2005\bak
c:\program files\Trend Micro\Internet Security 2005\bak\pccguide.exe
c:\windows\bak
c:\windows\bak\UpdReg.EXE
c:\windows\bak\vsnpstd.exe
c:\windows\system32\spool\drivers\w32x86\3\bak
c:\windows\system32\spool\drivers\w32x86\3\bak\LMPDPSRV.EXE

.
((((((((((((((((((((((((( Files Created from 2010-02-18 to 2010-03-18 )))))))))))))))))))))))))))))))
.

2010-03-18 10:34 . 2010-03-18 10:34 88 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\2\libfftw3f-3-1-1a_upx.dll
2010-03-18 10:34 . 2010-03-18 10:34 100 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\2\setiathome_6.03_windows_intelx86.exe
2010-03-18 10:34 . 2010-03-18 10:34 88 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\1\libfftw3f-3-1-1a_upx.dll
2010-03-18 10:34 . 2010-03-18 10:34 100 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\1\setiathome_6.03_windows_intelx86.exe
2010-03-18 03:14 . 2010-03-18 03:14 88 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\4\libfftw3f-3-1-1a_upx.dll
2010-03-18 03:14 . 2010-03-18 03:14 100 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\4\astropulse_5.05_windows_intelx86.exe
2010-03-18 01:21 . 2010-03-18 01:21 ——– d—–w- c:\program files\uTorrent
2010-03-17 21:33 . 2009-06-30 13:37 28552 —-a-w- c:\windows\system32\drivers\pavboot.sys
2010-03-17 21:33 . 2010-03-17 21:33 ——– d—–w- c:\program files\Panda Security
2010-03-17 17:32 . 2010-03-17 17:32 ——– d—–w- c:\program files\ESET
2010-03-16 23:55 . 2010-03-18 08:28 88 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\0\libfftw3f-3-1-1a_upx.dll
2010-03-16 23:55 . 2010-03-18 08:28 100 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\slots\0\setiathome_6.03_windows_intelx86.exe
2010-03-16 15:31 . 2010-03-16 15:31 ——– d—–w- c:\documents and settings\Default User\Local Settings\Application Data\Adobe
2010-03-16 15:29 . 2010-03-16 15:29 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-03-16 15:28 . 2010-03-16 15:28 86016 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-03-16 15:28 . 2010-03-16 15:39 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-03-16 00:52 . 2010-03-16 00:52 ——– d—–w- c:\documents and settings\Ignacio\Application Data\fretsonfire
2010-03-16 00:51 . 2010-03-16 00:51 ——– d—–w- C:\Frets on Fire
2010-03-14 14:15 . 2010-03-14 14:15 ——– d—–w- c:\program files\ERUNT
2010-03-06 17:43 . 2010-03-18 13:43 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\LogMeIn Hamachi
2010-03-06 17:43 . 2010-03-10 04:26 ——– d—–w- c:\documents and settings\Ignacio\Local Settings\Application Data\LogMeIn Hamachi
2010-03-06 17:42 . 2010-03-06 17:42 ——– d—–w- c:\program files\LogMeIn Hamachi
2010-03-06 14:50 . 2010-03-06 14:50 ——– d—–w- C:\rtww
2010-03-06 14:50 . 2009-12-13 00:53 390826 —-a-w- c:\windows\WildWestUninstall.exe
2010-03-06 01:38 . 2010-03-06 13:42 ——– d—–w- c:\documents and settings\Ignacio\Application Data\Xfire
2010-03-06 01:38 . 2010-03-06 01:42 ——– d—–w- c:\program files\Xfire
2010-02-19 14:52 . 2005-02-02 21:15 196409 —-a-w- c:\windows\system32\drivers\V0060Vid.sys
2010-02-19 14:52 . 2005-01-24 22:26 1133578 —-a-w- c:\windows\system32\drivers\V0060Evx.sys
2010-02-19 14:52 . 2005-01-10 06:01 49152 —-a-w- c:\windows\system32\V0060Hwx.dll
2010-02-19 14:52 . 2005-01-10 06:01 20480 —-a-w- c:\windows\V0060Cfg.exe
2010-02-19 14:52 . 2004-12-14 02:02 26560 —-a-w- c:\windows\system32\drivers\V0060USB.sys
2010-02-19 14:52 . 2004-11-01 14:00 36864 —-a-w- c:\windows\system32\V0060Pin.dll
2010-02-19 14:51 . 2010-02-19 14:51 ——– d—–w- C:\WebCam
2010-02-17 15:32 . 2004-11-15 01:00 32768 ——w- c:\windows\system32\V0060sti.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-18 13:43 . 2006-10-17 23:51 ——– d—–w- c:\program files\Microsoft ActiveSync
2010-03-18 13:43 . 2005-10-30 17:56 ——– d—–w- c:\program files\QuickTime
2010-03-18 13:29 . 2009-06-25 16:55 ——– d—–w- c:\documents and settings\All Users\Application Data\BOINC
2010-03-18 13:29 . 2009-04-10 08:23 ——– d—–w- c:\documents and settings\Ignacio\Application Data\DNA
2010-03-18 13:04 . 2009-04-10 08:23 ——– d—–w- c:\program files\DNA
2010-03-18 12:07 . 2008-10-01 21:11 ——– d—–w- c:\documents and settings\Ignacio\Application Data\uTorrent
2010-03-18 02:06 . 2009-02-09 16:25 ——– d—–w- c:\documents and settings\Ignacio\Application Data\dvdcss
2010-03-17 22:40 . 2005-05-26 13:28 ——– d—–w- c:\documents and settings\Ignacio\Application Data\Skype
2010-03-16 15:43 . 2005-03-11 02:34 ——– d—–w- c:\program files\Java
2010-03-16 15:43 . 2007-07-25 21:49 ——– d—–w- c:\program files\Common Files\Java
2010-03-16 15:31 . 2005-03-23 13:46 ——– d—–w- c:\program files\Common Files\Adobe
2010-03-10 00:00 . 2009-10-12 18:05 ——– d—–w- c:\documents and settings\Ignacio\Application Data\PrimoPDF
2010-03-07 02:53 . 2007-10-21 13:24 48 —-a-w- c:\windows\popcinfot.dat
2010-03-06 23:51 . 2005-10-30 17:52 ——– d—–w- c:\documents and settings\Ignacio\Application Data\iPodder
2010-03-06 17:42 . 2009-01-07 05:40 ——– d—–w- c:\documents and settings\Ignacio\Application Data\Hamachi
2010-03-06 15:50 . 2008-06-19 04:43 138784 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-03-06 15:49 . 2008-06-19 04:43 202008 —-a-w- c:\windows\system32\PnkBstrB.exe
2010-03-01 16:58 . 2010-03-01 16:58 361600 —-a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2010-03-01 16:58 . 2001-08-23 12:00 361600 —-a-w- c:\windows\system32\drivers\TCPIP.SYS
2010-03-01 16:47 . 2009-09-20 22:46 ——– d—–r- c:\program files\Skype
2010-02-13 02:37 . 2005-08-07 12:54 ——– d—–w- c:\documents and settings\Ignacio\Application Data\CamfrogWEB
2010-02-12 17:31 . 2010-02-12 17:31 60816 —ha-w- c:\windows\system32\mlfcache.dat
2010-02-11 03:19 . 2010-02-11 03:19 41872 —-a-w- c:\windows\system32\xfcodec.dll
2010-02-08 13:27 . 2009-07-15 23:25 ——– d—–w- c:\program files\iTunes
2010-02-08 13:27 . 2005-10-30 17:56 ——– d—–w- c:\program files\iPod
2010-02-08 13:26 . 2007-10-06 18:46 ——– d—–w- c:\program files\Common Files\Apple
2010-02-08 13:20 . 2010-02-08 13:20 72488 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-02-08 13:17 . 2010-02-08 13:17 ——– d—–w- c:\program files\Safari
2010-02-08 13:15 . 2010-02-08 13:15 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe
2010-02-07 16:41 . 2010-02-07 16:41 86016 —-a-w- c:\windows\system32\frapsvid.dll
2010-02-07 15:50 . 2010-02-07 15:48 8636928 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\cufft_23_win32.dll
2010-02-07 15:48 . 2010-02-07 15:48 2859008 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\setiathome_6.09_windows_intelx86__cuda23.exe
2010-02-07 15:48 . 2010-02-07 15:48 285696 —-a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\cudart_23_win32.dll
2010-02-07 13:39 . 2010-02-07 13:37 ——– d—–w- c:\program files\NVIDIA Corporation
2010-02-07 13:39 . 2007-10-10 01:57 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-02-07 13:38 . 2008-12-31 20:53 ——– d—–w- c:\program files\AGEIA Technologies
2010-02-07 13:07 . 2010-02-07 13:07 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-02-07 13:05 . 2010-02-07 13:05 ——– d—–w- c:\program files\Phyxion.net
2010-02-07 01:55 . 2007-03-08 13:28 ——– d—–w- c:\documents and settings\Ignacio\Application Data\IGN_DLM
2010-02-07 01:55 . 2010-02-07 01:55 ——– d—–w- c:\program files\Download Manager
2010-02-06 22:36 . 2005-03-09 02:54 ——– d—–w- c:\program files\Google
2010-02-02 17:14 . 2008-08-09 13:42 ——– d—–w- c:\documents and settings\All Users\Application Data\Google Updater
2010-01-27 13:33 . 2010-01-27 13:33 503808 —-a-w- c:\documents and settings\Ignacio\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3e5e96cd-n\msvcp71.dll
2010-01-27 13:33 . 2010-01-27 13:33 499712 —-a-w- c:\documents and settings\Ignacio\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3e5e96cd-n\jmc.dll
2010-01-27 13:33 . 2010-01-27 13:33 348160 —-a-w- c:\documents and settings\Ignacio\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-3e5e96cd-n\msvcr71.dll
2010-01-27 13:33 . 2010-01-27 13:33 61440 —-a-w- c:\documents and settings\Ignacio\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7d976b00-n\decora-sse.dll
2010-01-27 13:33 . 2010-01-27 13:33 12800 —-a-w- c:\documents and settings\Ignacio\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7d976b00-n\decora-d3d.dll
2010-01-17 14:02 . 2005-02-25 05:54 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-01-17 00:27 . 2009-04-27 23:53 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-17 00:23 . 2010-01-16 13:37 3888 —-a-w- c:\windows\system32\drivers\NTHANDLE.SYS
2010-01-12 04:03 . 2010-02-07 13:37 61440 —-a-w- c:\windows\system32\OpenCL.dll
2010-01-12 04:03 . 2010-02-07 13:37 10276768 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-01-12 04:03 . 2010-02-07 13:37 4104192 —-a-w- c:\windows\system32\nvcuda.dll
2010-01-12 04:03 . 2010-02-07 13:37 4077672 —-a-w- c:\windows\system32\nvcuvenc.dll
2010-01-12 04:03 . 2010-02-07 13:37 2259560 —-a-w- c:\windows\system32\nvcuvid.dll
2010-01-12 04:03 . 2010-02-07 13:37 14458880 —-a-w- c:\windows\system32\nvoglnt.dll
2010-01-12 04:03 . 2010-02-07 13:37 6359168 —-a-w- c:\windows\system32\nv4_disp.dll
2010-01-12 04:03 . 2010-02-07 13:37 2283526 —-a-w- c:\windows\system32\nvdata.bin
2010-01-12 04:03 . 2010-02-07 13:37 182888 —-a-w- c:\windows\system32\nvcodins.dll
2010-01-12 04:03 . 2010-02-07 13:37 182888 —-a-w- c:\windows\system32\nvcod.dll
2010-01-12 04:03 . 2010-02-07 13:37 11632640 —-a-w- c:\windows\system32\nvcompiler.dll
2010-01-12 04:03 . 2010-02-07 13:37 1081344 —-a-w- c:\windows\system32\nvapi.dll
2010-01-12 03:17 . 2010-01-12 03:17 278120 —-a-w- c:\windows\system32\nvmccs.dll
2010-01-12 03:17 . 2010-01-12 03:17 154216 —-a-w- c:\windows\system32\nvsvc32.exe
2010-01-12 03:17 . 2010-01-12 03:17 145000 —-a-w- c:\windows\system32\nvcolor.exe
2010-01-12 03:17 . 2010-01-12 03:17 13666408 —-a-w- c:\windows\system32\nvcpl.dll
2010-01-12 03:17 . 2010-01-12 03:17 110696 —-a-w- c:\windows\system32\nvmctray.dll
2010-01-12 03:17 . 2010-01-12 03:17 81920 —-a-w- c:\windows\system32\nvwddi.dll
2010-01-07 21:07 . 2009-02-05 03:21 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2009-02-05 03:21 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 19:28 . 2010-01-05 19:20 1885464 —-a-w- c:\windows\system32\AutoPartNt.exe
2010-01-05 18:59 . 2010-01-05 18:59 44384 —-a-w- c:\windows\system32\drivers\tifsfilt.sys
2010-01-05 18:59 . 2010-01-05 18:59 441760 —-a-w- c:\windows\system32\drivers\timntr.sys
2010-01-05 18:59 . 2010-01-05 18:59 132480 —-a-w- c:\windows\system32\drivers\snapman.sys
2010-01-05 18:58 . 2010-01-05 18:58 368480 —-a-w- c:\windows\system32\drivers\tdrpman.sys
2009-12-25 14:24 . 2009-12-25 14:24 28696928 —-a-w- c:\documents and settings\All Users\Application Data\Leapfrog\LeapFrog Connect\Updates\UPCInstaller.exe
2009-12-25 14:23 . 2009-12-25 14:23 6969680 —-a-w- c:\documents and settings\All Users\Application Data\Leapfrog\LeapFrog Connect\Updates\TagJuniorPlugin.exe
2009-12-22 05:21 . 2004-12-07 21:37 667136 ——w- c:\windows\system32\wininet.dll
2009-12-22 05:20 . 2004-08-04 07:56 81920 —-a-w- c:\windows\system32\ieencode.dll
2009-09-25 16:41 . 2009-09-25 16:41 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
2005-07-14 19:31 . 2006-05-24 17:37 27648 –sha-w- c:\windows\system32\AVSredirect.dll
2006-05-03 10:06 . 2007-11-26 03:00 163328 –sha-r- c:\windows\system32\flvDX.dll
2007-03-17 20:24 . 2007-03-03 22:11 12208 –sh–w- c:\windows\system32\KGyGaAvL.sys
2007-02-21 11:47 . 2007-11-26 03:00 31232 –sha-r- c:\windows\system32\msfDX.dll
2007-12-17 13:43 . 2008-03-24 13:36 27648 –sha-w- c:\windows\system32\Smab0.dll
.

——- Sigcheck ——-

[-] 2010-03-01 . D24EA301E2B36C4E975FD216CA85D8E7 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\TCPIP.SYS
[-] 2010-03-01 . D24EA301E2B36C4E975FD216CA85D8E7 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\TCPIP.SYS
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[7] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\TCPIP.SYS
[-] 2007-10-30 . 90CAFF4B094573449A0872A0F919B178 . 360064 . . [5.1.2600.3244] . . c:\windows\$NtServicePackUninstall$\tcpip.sys
[-] 2007-10-30 . 64798ECFA43D78C7178375FCDD16D8C8 . 360832 . . [5.1.2600.3244] . . c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
[-] 2006-04-20 . B2220C618B42A2212A59D91EBD6FC4B4 . 360576 . . [5.1.2600.2892] . . c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
[-] 2006-04-20 . 1DBF125862891817F374F407626967F4 . 359808 . . [5.1.2600.2892] . . c:\windows\$NtUninstallKB941644$\tcpip.sys
[-] 2005-05-25 . 63FDFEA54EB53DE2D863EE454937CE1E . 359936 . . [5.1.2600.2685] . . c:\windows\$hf_mig$\KB893066\SP2QFE\tcpip.sys
[-] 2005-05-25 . 88763A98A4C26C409741B4AA162720C9 . 359808 . . [5.1.2600.2685] . . c:\windows\$NtUninstallKB917953$\tcpip.sys
[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB893066$\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2010-03-18_01.50.21 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-18 02:12 . 2010-03-18 02:12 22528 c:\windows\Installer\371ede.msi
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2005-06-11 16:35 . 2002-12-03 22:06 45056 c:\program files\Creative\SB Drive Det\bak\SBDrvDet.exe

2005-06-11 16:32 . 2003-06-18 05:00 45056 c:\program files\Creative\SBAudigy2\DVDAudio\bak\CTDVDDet.EXE

2007-01-06 21:44 . 2004-11-18 02:50 258048 c:\qoobox\Quarantine\C\Program Files\Creative\Shared Files\bak\CamTray.exe.vir

2007-01-05 12:11 . 2006-11-09 20:07 49263 c:\qoobox\Quarantine\C\Program Files\Java\jre1.5.0_10\bin\bak\jusched.exe.vir

2006-06-26 20:13 . 2006-06-26 20:13 1207080 c:\qoobox\Quarantine\C\Program Files\Microsoft ActiveSync\bak\wcescomm.exe.vir

2005-04-08 20:39 . 2005-04-08 20:39 221184 c:\qoobox\Quarantine\C\Program Files\NovaStor\NovaBACKUP\bak\NbkCtrl.exe.vir

2005-10-30 17:57 . 2005-10-30 17:57 155648 c:\qoobox\Quarantine\C\Program Files\QuickTime\bak\qttask.exe.vir

2006-11-09 13:40 . 2006-07-27 14:49 544768 c:\qoobox\Quarantine\C\Program Files\Sprite Software\Sprite Backup\bak\SpriteService.exe.vir

2004-09-15 23:48 . 2005-11-26 00:51 819262 c:\qoobox\Quarantine\C\Program Files\Trend Micro\Internet Security 2005\bak\pccguide.exe.vir

2005-06-11 16:35 . 2000-05-11 05:00 90112 c:\qoobox\Quarantine\C\WINDOWS\bak\UpdReg.EXE.vir

2006-01-07 15:48 . 2003-12-31 22:39 40960 c:\qoobox\Quarantine\C\WINDOWS\bak\vsnpstd.exe.vir

2006-09-11 22:24 . 2002-09-05 14:05 45056 c:\qoobox\Quarantine\C\WINDOWS\system32\spool\drivers\w32x86\3\bak\LMPDPSRV.EXE.vir

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2009-04-17 95536]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-11-13 323392]
"igndlm.exe"="c:\program files\Download Manager\DLM.exe" [2009-10-27 1103216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSysVol"="c:\program files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]
"CTDVDDET"="c:\program files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE" [N/A]
"SBDrvDet"="c:\program files\Creative\SB Drive Det\SBDrvDet.exe" [N/A]
"CTHelper"="CTHELPER.EXE" [2005-12-08 16384]
"CTXFIREG"="CTxfiReg.exe" [N/A]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 94208]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2006-07-19 94208]
"NVMixerTray"="c:\program files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [N/A]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2009-04-17 54576]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
"boincmgr"="c:\program files\BOINC\boincmgr.exe" [2009-06-10 4182784]
"boinctray"="c:\program files\BOINC\boinctray.exe" [2009-06-10 58112]
"snpstd"="c:\windows\vsnpstd.exe" [2003-12-31 40960]
"Monitor"="c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe" [2009-11-10 443728]
"TrueImageMonitor.exe"="c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2009-06-10 1326080]
"AcronisTimounterMonitor"="c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe" [2009-06-10 904840]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2009-06-10 136472]
"nwiz"="nwiz.exe" [N/A]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-01-12 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-01-12 13666408]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]
"VF0060 STISvc"="V0060Pin.dll" [2004-11-01 36864]
"wildwestscan"="c:\rtww\WildWestStarter\wwstart.exe" [2009-12-13 184320]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [N/A]

c:\documents and settings\Ignacio\Start Menu\Programs\Startup\
Check for OneTouch Updates.lnk - c:\program files\Visioneer OneTouch\WiseUpdt.exe [2009-8-13 166518]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
UltraMon.lnk - c:\program files\UltraMon\UltraMon.exe [2004-5-10 177664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
[BU]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\1&1 EasyLogin]
2009-08-18 10:30 2200576 —-a-w- c:\program files\1&1\1&1 EasyLogin\EasyLogin.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Probe]
c:\program files\ASUS\Probe\AsusProb.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dvd43]
2008-04-09 14:00 826880 —-a-w- c:\program files\dvd43\DVD43_Tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
c:\documents and settings\Ignacio\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gStart]
c:\garmin\gStart.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-23 00:16 141608 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
c:\windows\system32\NeroCheck.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NovaBackup 7 Tray Control]
2005-04-08 21:39 221184 ——w- c:\program files\NovaStor\NovaBACKUP\NBKCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [N/A]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\sid meier's civilization iv\\Civilization4.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\call of duty world at war\\CoDWaW.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\call of duty world at war\\CoDWaWmp.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\plants vs zombies\\PlantsVsZombies.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\trine\\trine_launcher.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\serious sam hd the first encounter\\Bin\\SamHD.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\left 4 dead 2\\left4dead2.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\left 4 dead\\srcds.exe"=
"c:\\Program Files\\Valve\\Steam\\SteamApps\\common\\operation flashpoint dragon rising\\OFDR.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57439:TCP"= 57439:TCP:Pando Media Booster
"57439:UDP"= 57439:UDP:Pando Media Booster

R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [10/29/2009 1:27 PM 1074568]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [3/17/2010 5:33 PM 28552]
S1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [4/21/2009 10:15 PM 114768]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/21/2009 10:15 PM 20560]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/6/2010 7:28 PM 135664]
S2 iPodDrv;iPodDrv;c:\windows\system32\drivers\iPodDrv.sys [12/12/2009 3:19 AM 6656]
S2 UltraMonUtility;UltraMon Utility Driver;c:\windows\system32\UltraMonUtility.sys [4/12/2004 5:37 PM 10288]
S3 CCCP106;CIF USB Camera (2110A);c:\windows\system32\DRIVERS\cccp106.sys –> c:\windows\system32\DRIVERS\cccp106.sys [?]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [12/25/2009 10:25 AM 18560]
S3 nuvaudio;NUVision Audio Service;c:\windows\system32\drivers\nuvaudio.sys [1/12/2007 7:47 PM 22848]
S3 NUVision;NUVision Video Service;c:\windows\system32\drivers\NUVision.sys [1/12/2007 7:47 PM 135424]
S3 PIXMCV;JVC Communication PIX-MCV Driver;c:\windows\system32\drivers\pixmcvc.sys [4/10/2005 1:58 PM 32000]
S3 PIXMCVA;JVC PIX-MCV Audio Capture;c:\windows\system32\drivers\pixmcva.sys [4/10/2005 1:56 PM 28057]
S3 PIXMCVV;JVC PIX-MCV Video Capture;c:\windows\system32\drivers\pixmcvv.sys [4/10/2005 1:56 PM 21081]
S3 UltraMonMirror;UltraMonMirror;c:\windows\system32\drivers\UltraMonMirror.sys [4/12/2004 5:38 PM 8240]
.
Contents of the 'Scheduled Tasks' folder

2010-03-18 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-09 17:14]

2010-03-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 23:28]

2010-03-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 23:28]

2010-03-18 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 19:07]

2005-02-25 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2005-02-25 20:06]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei;=utf-8&fr;=b1ie7
mStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {28A47114-C3F0-4EEE-827F-45F4EB6308D3} = 192.168.1.1
TCP: {370E624D-60AB-4E91-A51C-A77E39F82EC2} = 192.168.1.254
TCP: {D0D8C33C-FB24-4186-9BAC-7C17606BD69F} = 192.168.2.1
TCP: {F67AE8CF-2E3D-45F3-A0CC-81E07CF4D150} = 192.168.1.1
DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} - hxxp://activex.camfrogweb.com/advanced/2.0.2.3/cfweb_activex.camfrogweb.com-advanced-2.0.2.3_instmodule.exe
FF - ProfilePath - c:\documents and settings\Ignacio\Application Data\Mozilla\Firefox\Profiles\fjdi59q7.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.bing.com/
FF - prefs.js: keyword.URL -
FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\documents and settings\Ignacio\Local Settings\Application Data\Yahoo!\BrowserPlus\2.5.1\Plugins\npybrowserplus_2.5.1.dll
FF - plugin: c:\program files\Download Manager\npfpdlm.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1851.5542\npCIDetect14.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-18 09:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-484763869-789336058-839522115-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-484763869-789336058-839522115-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:6a,aa,77,bf,39,15,c3,5e,0a,03,28,8d,22,74,d1,2e,fe,08,fe,a8,8b,0a,2e,
45,49,0b,c6,0b,6d,21,75,4b,4e,26,50,7f,d6,84,0b,1f,a0,50,91,b9,ff,48,39,39,\
"??"=hex:a7,29,ff,60,c6,66,be,fb,a4,fe,a2,8c,7e,08,f5,80
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'lsass.exe'(800)
c:\windows\system32\relog_ap.dll
.
Completion time: 2010-03-18 09:46:42
ComboFix-quarantined-files.txt 2010-03-18 13:46
ComboFix2.txt 2010-03-18 01:54
ComboFix3.txt 2007-07-24 22:33

Pre-Run: 509,956,644,864 bytes free
Post-Run: 509,894,520,832 bytes free

- - End Of File - - 55400B3A36C3CD961AD8D09CAB342714
Post #28
Hi, Try and scan with the Kaspersky online scanner again make sure your security programs are disabled and all other programs closed: see if the scan will complete: If not try the ESET scanner:
Post #29 last edited

Hi,

Try and scan with the Kaspersky online scanner again

make sure your security programs are disabled and all other programs closed:

see if the scan will complete:

If not try the ESET scanner:


I can try the scans again, but I don't know how to disable the Avast AV program since it no longer shows up in my system tray. If I try to end the task via the Task Manager, it won't allow me to.

Edit: Never mind, it let me end the service from the Services menu.
Post #30 last edited
The Kaspersky still stops at the tracking.log file. I am trying ESET again, but I don't have high hopes of it being successful either. I am beginning to think I may have to end up reformatting and reinstalling Windows, though I really dread doing that. And my Avast is still not showing up in my system tray.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI