Spyware / Malware / Virus Removal

[Resolved] whats going on

7 min read

Looking for the outcome? Ask AI

shucky Topic Starter

Post #1April 26, 2010, 11:34 AM UTC

I have been infected with something with is running a muck at the moment. My Trend micro will load at startup then quickly shut down some websites I have been too such as msn, yahoo ect over the last hour is producing a security warning basicly saying the site is harmful to my pc,. I have ran MBAM scan after scan. My AV is usless as at the moment. Below you'll see my MBAM and HJT logs. As far as the Mozilla goes I never downloaded or used it I'm strictly IE man. Mozilla Firefox is not listed in my ADD/Remove progs list.
MBAM LOG
Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 3930

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

4/26/2010 12:24:09 PM
mbam-log-2010-04-26 (12-24-09).txt

Scan type: Full scan (C:\|)
Objects scanned: 223931
Time elapsed: 1 hour(s), 39 minute(s), 17 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 2
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 4
Files Infected: 14

Memory Processes Infected:
C:\Documents and Settings\Carl Lary\Application Data\SystemProc\lsass.exe (Trojan.Agent) -> No action taken. DELETED

Memory Modules Infected:
C:\WINDOWS\system32\docprop32.dll (Trojan.Agent) -> No action taken. DELETED
C:\WINDOWS\system32\iasacct32.dll (Trojan.Tracur) -> No action taken. DELETED

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{03689446-1554-4513-a9e3-4ff981172d7d} (Trojan.BHO.H) -> No action taken. (Deleted)
HKEY_CLASSES_ROOT\CLSID\{03689446-1554-4513-a9e3-4ff981172d7d} (Trojan.BHO.H) -> No action taken. (DELETED)
HKEY_CLASSES_ROOT\.fsharproj (Trojan.Tracur) -> No action taken. (DELETED)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\262916f0891 (Trojan.Tracur) -> No action taken.( DELETED)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (DELETED) (Trojan.Tracur) -> Data: c:\windows\system32\iasacct32.dll -> No action taken.DELETED
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Tracur) -> Data: system32\iasacct32.dll -> No action taken. DELETED —-> KEY NAMED LoadAppInit_DLLs is shown

Folders Infected:
C:\Documents and Settings\Carl Lary\Application Data\SystemProc (Trojan.Agent) -> No action taken. should I delete sysproc folder? all else in it has been deleted
C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D} (Worm.Prolaco.M) -> No action taken. (DELETED)
C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome (Worm.Prolaco.M) -> No action taken.(DLEETED)
C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content (Worm.Prolaco.M) -> No action taken. (DELETED)

Where would have the Mozilla firefox files and folders came from? I dont use it Only IE.

Files Infected:
C:\WINDOWS\system32\docprop32.dll (Trojan.BHO.H) -> No action taken. deleted
C:\Documents and Settings\Carl Lary\Application Data\SystemProc\lsass.exe (Trojan.Agent) -> No action taken. ( DELETED)
C:\Documents and Settings\Carl Lary\Application Data\SystemProc\upd.exe (Trojan.Agent) -> No action taken. ( DELETED)
C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf (Worm.Prolaco.M) -> No action taken. (DELETED THE WHOLE MOZILLA FOLDER)
C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest (Worm.Prolaco.M) -> No action taken.(DELETED THE WHOLE MOZILLA FOLDER)
C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul (Worm.Prolaco.M) -> No action taken.(DELETED THE WHOLE MOZILLA FOLDER)
C:\WINDOWS\system32\ftsrch32.dll (Trojan.Tracur) -> No action taken. DELETED
C:\WINDOWS\system32\dmime32.dll (Trojan.Agent) -> No action taken. DELETED
C:\WINDOWS\system32\iasacct32.dll (Trojan.Tracur) -> No action taken. (DELETED)
C:\WINDOWS\system32\icmui32.dll (Trojan.FakeAlert) -> No action taken. (DELETED)
C:\WINDOWS\system32\ifmon32.dll (Trojan.Agent) -> No action taken. DELETED
C:\WINDOWS\system32\jet50032.dll (Trojan.Agent) -> No action taken.DELETED

HJT log
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:55:56 PM, on 4/26/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TiVo\Desktop\TiVoBeacon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGP.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TiVo\Desktop\Plus\TranscodingService.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFHP.EXE
C:\Program Files\NewSoft\Presto! PageManager 8 for EP\PMSpeed.EXE
C:\Program Files\TiVo\Desktop\TiVoTransfer.exe
C:\Program Files\TiVo\Desktop\TiVoNotify.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ninemsn.com.au
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ninemsn.com.au/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [EPSON Stylus Photo RX530 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGP.EXE /P31 "EPSON Stylus Photo RX530 Series" /O6 "USB001" /M "Stylus Photo RX530"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WebEx Document Loader] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGP.EXE /P21 "WebEx Document Loader" /O26 "WebEx Document Loader Port" /M "Stylus Photo RX530"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [FUFAXSTM] "C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe"
O4 - HKLM\..\Run: [EEventManager] C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
O4 - HKLM\..\Run: [WrtMon.exe] C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\Wcescomm.exe"
O4 - HKCU\..\Run: [TranscodingService] C:\Program Files\TiVo\Desktop\Plus\\TranscodingService.exe
O4 - HKCU\..\Run: [EPSON TX510FN Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFHP.EXE /FU "C:\WINDOWS\TEMP\E_S17A.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [PMSpeed] C:\Program Files\NewSoft\Presto! PageManager 8 for EP\PMSpeed.EXE
O4 - HKCU\..\Run: [TivoServer] C:\Program Files\TiVo\Desktop\TiVoServer.exe /service /registry
O4 - HKCU\..\Run: [TivoTransfer] C:\Program Files\TiVo\Desktop\TiVoTransfer.exe
O4 - HKCU\..\Run: [TivoNotify] C:\Program Files\TiVo\Desktop\TiVoNotify.exe /service /registry /auto:TivoNotify
O4 - HKUS\S-1-5-19\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: wkcalrem.LNK = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - I:\\Paltalk.exe (file missing)
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://catalog.update.microsoft.com/v7/sit…b?1240576235745
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1240576117011
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1260604066218
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2003120…all/xscan53.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
O16 - DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} (Windows Live Hotmail Photo Upload Tool) - http://gfx1.hotmail.com/mail/w4/pr01/photo…ol/MSNPUpld.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: EPSON V5 Service4(01) (EPSON_EB_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: TiVo Beacon Service (TivoBeacon2) - TiVo Inc. - C:\Program Files\TiVo\Desktop\TiVoBeacon.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
O23 - Service: TwonkyMedia - PacketVideo - C:\Program Files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe

–
End of file - 11462 bytes

Blade81

Post #2April 26, 2010, 3:12 PM UTC

Hi,

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.

When done, DDS will open two (2) logs:
- DDS.txt
- Attach.txt
Save both reports to your desktop. Post them back to your topic.

—

Download GMER here by clicking download exe -button and then saving it your desktop:

Double-click .exe that you downloaded
Click rootkit-tab, uncheck files option and then click scan.
Don't check
Show All
box while scanning in progress!
When scanning is ready, click Copy.
This copies log to clipboard
Post log (if the log is long, archive it into a zip file and attach instead of posting) in your reply.

shucky

Post #3April 27, 2010, 8:34 AM UTC

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 4/24/2009 8:19:04 PM
System Uptime: 4/27/2010 3:58:45 AM (1 hours ago)

Motherboard: Acer | | E61ML
Processor: Intel® Pentium® 4 CPU 3.00GHz | Socket 478 | 3000/200mhz
Processor: Intel® Pentium® 4 CPU 3.00GHz | Socket 478 | 3000/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (FAT32) - 233 GiB total, 168.599 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
G: is Removable
H: is Removable

==== Disabled Device Manager Items =============

Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia 6500s-1
Device ID: ROOT\WPD\0000
Manufacturer: Nokia
Name: Nokia 6500s-1
PNP Device ID: ROOT\WPD\0000
Service: WUDFRd

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

µTorrent
acer
Adobe Flash Player 10 ActiveX
Adobe Reader 8.1.5
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoImpression 5
ATI Display Driver
Bonjour
ConvertXtoDVD 4.0.10.324
Creative System Information
DJ Mixer Music Mover
DVD Shrink 3.2
e-tax 2009
Epson Easy Photo Print 2
Epson Event Manager
Epson FAX Utility
Epson PC-FAX Driver
EPSON Printer Software
Epson Printer Software Downloader
EPSON Scan
Epson Stylus Office BX310FN_TX510FN_Epson ME Office 650FN Manual
EPSON TX510FN Series Printer Uninstall
EPSON Web-To-Page
EpsonNet Print
EpsonNet Setup
FormatFactory 2.30
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB909394)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
iTunes
Java Auto Updater
Java™ 6 Update 20
KB408682
LimeWire PRO 4.16.2
Logitech QuickCam
Logitech® Camera Driver
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft National Language Support Downlevel APIs
Microsoft Office Excel Viewer 2003
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.5
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Journal Viewer
Microsoft Works 7.0
MjM Free Photo Recovery Software
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6 Service Pack 2 (KB973686)
Nero 6 Ultra Edition
Nokia Connectivity Cable Driver
Nokia Download!
Nokia Home Media Server
Nokia Ovi Application Installer
Nokia Ovi Application Installer 6.85.3008
Nokia Ovi Content Copier
Nokia Ovi Content Copier 6.85.3008
Nokia Ovi Music Manager
Nokia Ovi Music Manager 6.85.3008
Nokia Ovi Suite
Nokia Ovi System Utilities
Nokia Ovi System Utilities 6.85.3008
Nokia Photos
Nokia Software Updater
NVIDIA Display Driver
OGA Notifier 1.7.0105.35.0
PaltalkScene
PC Connectivity Solution
PIF DESIGNER
Presto! PageManager 8.15.01 SE
QuickTime
Realtek AC'97 Audio
RTLSetup
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB944338-v2)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
SiS 661FX_760_741_M661FX_M760_M741
Skype™ 4.1
Sound Blaster Audigy 2 ZS
TiVo Desktop 2.8
Trend Micro Internet Security
TweakNow RegCleaner
TwonkyMedia
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB968220)
Update for Windows Internet Explorer 8 (KB971180)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows Internet Explorer 8 (KB972636)
Update for Windows Internet Explorer 8 (KB975364)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920342)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
WebEx Support Manager for Internet Explorer
WebFldrs XP
Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Installer Clean Up
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885626
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
Yahoo! Messenger

==== Event Viewer Messages From Past Week ========

4/26/2010 8:44:47 AM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
4/26/2010 6:09:06 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
4/26/2010 6:06:05 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip tmtdi
4/26/2010 6:06:05 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
4/26/2010 6:06:05 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/26/2010 6:06:05 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/26/2010 6:06:05 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
4/26/2010 6:06:05 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/26/2010 6:06:05 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/26/2010 6:05:32 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
4/26/2010 5:35:25 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
4/26/2010 5:09:15 PM, error: Service Control Manager [7034] - The Trend Micro Central Control Component service terminated unexpectedly. It has done this 6 time(s).
4/26/2010 5:09:00 PM, error: Service Control Manager [7034] - The Trend Micro Central Control Component service terminated unexpectedly. It has done this 5 time(s).
4/26/2010 5:08:49 PM, error: Service Control Manager [7034] - The Trend Micro Central Control Component service terminated unexpectedly. It has done this 4 time(s).
4/26/2010 5:08:35 PM, error: Service Control Manager [7034] - The Trend Micro Central Control Component service terminated unexpectedly. It has done this 3 time(s).
4/26/2010 3:53:11 PM, error: Service Control Manager [7034] - The Trend Micro Central Control Component service terminated unexpectedly. It has done this 2 time(s).
4/26/2010 3:52:13 PM, error: Service Control Manager [7034] - The Trend Micro Central Control Component service terminated unexpectedly. It has done this 1 time(s).
4/26/2010 3:11:25 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\ftsrch.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 4.0.0.4553.
4/25/2010 6:22:39 PM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
4/25/2010 6:22:39 PM, error: Dhcp [1002] - The IP address lease 192.168.1.100 for the Network Card with network address 00115B574F84 has been denied by the DHCP server 10.0.0.138 (The DHCP Server sent a DHCPNACK message).
4/25/2010 6:07:52 PM, error: Disk [11] - The driver detected a controller error on \Device\Harddisk4\D.
4/25/2010 4:33:38 PM, error: Dhcp [1002] - The IP address lease 10.0.0.1 for the Network Card with network address 00115B574F84 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
4/25/2010 2:41:09 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.

==== End Of File ===========================

DDS (Ver_10-03-17.01) - FAT32x86
Run by [removed] at 4:16:29.09 on Tue 04/27/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.511.165 [GMT 9.5:30]

AV: Trend Micro Internet Security *On-access scanning enabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}

============== Running Processes ===============

C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
SVCHOST.EXE
SVCHOST.EXE
C:\WINDOWS\system32\spoolsv.exe
SVCHOST.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\TiVo\Desktop\TiVoBeacon.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGP.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TiVo\Desktop\Plus\TranscodingService.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFHP.EXE
C:\Program Files\NewSoft\Presto! PageManager 8 for EP\PMSpeed.EXE
C:\Program Files\TiVo\Desktop\TiVoTransfer.exe
C:\Program Files\TiVo\Desktop\TiVoNotify.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Carl Lary\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.ninemsn.com.au/
uDefault_Page_URL = hxxp://www.ninemsn.com.au
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Easy Photo Print: {9421dd08-935f-4701-a9ca-22df90ac4ea6} - c:\program files\epson software\easy photo print\EPTBL.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: EpsonToolBandKicker Class: {e99421fb-68dd-40f0-b4ac-b7027cae2f1a} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll
TB: EPSON Web-To-Page: {ee5d279f-081b-4404-994d-c6b60aaeba6d} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll
TB: Easy Photo Print: {9421dd08-935f-4701-a9ca-22df90ac4ea6} - c:\program files\epson software\easy photo print\EPTBL.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NVMCTRAY.DLL,NvTaskbarInit
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\Wcescomm.exe"
uRun: [TranscodingService] c:\program files\tivo\desktop\plus\\TranscodingService.exe
uRun: [EPSON TX510FN Series] c:\windows\system32\spool\drivers\w32x86\3\e_fatifhp.exe /fu "c:\windows\temp\E_S17A.tmp" /EF "HKCU"
uRun: [PMSpeed] c:\program files\newsoft\presto! pagemanager 8 for ep\PMSpeed.EXE
uRun: [TivoServer] c:\program files\tivo\desktop\TiVoServer.exe /service /registry
uRun: [TivoTransfer] c:\program files\tivo\desktop\TiVoTransfer.exe
uRun: [TivoNotify] c:\program files\tivo\desktop\TiVoNotify.exe /service /registry /auto:TivoNotify
mRun: [SiSUSBRG] c:\windows\SiSUSBrg.exe
mRun: [SiS Tray] c:\windows\system32\sistray.EXE
mRun: [SiS Windows KeyHook] c:\windows\system32\keyhook.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [CTHelper] CTHELPER.EXE
mRun: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
mRun: [SBDrvDet] c:\program files\creative\sb drive det\SBDrvDet.exe /r
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE
mRun: [EPSON Stylus Photo RX530 Series] c:\windows\system32\spool\drivers\w32x86\3\E_FATIAGP.EXE /P31 "EPSON Stylus Photo RX530 Series" /O6 "USB001" /M "Stylus Photo RX530"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [WebEx Document Loader] c:\windows\system32\spool\drivers\w32x86\3\E_FATIAGP.EXE /P21 "WebEx Document Loader" /O26 "WebEx Document Loader Port" /M "Stylus Photo RX530"
mRun: [UfSeAgnt.exe] "c:\program files\trend micro\internet security\UfSeAgnt.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [FUFAXSTM] "c:\program files\epson software\fax utility\FUFAXSTM.exe"
mRun: [EEventManager] c:\progra~1\epsons~1\eventm~1\EEventManager.exe
mRun: [WrtMon.exe] c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
dRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NVMCTRAY.DLL,NvTaskbarInit
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRun: [OE] c:\program files\trend micro\internet security\tmas_oe\TMAS_OEMon.exe
dRunOnce: [RunNarrator] Narrator.exe
StartupFolder: c:\docume~1\carlla~1\startm~1\programs\startup\wkcalrem.lnk - c:\program files\common files\microsoft shared\works shared\WkCalRem.exe
IE: {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - i:\\Paltalk.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - c:\program files\bonjour\ExplorerPlugin.dll
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1240576235745
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1240576117011
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1260604066218
DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - hxxp://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37983.9344097222
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R2 TivoBeacon2;TiVo Beacon Service;c:\program files\tivo\desktop\TiVoBeacon.exe [2009-11-2 1098968]
R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2009-10-11 36368]
R3 C4C_BSC2;C4C_BSC2;c:\windows\system32\drivers\C4C_BSC2.sys [2003-12-31 84788]
R3 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2009-10-11 50704]
R3 TmProxy;Trend Micro Proxy Service;c:\program files\trend micro\internet security\TmProxy.exe [2009-10-11 689416]
S1 SiSEsc;SISLIB_ESC;c:\windows\system32\sisesc.sys [2003-12-31 28416]
S2 TwonkyMedia;TwonkyMedia;c:\program files\nokia\nokia home media server\media server\twonkymedia.exe -serviceversion 0 –> c:\program files\nokia\nokia home media server\media server\TwonkyMedia.exe -serviceversion 0 [?]
S4 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2009-11-29 136704]
S4 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2009-11-29 8320]

=============== Created Last 30 ================

2010-04-26 11:23:10 388608 —-a-w- c:\program files\HiJackThis.exe
2010-04-26 00:18:56 152576 —-a-w- c:\windows\system32\loghours32.dll
2010-04-26 00:18:55 281600 —-a-w- c:\windows\system32\langwrbk32.dll
2010-04-25 23:33:32 0 d—–w- c:\windows\MjM Free Photo Recovery Software
2010-04-25 23:33:32 0 d—–w- c:\program files\MjM Free Photo Recovery Software
2010-04-25 23:01:06 3540804 —-a-w- c:\program files\photorecovery.zip
2010-04-24 22:38:46 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-04-05 02:59:03 0 d—–w- c:\docume~1\carlla~1\applic~1\HandBrake
2010-04-05 02:58:52 0 d—–w- c:\program files\Handbrake
2010-04-04 03:21:08 440 —-a-w- c:\documents and settings\carl lary\.kmttg_settings
2010-04-03 20:08:31 0 d—–w- c:\windows\system32\NtmsData
2010-04-02 05:25:29 0 d—–w- c:\program files\FreeTime
2010-04-02 05:21:23 38634503 —-a-w- c:\program files\FFSetup230.zip
2010-04-01 03:38:18 0 d—–w- c:\program files\Windows Media Connect 2
2010-03-28 07:36:19 65602 —-a-w- c:\windows\system32\cook3260.dll
2010-03-28 07:36:19 626688 —-a-w- c:\windows\system32\vp7vfw.dll
2010-03-28 07:36:19 217127 —-a-w- c:\windows\system32\drv43260.dll
2010-03-28 07:36:19 208935 —-a-w- c:\windows\system32\drv33260.dll
2010-03-28 07:36:19 176165 —-a-w- c:\windows\system32\drv23260.dll
2010-03-28 07:36:19 102439 —-a-w- c:\windows\system32\sipr3260.dll

==================== Find3M ====================

2010-04-26 11:25:58 11464 —-a-w- c:\program files\hijackthis.log
2010-04-26 08:41:38 4348 —-a-w- c:\windows\system32\d3d9caps.dat
2010-03-29 15:16:30 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 15:15:52 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-28 07:36:30 87608 —-a-w- c:\docume~1\carlla~1\applic~1\inst.exe
2010-03-28 07:36:30 47360 —-a-w- c:\windows\system32\drivers\pcouffin.sys
2010-03-28 07:36:30 47360 —-a-w- c:\docume~1\carlla~1\applic~1\pcouffin.sys
2010-02-25 02:24:36 11070976 —-a-w- c:\windows\system32\dllcache\ieframe.dll
2010-02-24 09:54:26 173056 —-a-w- c:\windows\system32\dllcache\ie4uinit.exe
2010-02-24 07:17:50 2025768 —-a-w- c:\program files\SkypeSetup.exe
2010-02-16 05:50:24 64000 ——w- c:\windows\system32\dllcache\iecompat.dll
2010-02-05 10:14:16 27944 —ha-w- c:\windows\system32\mlfcache.dat
2010-02-03 05:23:04 98180904 —-a-w- C:\iTunesSetup.exe
2010-01-25 21:57:36 417664 —-a-w- c:\program files\msgr10us.exe
2009-12-09 10:35:50 24435416 —-a-w- c:\program files\TiVoDesktop2.8.exe
2009-11-09 22:41:02 359656 —-a-w- c:\program files\msicuu2.exe
2009-10-04 08:16:08 92708656 —-a-w- c:\program files\TIS_Download32bit.exe
2009-07-25 20:36:30 2317151 —-a-w- c:\program files\tsc.zip
2009-07-15 06:47:02 6616576 —-a-w- c:\program files\etax2009_1.msi
2009-06-13 08:31:54 10420936 —-a-w- c:\program files\xlviewer.exe
2009-05-02 02:10:14 274224 —-a-w- c:\program files\utorrent.exe
2009-04-09 22:43:16 25913504 —-a-w- c:\program files\Setup.exe
2009-02-25 08:59:42 14657328 —-a-w- c:\program files\ooVoo.exe

============= FINISH: 4:17:14.12 ===============
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-27 17:47:09
Windows 5.1.2600 Service Pack 2
Running: b47mdeuw.exe; Driver: C:\DOCUME~1\CARLLA~1\LOCALS~1\Temp\pxtdqpod.sys

—- System - GMER 1.0.15 —-

SSDT 82CC2DA0 ZwCreateKey
SSDT 82CC3F00 ZwCreateMutant
SSDT 82CC2260 ZwCreateProcess
SSDT 82CC2520 ZwCreateProcessEx
SSDT 82CC3BC0 ZwCreateThread
SSDT 82CC3320 ZwDeleteKey
SSDT 82CC35A0 ZwDeleteValueKey
SSDT 82CC3D60 ZwLoadDriver
SSDT 82CC27E0 ZwOpenProcess
SSDT 82CC40A0 ZwSetSystemInformation
SSDT 82CC3060 ZwSetValueKey
SSDT 82CC2AE0 ZwTerminateProcess
SSDT 82CC3A20 ZwWriteVirtualMemory

—- Kernel code sections - GMER 1.0.15 —-

init C:\WINDOWS\system32\drivers\ALCXSENS.SYS entry point in "init" section [0xF826F870]

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\Tcpip \Device\Ip tmtdi.sys (Trend Micro TDI Driver (i386-fre)/Trend Micro Inc.)
AttachedDevice \Driver\Tcpip \Device\Tcp tmtdi.sys (Trend Micro TDI Driver (i386-fre)/Trend Micro Inc.)
AttachedDevice \Driver\Tcpip \Device\Udp tmtdi.sys (Trend Micro TDI Driver (i386-fre)/Trend Micro Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp tmtdi.sys (Trend Micro TDI Driver (i386-fre)/Trend Micro Inc.)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

—- EOF - GMER 1.0.15 —-

Blade81

Post #4April 27, 2010, 3:41 PM UTC

Hello,

uTorrent
LimeWire

Above listed ones are P2P file sharing programs. P2P downloads are nowadays one of those things that most likely bring infection into the system. My recommendation is to uninstall these (and other if present) P2P file sharing programs.

Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully first.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
Remember to re-enable them afterwards.
Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

shucky

Post #5April 27, 2010, 7:07 PM UTC

ComboFix 10-04-26.05 - Carl Lary 04/28/2010 4:05.1.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.511.209 [GMT 9.5:30]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Trend Micro Internet Security *On-access scanning enabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Carl Lary\Application Data\02000000c844bd90891C.manifest
c:\documents and settings\Carl Lary\Application Data\02000000c844bd90891O.manifest
c:\documents and settings\Carl Lary\Application Data\02000000c844bd90891P.manifest
c:\documents and settings\Carl Lary\Application Data\02000000c844bd90891S.manifest
c:\documents and settings\Carl Lary\Application Data\inst.exe
c:\program files\\setup.exe
c:\program files\Setup.exe
c:\windows\BackUp
c:\windows\BackUp\TB031231.DAT
c:\windows\patch.exe
c:\windows\system32\langwrbk32.dll
c:\windows\system32\loghours32.dll
c:\windows\system32\service
c:\windows\system32\service\04012010_TIS17_SfFniAU.log
c:\windows\system32\service\10052009_TIS17_SfFniAU.log
c:\windows\system32\service\15022010_TIS17_SfFniAU.log
c:\windows\system32\service\27042010_TIS17_SfFniAU.log

.
((((((((((((((((((((((((( Files Created from 2010-03-27 to 2010-04-27 )))))))))))))))))))))))))))))))
.

2010-04-26 11:23 . 2010-04-26 11:23 388608 —-a-w- c:\program files\HiJackThis.exe
2010-04-25 23:33 . 2010-04-25 23:33 ——– d—–w- c:\windows\MjM Free Photo Recovery Software
2010-04-25 23:33 . 2010-04-25 23:33 ——– d—–w- c:\program files\MjM Free Photo Recovery Software
2010-04-25 23:01 . 2010-04-25 23:01 3540804 —-a-w- c:\program files\photorecovery.zip
2010-04-25 08:21 . 2010-04-25 08:21 ——– d—–w- c:\documents and settings\Boys\Application Data\PC Suite
2010-04-25 05:11 . 2010-04-25 05:11 ——– d—–w- c:\documents and settings\Carl Lary\Application Data\PC Suite
2010-04-24 22:39 . 2010-04-24 22:39 503808 —-a-w- c:\documents and settings\Carl Lary\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-25ea34b4-n\msvcp71.dll
2010-04-24 22:39 . 2010-04-24 22:39 499712 —-a-w- c:\documents and settings\Carl Lary\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-25ea34b4-n\jmc.dll
2010-04-24 22:39 . 2010-04-24 22:39 348160 —-a-w- c:\documents and settings\Carl Lary\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-25ea34b4-n\msvcr71.dll
2010-04-24 22:39 . 2010-04-24 22:39 ——– d—–w- c:\program files\Common Files\Java
2010-04-24 22:39 . 2010-04-24 22:39 61440 —-a-w- c:\documents and settings\Carl Lary\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7b7ff40a-n\decora-sse.dll
2010-04-24 22:39 . 2010-04-24 22:39 12800 —-a-w- c:\documents and settings\Carl Lary\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-7b7ff40a-n\decora-d3d.dll
2010-04-24 22:38 . 2010-04-12 07:59 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-04-17 02:10 . 2010-04-17 02:10 1644118 —-a-r- c:\documents and settings\Boys\Application Data\Microsoft\Installer\{D8F4F1B3-DE66-434B-A269-B0716709F041}\_3DAE192C40A27B61228D86.exe
2010-04-17 02:10 . 2010-04-17 02:10 1644118 —-a-r- c:\documents and settings\Boys\Application Data\Microsoft\Installer\{D8F4F1B3-DE66-434B-A269-B0716709F041}\_4EDD132EAC2BA85AF07884.exe
2010-04-15 06:38 . 2010-04-15 06:38 ——– d—–w- c:\documents and settings\Boys\Local Settings\Application Data\Apple
2010-04-09 07:37 . 2010-04-09 07:37 ——– d—–w- c:\documents and settings\Marion\Local Settings\Application Data\Apple
2010-04-05 02:59 . 2010-04-05 02:59 ——– d—–w- c:\documents and settings\Carl Lary\Local Settings\Application Data\HandBrake
2010-04-05 02:59 . 2010-04-05 02:59 ——– d—–w- c:\documents and settings\Carl Lary\Application Data\HandBrake
2010-04-05 02:58 . 2010-04-05 02:58 ——– d—–w- c:\program files\Handbrake
2010-04-03 20:08 . 2010-04-03 20:08 ——– d—–w- c:\windows\system32\NtmsData
2010-04-02 05:25 . 2010-04-02 05:25 ——– d—–w- c:\program files\FreeTime
2010-04-02 05:21 . 2010-04-02 05:21 38634503 —-a-w- c:\program files\FFSetup230.zip
2010-04-01 03:54 . 2004-08-04 08:26 25600 —-a-w- c:\documents and settings\LocalService\Application Data\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
2010-04-01 03:38 . 2010-04-01 03:38 ——– d—–w- c:\program files\Windows Media Connect 2

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-26 11:25 . 2010-04-26 11:24 11464 —-a-w- c:\program files\hijackthis.log
2010-04-26 08:41 . 2009-11-14 02:38 4348 —-a-w- c:\windows\system32\d3d9caps.dat
2010-04-25 23:56 . 2009-06-05 20:55 5918776 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-03-29 15:16 . 2009-04-26 00:52 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 15:15 . 2009-04-26 00:52 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-28 07:36 . 2009-05-02 23:30 47360 —-a-w- c:\windows\system32\drivers\pcouffin.sys
2010-03-28 07:36 . 2009-05-02 23:30 47360 —-a-w- c:\documents and settings\Carl Lary\Application Data\pcouffin.sys
2010-03-28 07:36 . 2009-05-02 23:30 47360 —-a-w- c:\documents and settings\Carl Lary\Application Data\pcouffin.sys
2010-03-24 12:46 . 2010-03-24 12:46 ——– d—–w- c:\documents and settings\Marion\Application Data\skypePM
2010-03-24 12:44 . 2010-03-24 12:44 ——– d—–w- c:\documents and settings\Marion\Application Data\Skype
2010-03-20 02:57 . 2010-03-20 02:57 ——– d—–w- c:\program files\Common Files\Ahead
2010-03-19 12:58 . 2010-03-19 12:58 ——– d—–w- c:\documents and settings\Boys\Application Data\skypePM
2010-03-19 12:54 . 2010-03-19 12:54 ——– d—–w- c:\documents and settings\Boys\Application Data\Skype
2010-03-17 08:57 . 2010-03-17 08:57 ——– d—–w- c:\program files\Microsoft Silverlight
2010-03-10 21:15 . 2010-03-10 21:15 50354 —-a-w- c:\documents and settings\Boys\Application Data\Facebook\uninstall.exe
2010-03-10 21:15 . 2010-03-10 21:15 ——– d—–w- c:\documents and settings\Boys\Application Data\Facebook
2010-03-06 06:30 . 2010-03-06 06:30 847040 —-a-w- c:\documents and settings\Boys\Application Data\Facebook\axfbootloader.dll
2010-03-06 06:30 . 2010-03-06 06:30 5582848 —-a-w- c:\documents and settings\Boys\Application Data\Facebook\npfbplugin_1_0_3.dll
2010-03-06 02:20 . 2010-03-06 02:20 56 —ha-w- c:\windows\system32\ezsidmv.dat
2010-03-06 02:20 . 2010-03-06 02:20 ——– d—–w- c:\documents and settings\Carl Lary\Application Data\skypePM
2010-03-06 02:18 . 2010-03-06 02:18 ——– d—–w- c:\program files\Google
2010-03-06 02:18 . 2010-03-06 02:18 ——– d—–w- c:\documents and settings\Carl Lary\Application Data\Skype
2010-03-06 02:18 . 2010-03-06 02:18 ——– d—–w- c:\program files\Common Files\Skype
2010-03-06 02:18 . 2010-03-06 02:18 ——– d—–r- c:\program files\Skype
2010-02-25 06:24 . 2006-06-23 02:03 916480 —-a-w- c:\windows\system32\wininet.dll
2010-02-24 07:17 . 2010-02-24 07:17 2025768 —-a-w- c:\program files\SkypeSetup.exe
2010-02-09 06:07 . 2010-03-28 07:36 65602 —-a-w- c:\windows\system32\cook3260.dll
2010-02-09 06:07 . 2010-03-28 07:36 626688 —-a-w- c:\windows\system32\vp7vfw.dll
2010-02-09 06:07 . 2010-03-28 07:36 217127 —-a-w- c:\windows\system32\drv43260.dll
2010-02-09 06:07 . 2010-03-28 07:36 208935 —-a-w- c:\windows\system32\drv33260.dll
2010-02-09 06:07 . 2010-03-28 07:36 176165 —-a-w- c:\windows\system32\drv23260.dll
2010-02-09 06:07 . 2010-03-28 07:36 102439 —-a-w- c:\windows\system32\sipr3260.dll
2010-02-05 10:14 . 2010-02-05 10:14 27944 —ha-w- c:\windows\system32\mlfcache.dat
2010-02-03 05:23 . 2010-02-03 05:23 98180904 —-a-w- C:\iTunesSetup.exe
2010-01-28 09:19 . 2009-04-25 05:58 33544 —-a-w- c:\documents and settings\Boys\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-25 21:57 . 2010-01-25 21:57 417664 —-a-w- c:\program files\msgr10us.exe
2009-12-09 10:35 . 2009-12-09 10:35 24435416 —-a-w- c:\program files\TiVoDesktop2.8.exe
2009-11-09 22:41 . 2009-11-09 22:40 359656 —-a-w- c:\program files\msicuu2.exe
2009-10-04 08:16 . 2009-10-04 08:16 92708656 —-a-w- c:\program files\TIS_Download32bit.exe
2009-07-25 20:36 . 2009-07-25 20:36 2317151 —-a-w- c:\program files\tsc.zip
2009-07-15 06:47 . 2009-07-15 06:47 6616576 —-a-w- c:\program files\etax2009_1.msi
2009-06-13 08:31 . 2009-06-13 08:31 10420936 —-a-w- c:\program files\xlviewer.exe
2009-05-02 02:10 . 2009-05-02 02:10 274224 —-a-w- c:\program files\utorrent.exe
2009-02-25 08:59 . 2009-04-23 23:36 14657328 —-a-w- c:\program files\ooVoo.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\System32\NVMCTRAY.DLL" [2003-10-06 49152]
"TranscodingService"="c:\program files\TiVo\Desktop\Plus\\TranscodingService.exe" [2009-11-02 856280]
"PMSpeed"="c:\program files\NewSoft\Presto! PageManager 8 for EP\PMSpeed.EXE" [2008-12-09 55120]
"TivoServer"="c:\program files\TiVo\Desktop\TiVoServer.exe" [2009-11-02 2195160]
"TivoTransfer"="c:\program files\TiVo\Desktop\TiVoTransfer.exe" [2009-11-02 604888]
"TivoNotify"="c:\program files\TiVo\Desktop\TiVoNotify.exe" [2009-11-02 430808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]
"SiS Tray"="c:\windows\System32\sistray.EXE" [2003-08-19 667648]
"SiS Windows KeyHook"="c:\windows\System32\keyhook.exe" [2003-08-19 241664]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]
"nwiz"="nwiz.exe" [2003-10-06 741376]
"CTHelper"="CTHELPER.EXE" [2003-06-20 24576]
"AsioReg"="CTASIO.DLL" [2003-06-20 118784]
"SBDrvDet"="c:\program files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-03 45056]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]
"SoundMan"="SOUNDMAN.EXE" [2003-08-14 57344]
"LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2004-05-21 221184]
"EPSON Stylus Photo RX530 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAGP.EXE" [2005-04-07 98304]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"WebEx Document Loader"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIAGP.EXE" [2005-04-07 98304]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2010-01-26 1020248]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"FUFAXSTM"="c:\program files\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-06-04 843776]
"EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2009-04-06 673616]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2008-05-24 26448]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-10 417792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="c:\windows\System32\NVMCTRAY.DLL" [2003-10-06 49152]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2006-10-04 53760]

c:\documents and settings\Carl Lary\Start Menu\Programs\Startup\
wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2002-6-20 24651]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Nokia Ovi Suite.lnk]
path=
backup=c:\windows\pss\Nokia Ovi Suite.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-22 09:46 141608 —-a-w- c:\documents and settings\Boys\Desktop\music\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechSoftwareUpdate]
2004-06-01 11:16 196608 ——w- c:\program files\Logitech\Video\ManifestEngine.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
2004-06-01 01:39 458752 ——w- c:\program files\Logitech\Video\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
2004-06-01 01:33 217088 ——w- c:\program files\Logitech\Video\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 01:20 155648 —-a-w- c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 13:38 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TivoNotify]
2009-11-02 03:47 430808 —-a-w- c:\program files\TiVo\Desktop\TiVoNotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TivoServer]
2009-11-02 03:47 2195160 —-a-w- c:\program files\TiVo\Desktop\TiVoServer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"RDSessMgr"=3 (0x3)
"RasMan"=3 (0x3)
"RasAuto"=3 (0x3)
"mnmsrvc"=3 (0x3)
"Fax"=2 (0x2)
"FastUserSwitchingCompatibility"=3 (0x3)
"iPod Service"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Trend Micro\\Internet Security\\UfNavi.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Documents and Settings\\Boys\\Desktop\\music\\iTunes.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Nokia\\Nokia Home Media Server\\Media Server\\twonkymedia.exe"=
"c:\\Program Files\\Nokia\\Nokia Home Media Server\\Media Server\\twonkymediaserver.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 TivoBeacon2;TiVo Beacon Service;c:\program files\TiVo\Desktop\TiVoBeacon.exe [11/2/2009 1:17 PM 1098968]
R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [10/11/2009 5:56 AM 36368]
R3 C4C_BSC2;C4C_BSC2;c:\windows\system32\drivers\C4C_BSC2.sys [12/31/2003 8:17 PM 84788]
R3 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [10/11/2009 6:05 AM 50704]
R3 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [10/11/2009 6:05 AM 689416]
S1 SiSEsc;SISLIB_ESC;c:\windows\system32\sisesc.sys [12/31/2003 8:51 PM 28416]
S2 TwonkyMedia;TwonkyMedia;c:\program files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe -serviceversion 0 –> c:\program files\Nokia\Nokia Home Media Server\Media Server\TwonkyMedia.exe -serviceversion 0 [?]
S4 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [11/29/2009 9:20 AM 136704]
S4 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [11/29/2009 9:20 AM 8320]
.
Contents of the 'Scheduled Tasks' folder

2010-04-27 c:\windows\Tasks\User_Feed_Synchronization-{75F081BC-E6E6-49F8-BC1D-C69AC7356D90}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 19:01]

2010-04-26 c:\windows\Tasks\Epson Printer Software Downloader.job
- c:\program files\EPSON\EPAPDL\E_SAPDL2.EXE [2009-05-26 02:13]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.ninemsn.com.au/
uInternet Settings,ProxyOverride = *.local
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-TomTomHOME - c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
MSConfigStartUp-TranscodingService - c:\program files\TiVo\Desktop\TranscodingService.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-28 04:17
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(468)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2010-04-28 04:20:17
ComboFix-quarantined-files.txt 2010-04-27 18:50

Pre-Run: 180,882,210,816 bytes free
Post-Run: 196,605,673,472 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - 2A1D50915CCE5F58050AD9041841EDAD

I know you said to disable my A/V and such, when my pc starts my A/V will try to load for a few seconds then it just shuts down, Just as I started to run combofix it noticed my A/V was running but there was no icon in the systray and it wasn't showing up as a running application in the windows task manager. Just after combofix finished and I opened my IE I got a message saying IE was not my default browser and asked if I would like to make it the default in which of course I said yes. Though thats funny cause I have only ever used IE so I'm unsure what other browser is being found except maybe Mozilla which I have no clue where it's came from thats the honest truth strike me dead rignt now if its not.

Blade81

Post #6April 28, 2010, 2:05 PM UTC

Hi,

Just after combofix finished and I opened my IE I got a message saying IE was not my default browser and asked if I would like to make it the default

That's normal. Even if only IE was installed.

Please post a fresh dds log too. Then start MBAM, update its database version and run a quick scan letting it remove found items. Post back the report.

shucky

Post #7April 28, 2010, 7:11 PM UTC

DDS (Ver_10-03-17.01) - FAT32x86
Run by [removed] at 4:22:04.01 on Thu 04/29/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.511.127 [GMT 9.5:30]

AV: Trend Micro Internet Security *On-access scanning enabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}
If Trend is enabled, why would it not be showing in the systray?

============== Running Processes ===============

C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
SVCHOST.EXE
SVCHOST.EXE
C:\WINDOWS\system32\spoolsv.exe
SVCHOST.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\TiVo\Desktop\TiVoBeacon.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAGP.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe <—-I've never noticed this before problems occured
C:\Program Files\TiVo\Desktop\Plus\TranscodingService.exe
C:\Program Files\NewSoft\Presto! PageManager 8 for EP\PMSpeed.EXE
C:\Program Files\TiVo\Desktop\TiVoTransfer.exe
C:\Program Files\TiVo\Desktop\TiVoNotify.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Carl Lary\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.ninemsn.com.au/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Easy Photo Print: {9421dd08-935f-4701-a9ca-22df90ac4ea6} - c:\program files\epson software\easy photo print\EPTBL.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: EpsonToolBandKicker Class: {e99421fb-68dd-40f0-b4ac-b7027cae2f1a} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll
TB: EPSON Web-To-Page: {ee5d279f-081b-4404-994d-c6b60aaeba6d} - c:\program files\epson\epson web-to-page\EPSON Web-To-Page.dll
TB: Easy Photo Print: {9421dd08-935f-4701-a9ca-22df90ac4ea6} - c:\program files\epson software\easy photo print\EPTBL.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NVMCTRAY.DLL,NvTaskbarInit
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\Wcescomm.exe"
uRun: [TranscodingService] c:\program files\tivo\desktop\plus\\TranscodingService.exe
uRun: [PMSpeed] c:\program files\newsoft\presto! pagemanager 8 for ep\PMSpeed.EXE
uRun: [TivoServer] c:\program files\tivo\desktop\TiVoServer.exe /service /registry
uRun: [TivoTransfer] c:\program files\tivo\desktop\TiVoTransfer.exe
uRun: [TivoNotify] c:\program files\tivo\desktop\TiVoNotify.exe /service /registry /auto:TivoNotify
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [SiSUSBRG] c:\windows\SiSUSBrg.exe
mRun: [SiS Tray] c:\windows\system32\sistray.EXE
mRun: [SiS Windows KeyHook] c:\windows\system32\keyhook.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [CTHelper] CTHELPER.EXE
mRun: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
mRun: [SBDrvDet] c:\program files\creative\sb drive det\SBDrvDet.exe /r
mRun: [UpdReg] c:\windows\UpdReg.EXE
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE
mRun: [EPSON Stylus Photo RX530 Series] c:\windows\system32\spool\drivers\w32x86\3\E_FATIAGP.EXE /P31 "EPSON Stylus Photo RX530 Series" /O6 "USB001" /M "Stylus Photo RX530"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [WebEx Document Loader] c:\windows\system32\spool\drivers\w32x86\3\E_FATIAGP.EXE /P21 "WebEx Document Loader" /O26 "WebEx Document Loader Port" /M "Stylus Photo RX530"
mRun: [UfSeAgnt.exe] "c:\program files\trend micro\internet security\UfSeAgnt.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [FUFAXSTM] "c:\program files\epson software\fax utility\FUFAXSTM.exe"
mRun: [EEventManager] c:\progra~1\epsons~1\eventm~1\EEventManager.exe
mRun: [WrtMon.exe] c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
dRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NVMCTRAY.DLL,NvTaskbarInit
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [RunNarrator] Narrator.exe
StartupFolder: c:\docume~1\carlla~1\startm~1\programs\startup\wkcalrem.lnk - c:\program files\common files\microsoft shared\works shared\WkCalRem.exe
IE: {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - i:\\Paltalk.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - c:\program files\bonjour\ExplorerPlugin.dll
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1240576235745
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1240576117011
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1260604066218
DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} - hxxp://a840.g.akamai.net/7/840/537/2003120501/housecall.antivirus.com/housecall/xscan53.cab
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37983.9344097222
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

============= SERVICES / DRIVERS ===============

R2 TivoBeacon2;TiVo Beacon Service;c:\program files\tivo\desktop\TiVoBeacon.exe [2009-11-2 1098968]
R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2009-10-11 36368]
R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]
R3 C4C_BSC2;C4C_BSC2;c:\windows\system32\drivers\C4C_BSC2.sys [2003-12-31 84788]
R3 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2009-10-11 50704]
R3 TmProxy;Trend Micro Proxy Service;c:\program files\trend micro\internet security\TmProxy.exe [2009-10-11 689416]
S1 SiSEsc;SISLIB_ESC;c:\windows\system32\sisesc.sys [2003-12-31 28416]
S2 TwonkyMedia;TwonkyMedia;c:\program files\nokia\nokia home media server\media server\twonkymedia.exe -serviceversion 0 –> c:\program files\nokia\nokia home media server\media server\TwonkyMedia.exe -serviceversion 0 [?]
S4 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2009-11-29 136704]
S4 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2009-11-29 8320]

=============== Created Last 30 ================

2010-04-28 09:51:17 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-04-28 01:34:09 0 d-sh–w- C:\Recycled
2010-04-27 18:32:15 0 d-sha-r- C:\cmdcons
2010-04-27 18:30:29 77312 —-a-w- c:\windows\MBR.exe
2010-04-27 18:30:25 98816 —-a-w- c:\windows\sed.exe
2010-04-27 18:30:25 256512 —-a-w- c:\windows\PEV.exe
2010-04-27 18:30:25 161792 —-a-w- c:\windows\SWREG.exe
2010-04-27 18:30:08 0 d—–w- C:\ComboFix
2010-04-26 11:23:10 388608 —-a-w- c:\program files\HiJackThis.exe
2010-04-25 23:33:32 0 d—–w- c:\windows\MjM Free Photo Recovery Software
2010-04-25 23:33:32 0 d—–w- c:\program files\MjM Free Photo Recovery Software
2010-04-25 23:01:06 3540804 —-a-w- c:\program files\photorecovery.zip
2010-04-24 22:38:46 411368 —-a-w- c:\windows\system32\deployJava1.dll
2010-04-05 02:59:03 0 d—–w- c:\docume~1\carlla~1\applic~1\HandBrake
2010-04-05 02:58:52 0 d—–w- c:\program files\Handbrake
2010-04-04 03:21:08 440 —-a-w- c:\documents and settings\carl lary\.kmttg_settings
2010-04-03 20:08:31 0 d—–w- c:\windows\system32\NtmsData
2010-04-02 05:25:29 0 d—–w- c:\program files\FreeTime
2010-04-02 05:21:23 38634503 —-a-w- c:\program files\FFSetup230.zip
2010-04-01 03:38:18 0 d—–w- c:\program files\Windows Media Connect 2

==================== Find3M ====================

2010-04-28 09:45:50 5154304 —-a-w- c:\program files\WindowsDefender.msi
2010-04-26 11:25:58 11464 —-a-w- c:\program files\hijackthis.log
2010-04-26 08:41:38 4348 —-a-w- c:\windows\system32\d3d9caps.dat
2010-03-29 15:16:30 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-29 15:15:52 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-28 07:36:30 47360 —-a-w- c:\windows\system32\drivers\pcouffin.sys
2010-03-28 07:36:30 47360 —-a-w- c:\docume~1\carlla~1\applic~1\pcouffin.sys
2010-03-10 06:15:52 420352 —-a-w- c:\windows\system32\vbscript.dll
2010-03-10 06:15:52 420352 —-a-w- c:\windows\system32\dllcache\vbscript.dll
2010-02-25 02:24:36 11070976 —-a-w- c:\windows\system32\dllcache\ieframe.dll
2010-02-24 12:31:30 454016 ——w- c:\windows\system32\dllcache\mrxsmb.sys
2010-02-24 09:54:26 173056 —-a-w- c:\windows\system32\dllcache\ie4uinit.exe
2010-02-24 07:17:50 2025768 —-a-w- c:\program files\SkypeSetup.exe
2010-02-16 13:19:56 2181376 ——w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-02-16 13:17:38 2137088 —-a-w- c:\windows\system32\ntoskrnl.exe
2010-02-16 13:17:38 2137088 ——w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-02-16 12:39:04 2058368 ——w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-02-16 12:39:04 2016768 —-a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-16 12:39:04 2016768 ——w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-02-16 05:50:24 64000 ——w- c:\windows\system32\dllcache\iecompat.dll
2010-02-12 04:47:06 100864 —-a-w- c:\windows\system32\6to4svc.dll
2010-02-12 04:47:06 100864 ——w- c:\windows\system32\dllcache\6to4svc.dll
2010-02-11 12:01:44 226880 —-a-w- c:\windows\system32\dllcache\tcpip6.sys
2010-02-09 06:07:30 65602 —-a-w- c:\windows\system32\cook3260.dll
2010-02-09 06:07:30 626688 —-a-w- c:\windows\system32\vp7vfw.dll
2010-02-09 06:07:30 217127 —-a-w- c:\windows\system32\drv43260.dll
2010-02-09 06:07:30 208935 —-a-w- c:\windows\system32\drv33260.dll
2010-02-09 06:07:30 176165 —-a-w- c:\windows\system32\drv23260.dll
2010-02-09 06:07:30 102439 —-a-w- c:\windows\system32\sipr3260.dll
2010-02-05 10:14:16 27944 —ha-w- c:\windows\system32\mlfcache.dat
2010-02-03 05:23:04 98180904 —-a-w- C:\iTunesSetup.exe
2010-01-25 21:57:36 417664 —-a-w- c:\program files\msgr10us.exe
2009-12-09 10:35:50 24435416 —-a-w- c:\program files\TiVoDesktop2.8.exe
2009-11-09 22:41:02 359656 —-a-w- c:\program files\msicuu2.exe
2009-10-04 08:16:08 92708656 —-a-w- c:\program files\TIS_Download32bit.exe
2009-07-25 20:36:30 2317151 —-a-w- c:\program files\tsc.zip
2009-07-15 06:47:02 6616576 —-a-w- c:\program files\etax2009_1.msi
2009-06-13 08:31:54 10420936 —-a-w- c:\program files\xlviewer.exe
2009-05-02 02:10:14 274224 —-a-w- c:\program files\utorrent.exe
2009-02-25 08:59:42 14657328 —-a-w- c:\program files\ooVoo.exe

============= FINISH: 4:22:49.95 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 4/24/2009 8:19:04 PM
System Uptime: 4/29/2010 4:08:57 AM (0 hours ago)

Motherboard: Acer | | E61ML
Processor: Intel® Pentium® 4 CPU 3.00GHz | Socket 478 | 3000/200mhz
Processor: Intel® Pentium® 4 CPU 3.00GHz | Socket 478 | 3000/200mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (FAT32) - 233 GiB total, 182.645 GiB free.
D: is CDROM ()
E: is Removable
F: is Removable
G: is Removable
H: is Removable

==== Disabled Device Manager Items =============

Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia 6500s-1
Device ID: ROOT\WPD\0000
Manufacturer: Nokia
Name: Nokia 6500s-1
PNP Device ID: ROOT\WPD\0000
Service: WUDFRd

==== System Restore Points ===================

RP1: 4/28/2010 4:00:29 AM - System Checkpoint
RP2: 4/28/2010 6:26:05 PM - Software Distribution Service 3.0
RP3: 4/28/2010 7:19:09 PM - Installed Windows Defender
RP4: 4/28/2010 7:21:13 PM - Software Distribution Service 3.0

==== Installed Programs ======================

µTorrent
acer
Adobe Flash Player 10 ActiveX
Adobe Reader 8.1.5
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoImpression 5
ATI Display Driver
Bonjour
ConvertXtoDVD 4.0.10.324
Creative System Information
DJ Mixer Music Mover
DVD Shrink 3.2
e-tax 2009
Epson Easy Photo Print 2
Epson Event Manager
Epson FAX Utility
Epson PC-FAX Driver
EPSON Printer Software
Epson Printer Software Downloader
EPSON Scan
Epson Stylus Office BX310FN_TX510FN_Epson ME Office 650FN Manual
EPSON TX510FN Series Printer Uninstall
EPSON Web-To-Page
EpsonNet Print
EpsonNet Setup
FormatFactory 2.30
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB909394)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
iTunes
Java Auto Updater
Java™ 6 Update 20
KB408682
LimeWire PRO 4.16.2
Logitech QuickCam
Logitech® Camera Driver
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
Microsoft National Language Support Downlevel APIs
Microsoft Office Excel Viewer 2003
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.5
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Journal Viewer
Microsoft Works 7.0
MjM Free Photo Recovery Software
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6 Service Pack 2 (KB973686)
Nero 6 Ultra Edition
Nokia Connectivity Cable Driver
Nokia Download!
Nokia Home Media Server
Nokia Ovi Application Installer
Nokia Ovi Application Installer 6.85.3008
Nokia Ovi Content Copier
Nokia Ovi Content Copier 6.85.3008
Nokia Ovi Music Manager
Nokia Ovi Music Manager 6.85.3008
Nokia Ovi Suite
Nokia Ovi System Utilities
Nokia Ovi System Utilities 6.85.3008
Nokia Photos
Nokia Software Updater
NVIDIA Display Driver
OGA Notifier 1.7.0105.35.0
PaltalkScene
PC Connectivity Solution
PIF DESIGNER
Presto! PageManager 8.15.01 SE
QuickTime
Realtek AC'97 Audio
RTLSetup
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB944338-v2)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165-v2)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980232)
SiS 661FX_760_741_M661FX_M760_M741
Skype™ 4.1
Sound Blaster Audigy 2 ZS
TiVo Desktop 2.8
Trend Micro Internet Security
TweakNow RegCleaner
TwonkyMedia
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB968220)
Update for Windows Internet Explorer 8 (KB971180)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows Internet Explorer 8 (KB972636)
Update for Windows Internet Explorer 8 (KB975364)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB980302)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920342)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB925720)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB932823-v3)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
WebEx Support Manager for Internet Explorer
WebFldrs XP
Windows Defender
Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Installer Clean Up
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885626
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
Yahoo! Messenger

==== Event Viewer Messages From Past Week ========

4/26/2010 8:44:47 AM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
4/26/2010 6:09:06 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
4/26/2010 6:06:05 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Fips intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss Tcpip tmtdi
4/26/2010 6:06:05 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
4/26/2010 6:06:05 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/26/2010 6:06:05 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/26/2010 6:06:05 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
4/26/2010 6:06:05 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/26/2010 6:06:05 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
4/26/2010 6:05:32 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
4/26/2010 5:35:25 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
4/26/2010 5:09:15 PM, error: Service Control Manager [7034] - The Trend Micro Central Control Component service terminated unexpectedly. It has done this 6 time(s).
4/26/2010 5:09:00 PM, error: Service Control Manager [7034] - The Trend Micro Central Control Component service terminated unexpectedly. It has done this 5 time(s).
4/26/2010 5:08:49 PM, error: Service Control Manager [7034] - The Trend Micro Central Control Component service terminated unexpectedly. It has done this 4 time(s).
4/26/2010 5:08:35 PM, error: Service Control Manager [7034] - The Trend Micro Central Control Component service terminated unexpectedly. It has done this 3 time(s).
4/26/2010 3:53:11 PM, error: Service Control Manager [7034] - The Trend Micro Central Control Component service terminated unexpectedly. It has done this 2 time(s).
4/26/2010 3:52:13 PM, error: Service Control Manager [7034] - The Trend Micro Central Control Component service terminated unexpectedly. It has done this 1 time(s).
4/26/2010 3:11:25 PM, information: Windows File Protection [64002] - File replacement was attempted on the protected system file c:\windows\system32\ftsrch.dll. This file was restored to the original version to maintain system stability. The file version of the system file is 4.0.0.4553.
4/25/2010 6:22:39 PM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
4/25/2010 6:22:39 PM, error: Dhcp [1002] - The IP address lease 192.168.1.100 for the Network Card with network address 00115B574F84 has been denied by the DHCP server 10.0.0.138 (The DHCP Server sent a DHCPNACK message).
4/25/2010 6:07:52 PM, error: Disk [11] - The driver detected a controller error on \Device\Harddisk4\D.
4/25/2010 4:33:38 PM, error: Dhcp [1002] - The IP address lease 10.0.0.1 for the Network Card with network address 00115B574F84 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
4/25/2010 2:41:09 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.

==== End Of File ===========================
Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 4047

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

4/29/2010 4:38:27 AM
mbam-log-2010-04-29 (04-38-27).txt

Scan type: Quick scan
Objects scanned: 124226
Time elapsed: 8 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Blade81

Post #8April 28, 2010, 7:51 PM UTC

Hi,

If Trend is enabled, why would it not be showing in the systray?

Its components were likely harmed by the infection. Reinstallation should help.

How's the system running?

shucky

Post #9April 29, 2010, 9:12 AM UTC

well I have reinstalled my A/V which is staying active now, speaking of which I have also installed windows defender as well to run along side of my A/V good idea or was it a waste of time? I did do another scan using MBAM and came out with this C:\System Volume Information\_restore{3D0AB8C8-E7E6-4A23-B5FE-79EBC9A1C860}\RP1\A0000022.dll (Trojan.Tracur) -> No action taken. C:\System Volume Information\_restore{3D0AB8C8-E7E6-4A23-B5FE-79EBC9A1C860}\RP1\A0000023.dll (Trojan.Tracur) -> No action taken. C:\Qoobox\Quarantine\C\WINDOWS\system32\langwrbk32.dll.vir (Trojan.Tracur) -> No action taken. C:\Qoobox\Quarantine\C\WINDOWS\system32\loghours32.dll.vir (Trojan.Tracur) -> No action taken I let MBAM delete the files and rescanned after restarting my system and now shows all clear. Though thats a bit funny cause these never showed up til now and my pc hasn't been in use. So all in all everything seems to be ok as far as I can tell. Cheers for you help and time Blade

Blade81

Post #10April 29, 2010, 4:55 PM UTC

Hi,

well I have reinstalled my A/V which is staying active now, speaking of which I have also installed windows defender as well to run along side of my A/V good idea or was it a waste of time?

It won't harm having that installed too.

Those MBAM findings are (or should I say were

) in ComboFix quarantined items & system restore. We'll clean those as one of the final step now

THESE STEPS ARE VERY IMPORTANT

Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis

Now lets uninstall ComboFix:

Click START then RUN
Now copy-paste Combofix /uninstall in the runbox and click OK

Please download OTC and save it to desktop.

Double-click OTC.exe.
Click the CleanUp! button.
Select Yes when the
Begin cleanup Process?
prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.

Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.

UPDATING WINDOWS AND INTERNET EXPLORER

IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.

Make your Internet Explorer more secure

This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.

hosts file:
- Every version of windows has a hosts file as part of them.
- In a very basic sense, they are used to locate webpages.
- We can customize a hosts file so that it blocks certain webpages.
- However, it can slow down certain computers.
- This is why using a hosts file is optional!!
Download it here. Make sure you read the instructions on how to install the hosts file. There is a good tutorial here
If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
- Click the start button (at the lower left hand corner of your screen)
- Click run
- In the dialog box, type services.msc
- hit enter, then locate dns client
- Highlight it, then double-click it.
- On the dropdown box, change the setting from automatic to manual.
- Click ok
Run Secunia vulnerability check here and fix its findings.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For more info, check this webpage out.
If you don't have a 3rd party firewall or a router behind NAT then I recommend getting one. I recommend either Online Armor Free or Comodo Firewall Pro (If you choose Comodo: Uncheck during installation Install Comodo HopSurf.., Make Comodo my default search provider and Make Comodo Search my homepage and install firewall ONLY!). Both providers have support forums that help with configuration related questions.

Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Once again, please post and tell me how things are going with your system… problems etc.

Have a great day,
Blade

Blade81

Post #11May 1, 2010, 11:24 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] whats going on

✨ Ask AI

Ask AI