What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] IE redirects turned vicious

22 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
REPOST from the Laptop forum as suggested by Admin Doug (thanks Doug) Greetings. Fujitsu Nseries lifebook (bought new about 2 1/2 years ago) WinXP PRO service pack 2? (can't check it now) IE Explorer 6? ESET nod anti virus (just uninstalled, just now) For the past few months I've had this pop up window (fake) for scanning the HD then saying you need this blah blah (what everyone else pretty much got). Of course I knew what it was and always click [Alt] + F4 to get rid of the windows. Then the redirects started happening. Then a couple days ago upon startup the desktop wouldn't finish completing setup. The desk icons would flash off and the bottom bar wouldn't finish either (the sys tray icons as well), then it would try to come back and finish then repeat over and over. Somehow I managed to get to system restore and click on it before the desktop icons dissapeared again in this mad cycle. Even though this, the system restore window didn't go away and worked. I managed to go back to a Jan 2010 date and everything started to work. So I found this site on this Toshiba NB205 (mini notebook) and printed up the Pre-Instructions. I managed to get online to this site with the Fujitsu and download the ERUNT (Which I ran as directed), DDS and the GMER. At this point I went to the next step of 'Disable you Security Programs' so I can run the other two programs (DDS and GMER). Well the ESET NOD I have wouldn't let me because it wanted a password to do so. I don't remember it. I looked and looked. So I uninstalled it and was going to immediately install AVG. When I uninstalled the ESET and restarted the computer, I now get (just about 3 seconds after the windows splash svreen appears and before the blue dash appears that goes accross the lower middle of the screen in the elonggated small rectangle) a blue screen of death: "A problem has been detected and windows has been shut down to prevent damage to your computer. If this is the first time you've seen this stop error screen, restart… yada yada yada" Tech Info; ***stop: 0x0000007b (0xF7AAB524, 0xC0000034, the last two sets are all zeros) UPDATE: 1)The recovery CD's are as Doug said, they either destroy the HD or restore to original settings thus destroying all files. 2)I wonder if ESET took some necessary file(s) with it. I ran it before I uninstalled it and it said it found an "Object" and a "Threat" as
Post #2
Hi GGGGG, welcome to the forum.

To make cleaning this machine easier
  • Please do not uninstall/install any programs unless asked to
    It is more difficult when files/programs are appearing in/disappearing from the logs.
  • Please do not run any scans other than those requested
  • Please follow all instructions in the order posted
  • All logs/reports, etc.. must be posted in Notepad. Please ensure that word wrap is unchecked. In notepad click format, uncheck word wrap if it is checked.
  • Do not attach any logs/reports, etc.. unless specifically requested to do so.
  • If you have problems with or do not understand the instructions, Please ask before continuing.
  • Please stay with this thread until given the All Clear. A absence of symptoms does not mean a clean machine.

We will attempt to access your computer in a diferent manner. We will need a computer to create a bootable iso disk.

This iso has FireFox on it so you should be able go on line and return to this thread from the infected computer. We should also be able to run some scans on the computer now. Please do not use the infected computer for anything else.

Let's start with making the iso image.

Two programs to download

First

ISOBurner this will allow you to burn REATOGO-X-PE ISO to a cd and make it bootable. Just install the programme, from there on in it is fairly automatic. Instructions

Second

Download OTLPE Network.iso and burn to a CD using a program capable of burning an iso. NOTE: This file is 429Mb in size so it may take some time to download.

note: when saving this program make sure you save it with the save as file type set to all files and the file after it is downloaded is 429mb.

After the file is downloaded, double click it, this will then open ISOBurner to burn the file to CD.



After it has completed burning, put in cd in the effected computer and reboot.

On the ailing computer make sure the cd is set to be the first drive booted from. This can be set in the bios. When the computer is first started you should be given an option to boot to setup. You will be told which key to press to enter setup. As each computer is different you will need to look for a setting called Boot Order or similar. Follow the instructions there to set the cd first in the order. Save the changes, if you made any, and exit setup. The computer should now boot from the cd.

Please be patient as it is running from the cd and can be quiet slow. One of the first screens you will see is a confirmation it is booting from the cd. This will be followed by a screen saying starting Reatogo X PE. It may take awhile to load the necessary files. You should be presented with a light blue screen followed shorty by a Reatogo desktop. It will have what looks like a Swiss Army knife and some icons on it.

Please post back once you have made the iso and are on line or if you are having difficulty creating the iso.

Thanks
Post #3
Thanks Teacher, I will follow your instructions on Saturday March 20th. I've been having a series of disasters these last few days. The computer meltdown was the first. The latest was my roomates dog suddenly got the "squirts"!! lol
Post #5
Hi Teacher, Here is the latest. I am using a Toshiba NB205 mini notebook to communicate online currently (the greatest keyboard of them all, I can type super fast and no mistakes). This notebook however does not have a DVD/CD unit in it (hence 'mini'). I have an external DVD/CD burner however. But for some reason it refuses to 'obey' it's user (that would be me). I went on Sony's site to download drivers and the site interestingly informs me the external burner doesn't need one (for windows, which I have XP) It gave me some simple solutions to try if it doesn't work. They were too simple cuz they didn't work. It's a Sony Dual RW Drive - Double Layer Model DRX-700UL. I will have to try and use my other Dell Inspirion Laptop that's older and less protected (has Zone alarm that's expired but still on and the dredded ESET NOD that's expired but still on). I downloaded both programs to burn an ISO startup disc but since I cannot get the external burner to work with this mini laptop, I copied the download programs to a USB stick and will X-Fer them from the USB stick to the DELL laptop so I can used the external burner with that one. BUT I will check first to see if the external burner still works with the DELL (that was the laptop I originaly bought the burner for anyway) If it does, I will make the startup disc with it and then sail on with the journey. If for some reason that plan fails, I will bring the USB stick and a blank DVD somewhere that has a burner (maybe door to door in my neighborhood). Questions: Will a blank DVD be ok instead of a blank CD? The Fujitsu (the ill one) has a DVD burner in it. The first program I downloaded, the ISOburner, is a program I use to then burn the OTLPE Network.iso to the blank DVD? (which by the way I made sure to 'save as' "All files". Once the Fujitsu is able to get online following your instructions above, then I reply back to you to say I am able to get the Fujitsu online? If the answer is yes, then do I shut the Fujitsu off or let go into standby or try to put it in stand by? (to wait for the next instructions). Justin
Post #6
Teacher, I made the bootup iso disk on our new roomates laptop. Put the bootup disk in the Fujitsu and Bamm! It worked like a charm. Excellent igor. Now I feel like a kid in a candy store, especially when one of the 20 icons on the desktop says "Magical Jelly Bean Keyfinder"! You mentioned that this ISO has Firefox on it. One of the Icons says FirefoxPortable on it. Otherwise there is an IE icon in the lower left tray (next to the icon that says "show desktop". I am wary to click on it to see if I can get online. I'll await futher instruction, in the meantime I have an early appointment tomorrow (Monday). When I get back I'll check on the post. Actually I typed the windows logo button to access the shut off menu and turned it off. Life is looking a little brighter (as far as technology is concerned…) Justin
Post #7
Hi GGGGG,

Good job! FirefoxPortable is the one we want to use. Return to forum with the infected machine and follow these instructions for running a OTLPE scan.

On the desktop, please locate OTLPE
  • Double-click on the OTLPE icon.
  • When asked "Do you wish to load the remote registry", select Yes
  • When asked "Do you wish to load remote user profile(s) for scanning", select Yes
  • Ensure the box "Automatically Load All Remaining Users" is checked and press OK
  • OTL should now start. Change the following settings
    • Change Standard Registry to All
    • In the window under Custom Scans/Fixes copy and paste the following


      netsvcs
      %SYSTEMDRIVE%\*.exe
      /md5start
      eventlog.dll
      scecli.dll
      netlogon.dll
      cngaudit.dll
      sceclt.dll
      ntelogon.dll
      logevent.dll
      iaStor.sys
      nvstor.sys
      atapi.sys
      IdeChnDr.sys
      viasraid.sys
      AGP440.sys
      vaxscsi.sys
      nvatabus.sys
      viamraid.sys
      nvata.sys
      nvgts.sys
      iastorv.sys
      ViPrt.sys
      eNetHook.dll
      ahcix86.sys
      KR10N.sys
      nvstor32.sys
      ahcix86s.sys
      nvrd32.sys
      symmpi.sys
      adp3132.sys
      mv61xx.sys
      /md5stop
      %systemroot%\*. /mp /s
      %systemroot%\system32\*.dll /lockedfiles
      %systemroot%\Tasks\*.job /lockedfiles
      %systemroot%\system32\drivers\*.sys /lockedfiles
      %systemroot%\System32\config\*.sav


  • Press Run Scan to start the scan.
  • When finished, the file will be saved in drive C:\OTL.txt

Please post the OTLPE log in your next reply.

BTW, to shut down the computer, you can click the start button located at the bottom left of the REATOGO desktop. Click Shutdown.

Thanks
Post #8
OK TEACHER,

OTL logfile created on: 3/22/2010 3:34:46 PM - Run
OTLPE by OldTimer - Version 3.1.37.1 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 747.00 Mb Available Physical Memory | 73.00% Memory free
906.00 Mb Paging File | 750.00 Mb Available in Paging File | 83.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 92.15 Gb Total Space | 45.47 Gb Free Space | 49.34% Space Free | Partition Type: NTFS
Drive D: | 1.00 Gb Total Space | 0.99 Gb Free Space | 99.01% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive X: | 429.27 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO
Current User Name: SYSTEM
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - [2006/08/24 02:38:26 | 000,075,768 | —- | M] (Zone Labs, LLC) [On_Demand] – C:\WINDOWS\System32\ZoneLabs\vsmon.exe – (vsmon)
SRV - [2006/05/01 12:22:42 | 000,540,745 | —- | M] (Intel Corporation ) [Auto] – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe – (S24EventMonitor) Intel®
SRV - [2006/05/01 12:20:52 | 000,114,753 | —- | M] (Intel Corporation) [Auto] – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe – (EvtEng) Intel®
SRV - [2006/05/01 12:20:26 | 000,217,164 | —- | M] (Intel Corporation) [Auto] – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe – (RegSrvc) Intel®


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] – – (WPC54GSv1)
DRV - File not found [Kernel | On_Demand] – – (WDICA)
DRV - File not found [Kernel | On_Demand] – – (PDRFRAME)
DRV - File not found [Kernel | On_Demand] – – (PDRELI)
DRV - File not found [Kernel | On_Demand] – – (PDFRAME)
DRV - File not found [Kernel | On_Demand] – – (PDCOMP)
DRV - File not found [Kernel | System] – – (PCIDump)
DRV - File not found [Kernel | System] – – (lbrtfdc)
DRV - File not found [Kernel | Boot] – – (iaStor)
DRV - File not found [Kernel | System] – – (i2omgmt)
DRV - File not found [Kernel | System] – – (Changer)
DRV - [2007/12/27 19:06:09 | 000,051,176 | —- | M] (Zone Labs, LLC) [Kernel | Boot] – C:\WINDOWS\system32\ZoneLabs\srescan.sys – (srescan)
DRV - [2007/06/28 02:09:55 | 000,109,568 | —- | M] () [Kernel | System] – C:\WINDOWS\system32\drivers\SSHDRV64.sys – (SSHDRV64)
DRV - [2006/08/24 02:38:36 | 000,392,824 | —- | M] (Zone Labs, LLC) [Kernel | System] – C:\WINDOWS\system32\vsdatant.sys – (vsdatant)
DRV - [2006/06/06 12:51:06 | 000,022,528 | —- | M] (WALTOP International Corp.) [Kernel | System] – C:\WINDOWS\system32\drivers\aiptektp.sys – (aiptektp)
DRV - [2006/05/01 12:52:02 | 000,013,568 | —- | M] (Intel Corporation) [Kernel | Auto] – C:\WINDOWS\system32\drivers\s24trans.sys – (s24trans)
DRV - [2006/04/27 10:13:04 | 001,429,632 | —- | M] (Intel® Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\w39n51.sys – (w39n51) Intel®
DRV - [2005/12/20 08:51:46 | 001,419,264 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\ati2mtag.sys – (ati2mtag)
DRV - [2005/12/16 18:56:10 | 001,947,264 | —- | M] (AVerMedia Technologies, Inc.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\avusbpvr.sys – (AVUSBPVR)
DRV - [2005/12/09 03:48:40 | 004,123,136 | R— | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\RtkHDAud.Sys – (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2005/11/16 21:03:34 | 001,122,688 | R— | M] (Agere Systems) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\AGRSM.sys – (AgereSoftModem)
DRV - [2005/11/01 15:06:36 | 000,021,120 | —- | M] (FUJITSU LIMITED) [Kernel | Auto] – C:\Program Files\Fujitsu\BtnHnd\BtnHnd.sys – (BtnHnd)
DRV - [2005/10/19 01:49:50 | 000,051,328 | —- | M] (REDC) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\rimsptsk.sys – (rimsptsk)
DRV - [2005/10/19 01:08:50 | 000,033,280 | —- | M] (REDC) [Kernel | Boot] – C:\WINDOWS\system32\drivers\risdptsk.sys – (risdptsk)
DRV - [2005/07/21 18:56:22 | 000,007,196 | —- | M] (FUJITSU LIMITED) [Kernel | Auto] – C:\Program Files\Fujitsu\FlashAid\FlashDrv.sys – (FlashDrv)
DRV - [2005/07/21 04:12:34 | 000,134,272 | —- | M] (Broadcom Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\b57xp32.sys – (b57w2k)
DRV - [2005/06/28 19:43:39 | 000,046,592 | —- | M] (Microsoft Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\irbus.sys – (IrBus)
DRV - [2005/02/23 01:58:56 | 000,011,776 | —- | M] (Arcsoft, Inc.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\afc.sys – (Afc)
DRV - [2005/01/07 21:07:18 | 000,138,752 | —- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\Hdaudbus.sys – (HDAudBus)
DRV - [2004/12/06 01:57:14 | 000,307,456 | —- | M] (REDC) [Kernel | Boot] – C:\WINDOWS\system32\drivers\rixdptsk.sys – (rismxdp)
DRV - [2004/08/04 02:10:12 | 000,048,128 | —- | M] (Microsoft Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\61883.sys – (61883)
DRV - [2004/08/04 02:10:12 | 000,038,912 | —- | M] (Microsoft Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\avc.sys – (Avc)
DRV - [2004/08/04 02:10:00 | 000,051,328 | —- | M] (Microsoft Corporation) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\msdv.sys – (MSDV)
DRV - [2004/07/05 02:25:54 | 000,103,391 | R— | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\Apfiltr.sys – (ApfiltrService)
DRV - [2004/03/25 20:37:08 | 000,052,384 | —- | M] (MCCI) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\slabbus.sys – (slabbus) CP2101 USB Composite Device driver (WDM)
DRV - [2004/03/25 20:36:48 | 000,084,512 | —- | M] (MCCI) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\slabser.sys – (slabser)
DRV - [2004/01/17 07:15:20 | 000,004,864 | —- | M] (FUJITSU LIMITED) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\fuj02e3.sys – (FUJ02E3)
DRV - [2003/12/04 14:33:20 | 000,011,264 | —- | M] (Pinnacle Systems GmbH) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\asapiW2k.sys – (ASAPIW2k)
DRV - [2001/08/01 08:00:22 | 000,005,248 | —- | M] (FUJITSU LIMITED) [Kernel | On_Demand] – C:\WINDOWS\system32\drivers\fuj02b1.sys – (FUJ02B1)
DRV - [1999/11/18 04:20:00 | 000,003,872 | —- | M] (FUJITSU LIMITED.) [Kernel | On_Demand] – C:\WINDOWS\System32\drivers\ADVNTDRV.SYS – (ADVNTDRV)


========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.computers.us.fujitsu.com/
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p…ER}&ar=home
IE - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie


IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.computers.us.fujitsu.com/
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.drudgereport.com/
IE - HKU\Administrator_ON_C\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation)
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\LocalService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.computers.us.fujitsu.com/

IE - HKU\NetworkService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.computers.us.fujitsu.com/




O1 HOSTS File: ([2009/03/16 15:26:18 | 000,302,790 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 10436 more lines…
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKU\Administrator_ON_C\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKU\Administrator_ON_C\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKU\Administrator_ON_C\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AGRSMMSG] C:\WINDOWS\AGRSMMSG.exe (Agere Systems)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [ATICCC] C:\Program Files\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [atwtusb] C:\WINDOWS\System32\atwtusb.exe (Aiptek)
O4 - HKLM..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe (Microsoft Corporation)
O4 - HKLM..\Run: [FJUPDNV_Chitose] C:\Program Files\Fujitsu\fjdvrupd\fjdvrupd.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [LoadFUJ02E3] C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [LoadFujitsuQuickTouch] C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe (FUJITSU LIMITED)
O4 - HKLM..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe ()
O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.)
O4 - HKU\Administrator_ON_C..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE (SEIKO EPSON CORPORATION)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\EventLogger.lnk = C:\Program Files\JM Integrated Remote Station\CMS\EventLogger.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} http://activation.rr.com/install/downloads/tgctlcm.cab (Support.com Configuration Class)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {BDA70B08-C44E-48AB-BAEC-F119CE92223B} http://www.pjtv.com/player/player_ocx.jpeg (VPlayer Control)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O24 - Desktop WallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005/12/16 14:30:42 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R— | M] () - X:\AUTORUN.INF – [ CDFS ]
O33 - MountPoints2\{7ffa8a24-ebf4-11dd-880f-001302e1928b}\Shell - "" = AutoRun
O33 - MountPoints2\{7ffa8a24-ebf4-11dd-880f-001302e1928b}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{7ffa8a24-ebf4-11dd-880f-001302e1928b}\Shell\AutoRun\command - "" = F:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - C:\WINDOWS\system32\ias [2005/12/16 14:30:09 | 000,000,000 | —D | M]
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/03/16 02:31:25 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2010/03/16 02:10:39 | 000,000,000 | —D | C] – C:\WINDOWS\ERDNT
[2010/03/16 02:09:29 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/03/16 01:31:59 | 000,791,393 | —- | C] (Lars Hederer ) – C:\Documents and Settings\Administrator\Desktop\erunt_setup.exe
[2010/03/15 17:47:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\used pics
[2010/03/15 17:47:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Desktop\New Folder
[2010/03/15 02:55:33 | 000,000,000 | —D | C] – C:\Documents and Settings\Administrator\Local Settings\Application Data\{63EC125B-FD52-4E8A-B334-39CC5B8D1DEB}
[2010/03/15 01:58:54 | 000,000,000 | —D | C] – C:\WEB_BACKUP
[2010/03/03 21:20:39 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\ESET
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/03/16 02:32:04 | 001,118,208 | —- | M] () – C:\Documents and Settings\NetworkService\NTUSER.DAT
[2010/03/16 02:32:04 | 001,118,208 | —- | M] () – C:\Documents and Settings\LocalService\ntuser.dat
[2010/03/16 02:32:03 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/03/16 02:32:01 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/03/16 02:31:57 | 007,864,320 | —- | M] () – C:\Documents and Settings\Administrator\ntuser.dat
[2010/03/16 02:31:57 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Administrator\ntuser.ini
[2010/03/16 02:31:52 | 007,199,096 | -H– | M] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\IconCache.db
[2010/03/16 02:09:34 | 000,000,611 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk
[2010/03/16 02:09:34 | 000,000,592 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\ERUNT.lnk
[2010/03/16 01:43:30 | 000,000,382 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\What The Tech.url
[2010/03/16 01:43:19 | 000,015,327 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\HELPPP.rtf
[2010/03/16 01:35:11 | 000,009,662 | —- | M] () – C:\WINDOWS\EPISME00.SWB
[2010/03/16 01:33:52 | 000,293,376 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\64ju5i1o.exe
[2010/03/16 01:32:15 | 000,791,393 | —- | M] (Lars Hederer ) – C:\Documents and Settings\Administrator\Desktop\erunt_setup.exe
[2010/03/16 01:31:34 | 000,359,929 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\dds.scr
[2010/03/15 17:53:34 | 000,441,626 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/03/15 17:53:34 | 000,382,260 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/03/15 17:53:34 | 000,053,838 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/03/15 17:49:11 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/03/15 03:04:28 | 000,000,000 | —- | M] () – C:\WINDOWS\Jnesebosuyeganow.bin
[2010/03/15 02:55:34 | 000,000,120 | —- | M] () – C:\WINDOWS\Hduquwowohon.dat
[2010/03/15 02:51:37 | 000,000,020 | —- | M] () – C:\Documents and Settings\NetworkService\Application Data\rbuwzv.dat
[2010/03/15 02:51:31 | 000,000,004 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\avdrn.dat
[2010/03/15 01:48:06 | 104,911,360 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\DVR_10.AJP
[2010/03/15 01:48:06 | 000,221,696 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\DVR_11.AJP
[2010/03/15 01:43:49 | 104,911,360 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\DVR_09.AJP
[2010/03/15 01:40:56 | 104,911,360 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\DVR_08.AJP
[2010/03/15 01:38:39 | 104,911,360 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\DVR_07.AJP
[2010/03/15 01:36:42 | 104,911,360 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\DVR_06.AJP
[2010/03/15 01:34:40 | 104,911,360 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\DVR_05.AJP
[2010/03/15 01:32:43 | 104,911,360 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\DVR_04.AJP
[2010/03/15 01:30:44 | 104,908,288 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\DVR_03.AJP
[2010/03/15 01:28:46 | 104,911,360 | —- | M] () – C:\Documents and Settings\Administrator\My Documents\DVR_02.AJP
[2010/03/03 22:19:02 | 000,165,989 | —- | M] () – C:\Documents and Settings\Administrator\Desktop\wireless event viewer log 1.bin
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/03/16 02:09:34 | 000,000,611 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk
[2010/03/16 02:09:34 | 000,000,592 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\ERUNT.lnk
[2010/03/16 01:43:29 | 000,000,382 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\What The Tech.url
[2010/03/16 01:43:19 | 000,015,327 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\HELPPP.rtf
[2010/03/16 01:33:51 | 000,293,376 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\64ju5i1o.exe
[2010/03/16 01:31:33 | 000,359,929 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\dds.scr
[2010/03/15 02:55:34 | 000,000,120 | —- | C] () – C:\WINDOWS\Hduquwowohon.dat
[2010/03/15 02:55:34 | 000,000,000 | —- | C] () – C:\WINDOWS\Jnesebosuyeganow.bin
[2010/03/15 02:51:37 | 000,000,020 | —- | C] () – C:\Documents and Settings\NetworkService\Application Data\rbuwzv.dat
[2010/03/15 02:51:31 | 000,000,004 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\avdrn.dat
[2010/03/15 01:48:06 | 000,221,696 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\DVR_11.AJP
[2010/03/15 01:43:49 | 104,911,360 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\DVR_10.AJP
[2010/03/15 01:40:56 | 104,911,360 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\DVR_09.AJP
[2010/03/15 01:38:39 | 104,911,360 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\DVR_08.AJP
[2010/03/15 01:36:42 | 104,911,360 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\DVR_07.AJP
[2010/03/15 01:34:40 | 104,911,360 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\DVR_06.AJP
[2010/03/15 01:32:43 | 104,911,360 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\DVR_05.AJP
[2010/03/15 01:30:44 | 104,911,360 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\DVR_04.AJP
[2010/03/15 01:28:46 | 104,908,288 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\DVR_03.AJP
[2010/03/15 01:26:32 | 104,911,360 | —- | C] () – C:\Documents and Settings\Administrator\My Documents\DVR_02.AJP
[2010/03/03 22:19:02 | 000,165,989 | —- | C] () – C:\Documents and Settings\Administrator\Desktop\wireless event viewer log 1.bin
[2009/09/20 17:06:44 | 000,000,425 | —- | C] () – C:\Program Files\rootscan page 1.txt
[2009/09/20 17:03:09 | 000,001,626 | —- | C] () – C:\Program Files\rootscan info.txt
[2009/09/13 17:09:07 | 000,057,344 | —- | C] () – C:\WINDOWS\System32\Funckey.dll
[2009/09/13 17:09:07 | 000,003,320 | —- | C] () – C:\WINDOWS\aiptbl.ini
[2009/05/13 04:44:08 | 000,000,251 | —- | C] () – C:\Program Files\wt3d.ini
[2009/05/02 18:32:26 | 000,000,187 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\G-Force Prefs (WindowsMediaPlayer).txt
[2007/08/08 00:26:04 | 000,000,790 | —- | C] () – C:\Documents and Settings\Administrator\Application Data\wklnhst.dat
[2007/08/06 23:19:24 | 000,002,723 | —- | C] () – C:\WINDOWS\DevMgr.ini
[2007/08/06 23:14:03 | 000,000,020 | —- | C] () – C:\WINDOWS\Hposcv07.INI
[2007/08/02 21:19:35 | 000,000,029 | —- | C] () – C:\WINDOWS\DEBUGSM.INI
[2007/08/02 20:46:16 | 000,096,768 | —- | C] () – C:\WINDOWS\SlantAdj.dll
[2007/08/02 20:46:16 | 000,000,072 | —- | C] () – C:\WINDOWS\System32\epDPE.ini
[2007/08/02 20:44:59 | 000,000,018 | —- | C] () – C:\WINDOWS\Epson1240U.ini
[2007/06/28 02:09:55 | 000,109,568 | —- | C] () – C:\WINDOWS\System32\drivers\SSHDRV64.sys
[2007/06/25 22:41:03 | 000,056,320 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/06/11 23:29:23 | 000,796,584 | —- | C] () – C:\WINDOWS\System32\libeay32_0.9.6l.dll
[2007/05/22 22:14:58 | 000,008,520 | —- | C] () – C:\WINDOWS\System32\ractrlkeyhook.dll
[2006/01/12 21:21:27 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2005/12/19 23:35:35 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2005/12/17 01:10:56 | 000,135,168 | R— | C] () – C:\WINDOWS\System32\RtlCPAPI.dll
[2005/12/16 19:18:05 | 000,000,059 | —- | C] () – C:\WINDOWS\WININIT.INI
[2005/12/16 19:11:33 | 000,000,174 | —- | C] () – C:\WINDOWS\QUICKEN.INI
[2005/12/16 15:21:32 | 000,000,136 | —- | C] () – C:\Documents and Settings\Administrator\Local Settings\Application Data\fusioncache.dat
[2005/12/16 14:49:04 | 000,001,514 | —- | C] () – C:\WINDOWS\System32\FJSaver.ini
[2005/12/16 14:26:36 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2005/12/16 13:14:36 | 000,000,505 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2005/12/16 13:10:29 | 000,027,440 | —- | C] () – C:\WINDOWS\System32\drivers\secdrv.sys
[2005/12/16 13:09:52 | 000,081,920 | —- | C] () – C:\WINDOWS\System32\ieencode.dll
[2005/11/02 22:28:20 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2005/08/05 18:01:54 | 000,235,008 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/04/23 15:17:02 | 000,000,061 | —- | C] () – C:\WINDOWS\System32\uninstall.ini
[2003/12/22 17:40:06 | 001,663,068 | —- | C] () – C:\WINDOWS\System32\libmmd.dll

========== LOP Check ==========

[2007/06/27 23:21:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Leadertech
[2009/09/13 00:27:40 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\PlayFirst
[2008/12/02 23:32:27 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator\Application Data\Template

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2004/08/10 08:00:00 | 016,971,599 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2004/08/10 08:00:00 | 016,971,599 | —- | M] () .cab file – C:\WINDOWS\i386\sp2.cab:AGP440.sys

< MD5 for: ATAPI.SYS >
[2004/08/10 08:00:00 | 016,971,599 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2004/08/10 08:00:00 | 016,971,599 | —- | M] () .cab file – C:\WINDOWS\i386\sp2.cab:atapi.sys
[2004/08/04 02:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/10 08:00:00 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0006\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2004/08/10 08:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\system32\eventlog.dll

< MD5 for: IASTOR.SYS >
[2005/10/11 23:07:12 | 000,874,240 | —- | M] (Intel Corporation) MD5=309C4D86D989FB1FCF64BD30DC81C51B – C:\WINDOWS\OemDir\iaStor.sys

< MD5 for: NETLOGON.DLL >
[2004/08/10 08:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\system32\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/10 08:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2006/06/26 13:37:10 | 000,148,480 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\dnsapi.dll
[2004/08/10 08:00:00 | 000,274,944 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\mstask.dll
[2004/08/10 08:00:00 | 000,067,072 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\ntdsapi.dll
[2007/06/15 04:12:30 | 001,498,112 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\shdocvw.dll
[2006/12/19 17:52:18 | 008,453,632 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\shell32.dll
[3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2005/12/16 06:23:56 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2005/12/16 06:23:56 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2005/12/16 06:23:56 | 000,901,120 | —- | M] () – C:\WINDOWS\system32\config\system.sav
< End of report >


Everything going as you have said.

Justin
Post #9
Also, this line: O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\EventLogger.lnk = C:\Program Files\JM Integrated Remote Station\CMS\EventLogger.exe () Is software for viewing my home security cams. I don't use the 'event logger'. I need to remove it from startup. Justin
Post #10
Hi GGGGG,

Let's see if this will get your computer tp boot normally.

Boot with the OTLPE disk as you did before.

Double click "MY Computer"
  • Double click local drive(c:)
  • At the top click Folders
  • Next click View
  • Click Folder Options
  • Click the view tab
  • check Display the contents of system folders
  • check Show hidden files and folders
  • uncheck "Hide extensions for known file types" box
  • uncheck "Hide protecting operating system files" box
Click apply, click ok

Navigate to this folder C:\WINDOWS\OemDir

  • In the right hand panel locate this file iaStor.sys
  • Right click it and select copy

Next, in the left hand panel, navigate to this folder C:\WINDOWS\system32\drivers
  • Right click on the drivers folder and select paste.

Please confirm the presence of iaStor.sys in the left hand panel. Please note iaStor.sys may be located at the bottom of the list.

Close the window.

Next, Double click on OTLPE.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Services

:OTL
[2010/03/15 03:04:28 | 000,000,000 | —- | M] () – C:\WINDOWS\Jnesebosuyeganow.bin
[2010/03/15 02:55:34 | 000,000,120 | —- | M] () – C:\WINDOWS\Hduquwowohon.dat
[2010/03/15 02:51:37 | 000,000,020 | —- | M] () – C:\Documents and Settings\NetworkService\Application Data\rbuwzv.dat
[2010/03/15 02:51:31 | 000,000,004 | —- | M] () – C:\Documents and Settings\Administrator\Application Data\avdrn.dat

Then click the Run Fix button at the top
  • Let the program run unhindered
Should OTLPE request a reboot, please allow it but boot back into the computer with the CD iso to allow OTLPE to finish.

Once the program has finished, if the log doesn't popup you will find it at C:\_OTL\MovedFiles

Please post the log then click the start button located at the bottom left of the REATOGO desktop. Click Shutdown.

The CD should eject and the computer will shut down. Try to boot the computer normally. Let me know if you are in normal windows and we will continue.

Thanks
Post #11
Teacher, Followed instructions. When I clicked on the OTLPE to use it, a small window popped up first: the header was "runscanner" the message was: "Do you wish to load remote user profile(s) for scanning? I selected NO (since we were not scanning this time anyway) Here is the log: ========== SERVICES/DRIVERS ========== ========== OTL ========== C:\WINDOWS\Jnesebosuyeganow.bin moved successfully. C:\WINDOWS\Hduquwowohon.dat moved successfully. C:\Documents and Settings\NetworkService\Application Data\rbuwzv.dat moved successfully. C:\Documents and Settings\Administrator\Application Data\avdrn.dat moved successfully. OTLPE by OldTimer - Version 3.1.37.1 log created on 03232010_155350 I will now follow the rest of your instructions and post the results. BTY, OTLPE did not ask to reboot. So this will be the first reboot without CD. Justin
Post #12
Teacher,
Yes the Fujitsu boots normally!
After it was finished, I turned it off and am now on the Mini laptop. I imagine the malware is still there.
Waiting for the next step.

Also, in the previous instructions just a quick note:
1) Double click local drive(c:)
At the top click Folders
Next click View should be Tools
Click Folder Options
Click the view tab



2) Please confirm the presence of iaStor.sys in the left hand panel. Please note iaStor.sys may be located at the bottom of the list.
should be 'Right' hand panel'


I mention this in case someone else is reading this post.

Justin
Post #13
Hi GGGGG,

Thanks, I missed that when I edited that fix for your computer.

Boot your computer normally and we'll work directly in Windows.

Please read through these instructions to familarize yourself with what to expect when this tool runs

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Next

Please open windows explorer and navigate to this folder C:\Qoobox . In the right hand panel locate this file
  • Add-Remove Programs.txt

Please post back with
  • combofix.txt
  • add-remove programs.txt
Thanks
Post #15
OK teacher, ComboFix 10-03-23.03 - Administrator 03/24/2010 2:31.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1022.617 [GMT -7:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe FW: ZoneAlarm Pro Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Administrator\Local Settings\Application Data\{63EC125B-FD52-4E8A-B334-39CC5B8D1DEB} c:\documents and settings\Administrator\Local Settings\Application Data\{63EC125B-FD52-4E8A-B334-39CC5B8D1DEB}\chrome\content\_cfg.js c:\documents and settings\Administrator\Local Settings\Application Data\{63EC125B-FD52-4E8A-B334-39CC5B8D1DEB}\chrome\content\overlay.xul c:\documents and settings\Administrator\Local Settings\Application Data\{63EC125B-FD52-4E8A-B334-39CC5B8D1DEB}\install.rdf c:\windows\explorer(2).exe c:\windows\system32\lowsec c:\windows\system32\lowsec\user.ds.lll c:\windows\system32\Settings c:\windows\system32\Settings\Settings.ini c:\windows\system32\uninstall.exe . ((((((((((((((((((((((((( Files Created from 2010-02-24 to 2010-03-24 ))))))))))))))))))))))))))))))) . 2010-03-16 06:09 . 2010-03-16 06:10 ——– d—–w- c:\program files\ERUNT 2010-03-15 21:47 . 2010-03-15 21:47 ——– d—–w- c:\windows\system32\wbem\Repository 2010-03-15 05:58 . 2010-03-15 06:11 ——– d—–w- C:\WEB_BACKUP 2010-03-04 01:20 . 2010-03-04 01:20 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-03-15 21:47 . 2009-01-28 04:13 ——– d—–w- c:\documents and settings\Administrator\Application Data\U3 2010-03-15 21:37 . 2007-07-06 23:00 ——– d—–w- c:\program files\Spybot - Search & Destroy 2009-09-20 21:06 . 2009-09-20 21:06 425 —-a-w- c:\program files\rootscan page 1.txt 2009-09-20 21:03 . 2009-09-20 21:03 1626 —-a-w- c:\program files\rootscan info.txt 2009-05-13 08:44 . 2009-05-13 08:44 251 —-a-w- c:\program files\wt3d.ini . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "EPSON Stylus Photo R300 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE" [2003-06-04 99840] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "atwtusb"="atwtusb.exe beta" [X] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056] "AGRSMMSG"="AGRSMMSG.exe" [2005-11-17 88203] "Apoint"="c:\program files\Apoint2K\Apoint.exe" [2004-07-02 163840] "IndicatorUtility"="c:\program files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2005-08-09 81920] "LoadFUJ02E3"="c:\program files\Fujitsu\FUJ02E3\FUJ02E3.exe" [2005-06-08 69632] "LoadFujitsuQuickTouch"="c:\program files\Fujitsu\Application Panel\QuickTouch.exe" [2005-11-01 242688] "LoadBtnHnd"="c:\program files\Fujitsu\BtnHnd\BtnHnd.exe" [2005-11-01 61440] "RTHDCPL"="RTHDCPL.EXE" [2005-12-09 15691264] "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-05-01 667718] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-05-01 602182] "FJUPDNV_Chitose"="c:\program files\Fujitsu\fjdvrupd\fjdvrupd.exe" [2005-11-18 303104] "PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2003-12-04 406016] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-8-2 113664] Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696] EventLogger.lnk - c:\program files\JM Integrated Remote Station\cms\EventLogger.exe [2009-9-20 94208] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^EPSON SMART PANEL for Scanner.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\EPSON SMART PANEL for Scanner.lnk backup=c:\windows\pss\EPSON SMART PANEL for Scanner.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R300 Series] 2003-06-04 10:00 99840 —-a-w- c:\windows\system32\spool\drivers\w32x86\3\E_S4I2F1.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] 2004-07-15 09:07 32768 —-a-w- c:\program files\CyberLink Codec\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\JM Integrated Remote Station\\CMS\\EventLogger.exe"= "c:\\Program Files\\SkyGolf\\SkyCaddie Desktop\\SkyCaddieDesktop.exe"= "c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= R1 SSHDRV64;SSHDRV64;c:\windows\system32\drivers\SSHDRV64.sys [6/27/2007 11:09 PM 109568] R2 FlashDrv;FlashDrv;c:\progra~1\Fujitsu\FlashAid\FlashDrv.sys [12/16/2005 4:17 PM 7196] R3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\drivers\fuj02e3.sys [12/16/2005 11:50 AM 4864] S1 aiptektp;Pen Pad;c:\windows\system32\drivers\aiptektp.sys [9/13/2009 2:09 PM 22528] S3 ADVNTDRV;ADVNTDRV;c:\windows\system32\drivers\ADVNTDRV.SYS [11/18/1999 1:20 AM 3872] S3 AVUSBPVR;AVerMedia USB MPEG-2 Capture Device;c:\windows\system32\drivers\avusbpvr.sys [12/16/2005 3:56 PM 1947264] S3 WPC54GSv1;Linksys Wireless Notebook Adapter WPC54GSv1 Driver;c:\windows\system32\DRIVERS\WPC54GSv1.SYS –> c:\windows\system32\DRIVERS\WPC54GSv1.SYS [?] . . ——- Supplementary Scan ——- . uStart Page = hxxp://www.drudgereport.com/ uInternet Connection Wizard,ShellNext = hxxp://www.computers.us.fujitsu.com/ uSearchURL,(Default) = hxxp://www.google.com/keyword/%s IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 DPF: {BDA70B08-C44E-48AB-BAEC-F119CE92223B} - hxxp://www.pjtv.com/player/player_ocx.jpeg . - - - - ORPHANS REMOVED - - - - Notify-WgaLogon - (no file) AddRemove-SLABCOMM - c:\windows\system32\uninstall.exe ************************************************************************** scanning hidden processes … scanning hidden autostart entries … HKCU\Software\Microsoft\Windows\CurrentVersion\Run EPSON Stylus Photo R300 Series = c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 "EPSON Stylus Photo R300 Series" /M "Stylus Photo R300" /EF "HKCU"??????????????????YB~????????????????p????????????????????YB~????p???????????8???????????X?C~????p???????j?C~p??????????????|??????? scanning hidden files … scan completed successfully hidden files: ************************************************************************** . ——————— LOCKED REGISTRY KEYS ——————— [HKEY_USERS\S-1-5-21-3825968557-2407206787-366606322-500\Software\Microsoft\SystemCertificates\AddressBook*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'winlogon.exe'(1004) c:\windows\system32\Ati2evxx.dll . Completion time: 2010-03-24 02:36:30 ComboFix-quarantined-files.txt 2010-03-24 09:36 Pre-Run: 48,889,466,880 bytes free Post-Run: 50,473,623,552 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect - - End Of File - - 364A0B2734A902CA7C33A036F3A516C9 Adobe Flash Player 10 ActiveX Adobe Photoshop 6.0 Adobe Reader 7.0.5 Adobe Shockwave Player 11.5 Adobe SVG Viewer Agere Systems HDA Modem ALPS Touch Pad Driver Are You Smarter Than a 5th Grader ATI - Software Uninstall Utility ATI Catalyst Control Center ATI Display Driver AVerMedia E882 Driver Uninstaller CP2101 USB to UART Bridge Controller CyberLink Codec EPSON Printer Software EPSON SMART PANEL for Scanner ERUNT 1.1j ESPNMotion FlashAid Fujitsu Driver Update Fujitsu Hotkey Utility Fujitsu System Extension Utility GemMaster Mystic High Definition Audio Driver Package - KB888111 HijackThis 2.0.2 Hotfix for Windows Media Player 10 (KB903157) Hotfix for Windows XP (KB888795) Hotfix for Windows XP (KB891593) Hotfix for Windows XP (KB895961) Hotfix for Windows XP (KB896256) Hotfix for Windows XP (KB899337) Hotfix for Windows XP (KB899510) Hotfix for Windows XP (KB902841) Hotfix for Windows XP (KB935448) HyperPen USB Manager Intel® PROSet/Wireless Software JM Integrated Remote Station LifeBook Application Panel mCore mDriver mDrWiFi mHelp Microsoft .NET Framework 1.0 Hotfix (KB887998) Microsoft .NET Framework 1.0 Hotfix (KB930494) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft Office 2000 Standard Microsoft Works mIWA mLogView mMHouse mPfMgr mPfWiz mProSafe MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) mWlsSafe mXML mZConfig Otto Pinnacle Hollywood FX 5 Quicken 2006 Realtek High Definition Audio Driver Road Runner Install Roxio RecordNow Audio Roxio RecordNow Copy Roxio RecordNow Data Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899589) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB929969) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933566) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937143) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938829) SkyCaddie Desktop SlideShow Expressions Spybot - Search & Destroy Spybot - Search & Destroy 1.5.2.20 Studio 9 Update for Windows Media Player 10 (KB913800) Update for Windows Media Player 10 (KB926251) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB912945) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB933360) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Update Rollup 2 for Windows XP Media Center Edition 2005 WebFldrs XP Windows Installer 3.1 (KB893803) Windows Media Format Runtime Windows XP Hotfix - KB873339 Windows XP Hotfix - KB884018 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887797 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888239 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB889673 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Windows XP Media Center Edition 2005 KB925766 ZoneAlarm Pro Thanks, Justin

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI