bob5326
Even when the tablet has an excellent connection from my wi-fi, IE will still not open…..
Spyware / Malware / Virus Removal
HTTP error 12029
11 min read
LDTate
OK. Try this instead.
This file will fit on your thumb drive.
http://www.snapfiles.com/get/winsockxpfix.html
Get a copy of winsockxpfix.exe, save it to the thumb drive and copy it to the infected computer.
You just run it by double clicking on the downloaded file after you copy it to the non-working computer.
Things should work OK after it reboots your system.
This file will fit on your thumb drive.
http://www.snapfiles.com/get/winsockxpfix.html
Get a copy of winsockxpfix.exe, save it to the thumb drive and copy it to the infected computer.
You just run it by double clicking on the downloaded file after you copy it to the non-working computer.
Things should work OK after it reboots your system.
bob5326
LDTate, no change…. After i ran the fix, and rebooted, the network diagnostic said that it had to be reconfigured, and to click the button , and it would do that. Didn't work, then diagnostic said to go to microsoft support/winxp, and that's where I am now….. http://support.microsoft.com/kb/811259/en-us under message, you see what I get when I try IE… the page cannot be displayed… I haven't done anything else, I'm reading and hoping you'll know what to do now……
LDTate
I suggest you do this:
Uninstall Internet Explorer 8 to return to Internet Explorer 7 on Windows XP
Click "Start," and then click "Control Panel."
Click "Add or Remove Programs."
Check "Show Updates" at the top of the dialog box.
Scroll down the list and highlight the version of Internet Explorer 8 that you are running, and then click "Change/Remove."
Remove IE 8
bob5326
It won't delete…….
LDTate
Try it in Safe Mode.
Restart your computer in Safe Mode.
Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.
This can take several miniutes to load.
bob5326
In my posting, I said that I didn't know how to get it to boot in safe mode, key F8 does nothing…. There are two buttons that apear on screen just before booting up that says "boot menu" and "boot set-up" , I've hit them both, they open to the bios page………..
LDTate
download Combofix to your thumb drive. Plug in the thumb drive to the non-working pc run it from the thumb drive.
Download Combofix from any of the links below
Link 1
Link 2 If using this link, Right Click and select Save As.
Double click on the combofix.exe & follow the prompts.
——————————————————————-
Notes:
Give it atleast 20-30 minutes to finish if needed.
1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Also please describe how your computer behaves in your next reply.
Download Combofix from any of the links below
Link 1
Link 2 If using this link, Right Click and select Save As.
Double click on the combofix.exe & follow the prompts.
- When finished, it will produce a report for you.
- Please post the C:\ComboFix.txt so we can continue cleaning the system.
——————————————————————-
Notes:
Give it atleast 20-30 minutes to finish if needed.
1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Also please describe how your computer behaves in your next reply.
bob5326
here is the log from the scan……..
ComboFix 10-06-19.01 - Jess 06/19/2010 21:22:02.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.207 [GMT -4:00]
Running from: E:\ComboFix.exe
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\Jay\Local Settings\Application Data\syssvc.exe
c:\documents and settings\Jess\Local Settings\Application Data\syssvc.exe
c:\documents and settings\raj\Application Data\shb.dat
c:\windows\msnimport.exe
c:\windows\system32\Cache
c:\windows\system32\Thumbs.db
D:\AUTORUN.INF
—– BITS: Possible infected sites —–
hxxp://download.yimg.com
.
((((((((((((((((((((((((( Files Created from 2010-05-20 to 2010-06-20 )))))))))))))))))))))))))))))))
.
2010-06-17 22:58 . 2010-06-17 22:59 ——– d—–w- c:\documents and settings\Jess\Application Data\MSN6
2010-06-17 21:26 . 2010-06-17 21:26 ——– d—–w- c:\windows\system32\scripting
2010-06-17 21:26 . 2010-06-17 21:26 ——– d—–w- c:\windows\l2schemas
2010-06-17 21:26 . 2010-06-17 21:26 ——– d—–w- c:\windows\system32\en
2010-06-17 18:35 . 2010-06-17 18:36 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\WeatherBug
2010-06-14 01:41 . 2010-06-14 01:41 439816 —-a-w- c:\documents and settings\Jess\Application Data\Real\Update\setup3.10\setup.exe
2010-06-13 03:39 . 2010-06-13 03:39 ——– d—–w- c:\documents and settings\Jess\Application Data\AdobeUM
2010-06-13 03:39 . 2010-06-13 03:39 ——– d—–w- c:\program files\AskBarDis
2010-06-13 03:39 . 2010-06-13 03:39 ——– d—–w- c:\documents and settings\Jess\Application Data\WeatherBug
2010-06-13 03:38 . 2010-06-13 03:39 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\Adobe
2010-06-12 19:03 . 2010-06-12 19:03 ——– d-sh–w- c:\documents and settings\Jess\IECompatCache
2010-06-12 19:01 . 2010-06-12 19:01 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\vmnoki
2010-06-12 08:16 . 2010-06-12 08:24 ——– d—–w- c:\documents and settings\Jess\Application Data\EmailNotifier
2010-06-12 08:15 . 2010-06-12 08:15 ——– d—–w- c:\documents and settings\All Users\Application Data\EmailNotifier
2010-06-12 08:15 . 2010-06-12 08:15 35311 —-a-w- c:\documents and settings\All Users\Application Data\EmailNotifier\uninstall.exe
2010-06-12 07:09 . 2010-06-12 07:09 ——– d—–w- c:\documents and settings\Jay\Local Settings\Application Data\Yahoo
2010-06-12 07:09 . 2010-06-12 07:10 ——– d—–w- c:\documents and settings\Jay\Application Data\imeshmediabartb
2010-06-12 07:09 . 2010-06-12 07:09 ——– d—–w- c:\documents and settings\Jay\Application Data\Yahoo!
2010-06-12 05:41 . 2010-06-12 05:41 439816 —-a-w- c:\documents and settings\Jay\Application Data\Real\Update\setup3.10\setup.exe
2010-06-12 05:38 . 2010-06-12 05:45 ——– d—–w- c:\documents and settings\Jay\Application Data\MSN6
2010-06-12 05:31 . 2010-06-12 05:31 ——– d—–w- c:\documents and settings\Jay\Local Settings\Application Data\iMesh
2010-06-12 05:26 . 2010-06-12 05:26 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\Yahoo
2010-06-12 05:23 . 2010-06-12 05:23 ——– d—–w- c:\program files\BarQuery
2010-06-12 05:23 . 2010-06-12 05:23 ——– d—–w- c:\documents and settings\All Users\Application Data\BarQuery
2010-06-12 05:23 . 2010-06-11 18:37 65792 —-a-w- c:\documents and settings\All Users\Application Data\BarQuery\barquery144.exe
2010-06-12 05:23 . 2010-06-12 05:23 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-06-12 05:23 . 2010-06-12 05:23 ——– d—–w- c:\program files\Free Offers from Freeze.com
2010-06-12 05:23 . 2010-06-12 05:24 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-06-12 05:23 . 2010-06-12 05:23 ——– d—–w- c:\documents and settings\Jess\Application Data\Yahoo!
2010-06-12 03:07 . 2010-06-12 05:03 ——– d—–w- c:\documents and settings\Jess\Application Data\imeshmediabartb
2010-06-12 03:04 . 2010-06-12 03:23 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\iMesh
2010-06-12 03:04 . 2010-06-12 03:07 ——– d—–w- c:\program files\iMesh Applications
2010-06-12 00:39 . 2010-06-12 00:39 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\ijurnn
2010-06-11 17:40 . 2010-05-06 10:41 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-09 03:44 . 2010-06-09 03:44 ——– d—–w- c:\documents and settings\Jay\Local Settings\Application Data\bteekx
2010-06-08 23:22 . 2010-06-08 23:22 ——– d—–w- c:\documents and settings\Jay\Local Settings\Application Data\pualkqxfs
2010-06-08 03:26 . 2010-06-08 03:26 ——– d-sh–w- c:\documents and settings\Jay\IECompatCache
2010-06-08 03:25 . 2010-06-08 03:25 ——– d-sh–w- c:\documents and settings\Jay\PrivacIE
2010-06-08 03:24 . 2010-06-08 03:24 ——– d-sh–w- c:\documents and settings\Jay\IETldCache
2010-06-08 02:04 . 2010-06-08 02:04 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2010-06-07 17:52 . 2010-06-08 02:20 ——– d—–w- c:\windows\ie8updates
2010-06-07 17:49 . 2010-05-06 10:41 599040 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2010-06-07 17:48 . 2010-05-06 10:41 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-06-07 17:48 . 2010-05-06 10:41 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2010-06-07 17:48 . 2010-05-06 10:41 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2010-06-07 17:48 . 2010-05-06 10:41 1985536 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2010-06-07 17:42 . 2010-06-07 17:42 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\ewsmjm
2010-06-07 00:56 . 2010-06-07 00:56 ——– d-sh–w- c:\documents and settings\Jess\PrivacIE
2010-06-06 18:52 . 2010-06-06 18:52 ——– d—–w- c:\windows\system32\XPSViewer
2010-06-06 18:51 . 2010-06-06 18:51 ——– d—–w- c:\program files\MSBuild
2010-06-06 18:51 . 2010-06-06 18:51 ——– d—–w- c:\program files\Reference Assemblies
2010-06-06 18:51 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-06-06 18:50 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-06-06 18:50 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2010-06-06 18:50 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-06-06 18:50 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2010-06-06 18:50 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2010-06-06 18:50 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2010-06-06 18:50 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-06-06 18:50 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-06-06 18:50 . 2010-06-06 18:51 ——– d—–w- C:\d6a9758d53fac972d0704768d64470
2010-06-06 18:42 . 2010-06-06 18:42 ——– d—–w- c:\program files\MSXML 6.0
2010-06-06 18:40 . 2010-06-06 18:40 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-06-06 18:36 . 2010-06-06 18:36 ——– d-sh–w- c:\documents and settings\Jess\IETldCache
2010-06-06 18:18 . 2010-06-06 18:20 ——– dc-h–w- c:\windows\ie8
2010-06-06 17:38 . 2008-04-14 00:12 69120 ——w- c:\windows\system32\wlanapi.dll
2010-06-06 17:37 . 2008-04-14 00:12 53248 ——w- c:\windows\system32\tsgqec.dll
2010-06-06 17:37 . 2008-04-14 00:12 50688 ——w- c:\windows\system32\tspkg.dll
2010-06-06 17:37 . 2008-04-13 18:40 10240 ——w- c:\windows\system32\drivers\sffp_mmc.sys
2010-06-06 17:37 . 2008-04-14 00:12 32768 ——w- c:\windows\system32\setupn.exe
2010-06-06 17:35 . 2008-04-14 00:12 33792 ——w- c:\windows\system32\mmcperf.exe
2010-06-06 17:35 . 2008-04-14 00:11 397312 ——w- c:\windows\system32\mmcex.dll
2010-06-06 17:35 . 2008-04-14 00:11 184320 ——w- c:\windows\system32\microsoft.managementconsole.dll
2010-06-06 17:35 . 2008-04-14 00:11 106496 ——w- c:\windows\system32\mmcfxcommon.dll
2010-06-06 17:35 . 2008-04-14 00:11 37376 ——w- c:\windows\system32\l2gpstore.dll
2010-06-06 17:35 . 2008-04-14 00:11 61440 ——w- c:\windows\system32\kmsvc.dll
2010-06-06 17:35 . 2008-04-14 00:09 6144 ——w- c:\windows\system32\kbdpash.dll
2010-06-06 17:35 . 2008-04-14 00:09 6144 ——w- c:\windows\system32\kbdnepr.dll
2010-06-06 17:35 . 2008-04-14 00:09 6144 ——w- c:\windows\system32\kbdiultn.dll
2010-06-06 17:35 . 2008-04-14 00:09 6144 ——w- c:\windows\system32\kbdbhc.dll
2010-06-06 17:34 . 2008-04-14 00:11 81920 ——w- c:\windows\system32\ieencode.dll
2010-06-06 17:34 . 2008-04-13 16:36 144384 ——w- c:\windows\system32\drivers\hdaudbus.sys
2010-06-06 17:34 . 2008-04-14 00:11 59392 ——w- c:\windows\system32\eapqec.dll
2010-06-06 17:34 . 2008-04-14 00:11 33792 ——w- c:\windows\system32\eapsvc.dll
2010-06-06 17:34 . 2008-04-14 00:11 94208 ——w- c:\windows\system32\eappgnui.dll
2010-06-06 17:34 . 2008-04-14 00:11 40960 ——w- c:\windows\system32\eappprxy.dll
2010-06-06 17:34 . 2008-04-14 00:11 30720 ——w- c:\windows\system32\eapolqec.dll
2010-06-06 17:34 . 2008-04-14 00:11 184832 ——w- c:\windows\system32\eapp3hst.dll
2010-06-06 17:34 . 2008-04-14 00:11 180224 ——w- c:\windows\system32\eapphost.dll
2010-06-06 17:34 . 2008-04-14 00:11 126976 ——w- c:\windows\system32\eappcfg.dll
2010-06-06 17:04 . 2010-06-11 17:45 ——– d—–w- c:\documents and settings\Jess\Application Data\VERITAS
2010-06-06 17:03 . 2010-06-12 08:58 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\ApplicationHistory
2010-06-06 17:03 . 2010-06-06 17:03 127 —-a-w- c:\documents and settings\Jess\Local Settings\Application Data\fusioncache.dat
2010-06-06 17:03 . 2010-06-08 02:45 50992 —-a-w- c:\documents and settings\Jess\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-06 16:41 . 2010-06-06 16:41 ——– d—–w- c:\program files\InterVideo
2010-06-06 16:34 . 2010-06-06 16:34 ——– d—–w- c:\documents and settings\Jay\Application Data\VERITAS
2010-06-06 16:22 . 2008-06-13 11:05 272128 -c—-w- c:\windows\system32\dllcache\bthport.sys
2010-06-06 16:21 . 2009-12-31 16:50 353792 -c—-w- c:\windows\system32\dllcache\srv.sys
2010-06-06 16:21 . 2009-09-06 07:09 126976 -c—-w- c:\windows\system32\dllcache\ftpsvc2.dll
2010-06-06 16:21 . 2010-02-24 13:11 455680 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys
2010-06-06 16:21 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2010-06-06 16:20 . 2009-05-21 18:46 268288 -c—-w- c:\windows\system32\dllcache\httpext.dll
2010-06-06 16:19 . 2009-10-15 16:28 81920 -c—-w- c:\windows\system32\dllcache\fontsub.dll
2010-06-06 16:19 . 2009-10-15 16:28 119808 -c—-w- c:\windows\system32\dllcache\t2embed.dll
2010-06-06 16:19 . 2009-03-06 14:22 284160 -c—-w- c:\windows\system32\dllcache\pdh.dll
2010-06-06 16:19 . 2009-02-09 12:10 401408 -c—-w- c:\windows\system32\dllcache\rpcss.dll
2010-06-06 16:19 . 2009-02-06 11:11 110592 -c—-w- c:\windows\system32\dllcache\services.exe
2010-06-06 16:19 . 2009-02-09 12:10 473600 -c—-w- c:\windows\system32\dllcache\fastprox.dll
2010-06-06 16:19 . 2009-02-06 10:10 227840 -c—-w- c:\windows\system32\dllcache\wmiprvse.exe
2010-06-06 16:19 . 2009-02-09 12:10 453120 -c—-w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-06-06 16:19 . 2009-06-25 08:25 730112 -c—-w- c:\windows\system32\dllcache\lsasrv.dll
2010-06-06 16:19 . 2009-02-09 12:10 617472 -c—-w- c:\windows\system32\dllcache\advapi32.dll
2010-06-06 16:19 . 2009-02-09 12:10 714752 -c—-w- c:\windows\system32\dllcache\ntdll.dll
2010-06-06 16:18 . 2010-02-16 14:08 2146304 -c—-w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-06-06 16:18 . 2010-02-17 13:10 2189952 -c—-w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-06-06 16:18 . 2010-02-16 13:25 2024448 -c—-w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-06-06 16:18 . 2010-06-06 16:33 ——– d—–w- c:\program files\VERITAS Software
2010-06-06 16:17 . 2009-10-23 15:28 3558912 -c—-w- c:\windows\system32\dllcache\moviemk.exe
2010-06-06 16:11 . 2008-05-08 14:02 203136 -c—-w- c:\windows\system32\dllcache\rmcast.sys
2010-06-06 16:10 . 2008-05-01 14:33 331776 -c—-w- c:\windows\system32\dllcache\msadce.dll
2010-06-06 16:06 . 2009-06-10 13:19 2066432 -c—-w- c:\windows\system32\dllcache\mstscax.dll
2010-06-06 16:05 . 2008-10-15 16:34 337408 -c—-w- c:\windows\system32\dllcache\netapi32.dll
2010-06-06 16:03 . 2008-05-03 11:55 2560 ——w- c:\windows\system32\xpsp4res.dll
2010-06-06 16:03 . 2008-04-21 12:08 215552 -c—-w- c:\windows\system32\dllcache\wordpad.exe
2010-06-06 00:00 . 2004-04-01 20:47 69632 ——w- c:\windows\erase_SR.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-17 21:38 . 2003-06-16 22:19 94291 —-a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2010-06-17 21:28 . 2003-06-16 22:13 ——– d—–w- c:\program files\Windows Journal
2010-06-12 05:23 . 2005-10-15 13:40 ——– d—–w- c:\program files\Yahoo!
2010-06-06 16:41 . 2003-06-17 19:19 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-06-06 00:03 . 2005-08-25 16:34 ——– d—–w- c:\program files\CheckPoint
2010-05-06 10:41 . 2003-06-16 21:56 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22 . 2003-06-16 21:56 1851264 —-a-w- c:\windows\system32\win32k.sys
2010-04-20 05:30 . 2003-06-16 21:55 285696 —-a-w- c:\windows\system32\atmfd.dll
2010-04-07 03:50 . 2010-04-07 03:50 3693160 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\yau\{45BD9EDA-B512-4C2C-9672-44F1118CAC33}\ytb_8.1.4.26_2.1.3_ysp_2.0.1.13_mail_bts_pub_us_setup_.exe
2010-04-07 03:50 . 2010-04-07 03:50 3693160 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\yau\{B7C919AA-51EB-4945-A59B-C37F6F827443}\ytb_8.1.4.26_2.1.3_ysp_2.0.1.13_mail_bts_pub_us_setup_.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-10-30 01:55 333192 —-a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}]
2010-03-24 15:36 392624 —-a-w- c:\program files\iMesh Applications\MediaBar\DataMngr\IEBHO.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}]
2009-11-20 17:34 87472 —-a-w- c:\program files\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}"= "c:\program files\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll" [2009-11-20 87472]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-30 333192]
[HKEY_CLASSES_ROOT\clsid\{abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f}]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-30 333192]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PRISMSTA.EXE"="PRISMSTA.EXE START" [X]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2002-12-04 114688]
"LTSMMSG"="LTSMMSG.exe" [2001-12-17 32768]
"TabletWizard"="c:\windows\help\SplshWrp.exe" [2008-04-14 16384]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-08-18 94208]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 147514]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 19968]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-02-09 180269]
"StorageGuard"="c:\program files\VERITAS Software\Update Manager\sgtray.exe" [2002-06-18 155648]
"DataMngr"="c:\progra~1\IMESHA~1\MediaBar\DataMngr\DataMngrUI.exe" [2010-03-24 797104]
"Easy Dock"="c:\documents and settings\Jess\My Documents\RCA easyRip\EZDock.exe" [2009-04-03 573440]
c:\documents and settings\Jess\Start Menu\Programs\Startup\
RCA Detective.lnk - c:\documents and settings\Jess\My Documents\RCA Detective\RCADetective.exe [2010-6-12 942592]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
2008-04-14 00:11 47104 —-a-w- c:\program files\Common Files\Microsoft Shared\Ink\loginkey.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
2002-08-29 10:41 11776 —-a-w- c:\windows\system32\tabbtnwl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
2008-04-14 00:12 32256 —-a-w- c:\windows\system32\tpgwlnot.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-602162358-1220945662-1801674531-4635\Scripts\Logon\0\0]
"Script"=\\bos.altova.com\SysVol\bos.altova.com\scripts\logon1.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-602162358-1220945662-1801674531-4663\Scripts\Logon\0\0]
"Script"=\\bos.altova.com\sysvol\bos.altova.com\scripts\logon1.bat
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRISMSTA.EXE]
PRISMSTA.EXE START [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FjMenu]
2003-01-20 22:26 32768 -c–a-w- c:\program files\Fujitsu\FjMenu\FjMenu.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 –sh–w- c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2005-12-14 00:27 7094272 —-a-w- c:\program files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TabletTip]
2008-04-14 00:12 271872 —-a-w- c:\program files\Common Files\Microsoft Shared\Ink\tabtip.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [10/14/2005 1:02 PM 58016]
R3 {6D08DE67-D457-4d38-A7F5-D88CCB81EE00};AIM 3.0 NS2501;c:\windows\system32\drivers\A306.sys [6/17/2003 3:19 PM 15927]
R3 FJTabBtn;Fujitsu Stylistic ST4000 Button Driver;c:\windows\system32\drivers\FjTabBtn.sys [6/16/2003 7:16 PM 10368]
R3 hidpen;Wacom Serial Pen HID MiniDriver;c:\windows\system32\drivers\hidpen.sys [6/17/2003 3:33 PM 30592]
R3 LucentSoftModem;Lucent Technologies Soft Modem;c:\windows\system32\drivers\LTSM.sys [6/16/2003 7:15 PM 807021]
R3 PRISM;Intersil PRISM Wireless LAN Driver;c:\windows\system32\drivers\PRISMNDS.sys [8/24/2005 12:20 PM 642560]
S3 WacomPen;Wacom Serial Pen HID Driver;c:\windows\system32\drivers\wacompen.sys [6/16/2003 11:09 AM 14208]
— Other Services/Drivers In Memory —
*NewlyCreated* - ENTDRV51
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyServer = http=127.0.0.1:1053
uInternet Settings,ProxyOverride =
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Weather - c:\program files\AWS\WeatherBug\Weather.exe
Notify-ckpNotify - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-19 21:41
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(396)
c:\windows\SYSTEM32\igfxsrvc.dll
c:\windows\SYSTEM32\hccutils.DLL
- - - - - - - > 'lsass.exe'(452)
c:\windows\system32\EntApi.dll
c:\windows\system32\WININET.dll
.
Completion time: 2010-06-19 21:47:17
ComboFix-quarantined-files.txt 2010-06-20 01:47
Pre-Run: 12,631,384,064 bytes free
Post-Run: 13,250,248,704 bytes free
- - End Of File - - EFA388C3E12BD2AE08D528D6D6C77E0A
ComboFix 10-06-19.01 - Jess 06/19/2010 21:22:02.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.207 [GMT -4:00]
Running from: E:\ComboFix.exe
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\Jay\Local Settings\Application Data\syssvc.exe
c:\documents and settings\Jess\Local Settings\Application Data\syssvc.exe
c:\documents and settings\raj\Application Data\shb.dat
c:\windows\msnimport.exe
c:\windows\system32\Cache
c:\windows\system32\Thumbs.db
D:\AUTORUN.INF
—– BITS: Possible infected sites —–
hxxp://download.yimg.com
.
((((((((((((((((((((((((( Files Created from 2010-05-20 to 2010-06-20 )))))))))))))))))))))))))))))))
.
2010-06-17 22:58 . 2010-06-17 22:59 ——– d—–w- c:\documents and settings\Jess\Application Data\MSN6
2010-06-17 21:26 . 2010-06-17 21:26 ——– d—–w- c:\windows\system32\scripting
2010-06-17 21:26 . 2010-06-17 21:26 ——– d—–w- c:\windows\l2schemas
2010-06-17 21:26 . 2010-06-17 21:26 ——– d—–w- c:\windows\system32\en
2010-06-17 18:35 . 2010-06-17 18:36 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\WeatherBug
2010-06-14 01:41 . 2010-06-14 01:41 439816 —-a-w- c:\documents and settings\Jess\Application Data\Real\Update\setup3.10\setup.exe
2010-06-13 03:39 . 2010-06-13 03:39 ——– d—–w- c:\documents and settings\Jess\Application Data\AdobeUM
2010-06-13 03:39 . 2010-06-13 03:39 ——– d—–w- c:\program files\AskBarDis
2010-06-13 03:39 . 2010-06-13 03:39 ——– d—–w- c:\documents and settings\Jess\Application Data\WeatherBug
2010-06-13 03:38 . 2010-06-13 03:39 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\Adobe
2010-06-12 19:03 . 2010-06-12 19:03 ——– d-sh–w- c:\documents and settings\Jess\IECompatCache
2010-06-12 19:01 . 2010-06-12 19:01 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\vmnoki
2010-06-12 08:16 . 2010-06-12 08:24 ——– d—–w- c:\documents and settings\Jess\Application Data\EmailNotifier
2010-06-12 08:15 . 2010-06-12 08:15 ——– d—–w- c:\documents and settings\All Users\Application Data\EmailNotifier
2010-06-12 08:15 . 2010-06-12 08:15 35311 —-a-w- c:\documents and settings\All Users\Application Data\EmailNotifier\uninstall.exe
2010-06-12 07:09 . 2010-06-12 07:09 ——– d—–w- c:\documents and settings\Jay\Local Settings\Application Data\Yahoo
2010-06-12 07:09 . 2010-06-12 07:10 ——– d—–w- c:\documents and settings\Jay\Application Data\imeshmediabartb
2010-06-12 07:09 . 2010-06-12 07:09 ——– d—–w- c:\documents and settings\Jay\Application Data\Yahoo!
2010-06-12 05:41 . 2010-06-12 05:41 439816 —-a-w- c:\documents and settings\Jay\Application Data\Real\Update\setup3.10\setup.exe
2010-06-12 05:38 . 2010-06-12 05:45 ——– d—–w- c:\documents and settings\Jay\Application Data\MSN6
2010-06-12 05:31 . 2010-06-12 05:31 ——– d—–w- c:\documents and settings\Jay\Local Settings\Application Data\iMesh
2010-06-12 05:26 . 2010-06-12 05:26 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\Yahoo
2010-06-12 05:23 . 2010-06-12 05:23 ——– d—–w- c:\program files\BarQuery
2010-06-12 05:23 . 2010-06-12 05:23 ——– d—–w- c:\documents and settings\All Users\Application Data\BarQuery
2010-06-12 05:23 . 2010-06-11 18:37 65792 —-a-w- c:\documents and settings\All Users\Application Data\BarQuery\barquery144.exe
2010-06-12 05:23 . 2010-06-12 05:23 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-06-12 05:23 . 2010-06-12 05:23 ——– d—–w- c:\program files\Free Offers from Freeze.com
2010-06-12 05:23 . 2010-06-12 05:24 ——– d—–w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-06-12 05:23 . 2010-06-12 05:23 ——– d—–w- c:\documents and settings\Jess\Application Data\Yahoo!
2010-06-12 03:07 . 2010-06-12 05:03 ——– d—–w- c:\documents and settings\Jess\Application Data\imeshmediabartb
2010-06-12 03:04 . 2010-06-12 03:23 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\iMesh
2010-06-12 03:04 . 2010-06-12 03:07 ——– d—–w- c:\program files\iMesh Applications
2010-06-12 00:39 . 2010-06-12 00:39 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\ijurnn
2010-06-11 17:40 . 2010-05-06 10:41 743424 -c—-w- c:\windows\system32\dllcache\iedvtool.dll
2010-06-09 03:44 . 2010-06-09 03:44 ——– d—–w- c:\documents and settings\Jay\Local Settings\Application Data\bteekx
2010-06-08 23:22 . 2010-06-08 23:22 ——– d—–w- c:\documents and settings\Jay\Local Settings\Application Data\pualkqxfs
2010-06-08 03:26 . 2010-06-08 03:26 ——– d-sh–w- c:\documents and settings\Jay\IECompatCache
2010-06-08 03:25 . 2010-06-08 03:25 ——– d-sh–w- c:\documents and settings\Jay\PrivacIE
2010-06-08 03:24 . 2010-06-08 03:24 ——– d-sh–w- c:\documents and settings\Jay\IETldCache
2010-06-08 02:04 . 2010-06-08 02:04 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2010-06-07 17:52 . 2010-06-08 02:20 ——– d—–w- c:\windows\ie8updates
2010-06-07 17:49 . 2010-05-06 10:41 599040 -c—-w- c:\windows\system32\dllcache\msfeeds.dll
2010-06-07 17:48 . 2010-05-06 10:41 55296 -c—-w- c:\windows\system32\dllcache\msfeedsbs.dll
2010-06-07 17:48 . 2010-05-06 10:41 247808 -c—-w- c:\windows\system32\dllcache\ieproxy.dll
2010-06-07 17:48 . 2010-05-06 10:41 12800 -c—-w- c:\windows\system32\dllcache\xpshims.dll
2010-06-07 17:48 . 2010-05-06 10:41 1985536 -c—-w- c:\windows\system32\dllcache\iertutil.dll
2010-06-07 17:42 . 2010-06-07 17:42 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\ewsmjm
2010-06-07 00:56 . 2010-06-07 00:56 ——– d-sh–w- c:\documents and settings\Jess\PrivacIE
2010-06-06 18:52 . 2010-06-06 18:52 ——– d—–w- c:\windows\system32\XPSViewer
2010-06-06 18:51 . 2010-06-06 18:51 ——– d—–w- c:\program files\MSBuild
2010-06-06 18:51 . 2010-06-06 18:51 ——– d—–w- c:\program files\Reference Assemblies
2010-06-06 18:51 . 2008-07-06 12:06 89088 —-a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-06-06 18:50 . 2008-07-06 12:06 89088 -c—-w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-06-06 18:50 . 2008-07-06 12:06 117760 ——w- c:\windows\system32\prntvpt.dll
2010-06-06 18:50 . 2008-07-06 12:06 575488 -c—-w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-06-06 18:50 . 2008-07-06 12:06 575488 ——w- c:\windows\system32\xpsshhdr.dll
2010-06-06 18:50 . 2008-07-06 12:06 1676288 -c—-w- c:\windows\system32\dllcache\xpssvcs.dll
2010-06-06 18:50 . 2008-07-06 12:06 1676288 ——w- c:\windows\system32\xpssvcs.dll
2010-06-06 18:50 . 2008-07-06 10:50 597504 -c—-w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-06-06 18:50 . 2008-07-06 10:50 597504 ——w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-06-06 18:50 . 2010-06-06 18:51 ——– d—–w- C:\d6a9758d53fac972d0704768d64470
2010-06-06 18:42 . 2010-06-06 18:42 ——– d—–w- c:\program files\MSXML 6.0
2010-06-06 18:40 . 2010-06-06 18:40 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-06-06 18:36 . 2010-06-06 18:36 ——– d-sh–w- c:\documents and settings\Jess\IETldCache
2010-06-06 18:18 . 2010-06-06 18:20 ——– dc-h–w- c:\windows\ie8
2010-06-06 17:38 . 2008-04-14 00:12 69120 ——w- c:\windows\system32\wlanapi.dll
2010-06-06 17:37 . 2008-04-14 00:12 53248 ——w- c:\windows\system32\tsgqec.dll
2010-06-06 17:37 . 2008-04-14 00:12 50688 ——w- c:\windows\system32\tspkg.dll
2010-06-06 17:37 . 2008-04-13 18:40 10240 ——w- c:\windows\system32\drivers\sffp_mmc.sys
2010-06-06 17:37 . 2008-04-14 00:12 32768 ——w- c:\windows\system32\setupn.exe
2010-06-06 17:35 . 2008-04-14 00:12 33792 ——w- c:\windows\system32\mmcperf.exe
2010-06-06 17:35 . 2008-04-14 00:11 397312 ——w- c:\windows\system32\mmcex.dll
2010-06-06 17:35 . 2008-04-14 00:11 184320 ——w- c:\windows\system32\microsoft.managementconsole.dll
2010-06-06 17:35 . 2008-04-14 00:11 106496 ——w- c:\windows\system32\mmcfxcommon.dll
2010-06-06 17:35 . 2008-04-14 00:11 37376 ——w- c:\windows\system32\l2gpstore.dll
2010-06-06 17:35 . 2008-04-14 00:11 61440 ——w- c:\windows\system32\kmsvc.dll
2010-06-06 17:35 . 2008-04-14 00:09 6144 ——w- c:\windows\system32\kbdpash.dll
2010-06-06 17:35 . 2008-04-14 00:09 6144 ——w- c:\windows\system32\kbdnepr.dll
2010-06-06 17:35 . 2008-04-14 00:09 6144 ——w- c:\windows\system32\kbdiultn.dll
2010-06-06 17:35 . 2008-04-14 00:09 6144 ——w- c:\windows\system32\kbdbhc.dll
2010-06-06 17:34 . 2008-04-14 00:11 81920 ——w- c:\windows\system32\ieencode.dll
2010-06-06 17:34 . 2008-04-13 16:36 144384 ——w- c:\windows\system32\drivers\hdaudbus.sys
2010-06-06 17:34 . 2008-04-14 00:11 59392 ——w- c:\windows\system32\eapqec.dll
2010-06-06 17:34 . 2008-04-14 00:11 33792 ——w- c:\windows\system32\eapsvc.dll
2010-06-06 17:34 . 2008-04-14 00:11 94208 ——w- c:\windows\system32\eappgnui.dll
2010-06-06 17:34 . 2008-04-14 00:11 40960 ——w- c:\windows\system32\eappprxy.dll
2010-06-06 17:34 . 2008-04-14 00:11 30720 ——w- c:\windows\system32\eapolqec.dll
2010-06-06 17:34 . 2008-04-14 00:11 184832 ——w- c:\windows\system32\eapp3hst.dll
2010-06-06 17:34 . 2008-04-14 00:11 180224 ——w- c:\windows\system32\eapphost.dll
2010-06-06 17:34 . 2008-04-14 00:11 126976 ——w- c:\windows\system32\eappcfg.dll
2010-06-06 17:04 . 2010-06-11 17:45 ——– d—–w- c:\documents and settings\Jess\Application Data\VERITAS
2010-06-06 17:03 . 2010-06-12 08:58 ——– d—–w- c:\documents and settings\Jess\Local Settings\Application Data\ApplicationHistory
2010-06-06 17:03 . 2010-06-06 17:03 127 —-a-w- c:\documents and settings\Jess\Local Settings\Application Data\fusioncache.dat
2010-06-06 17:03 . 2010-06-08 02:45 50992 —-a-w- c:\documents and settings\Jess\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-06-06 16:41 . 2010-06-06 16:41 ——– d—–w- c:\program files\InterVideo
2010-06-06 16:34 . 2010-06-06 16:34 ——– d—–w- c:\documents and settings\Jay\Application Data\VERITAS
2010-06-06 16:22 . 2008-06-13 11:05 272128 -c—-w- c:\windows\system32\dllcache\bthport.sys
2010-06-06 16:21 . 2009-12-31 16:50 353792 -c—-w- c:\windows\system32\dllcache\srv.sys
2010-06-06 16:21 . 2009-09-06 07:09 126976 -c—-w- c:\windows\system32\dllcache\ftpsvc2.dll
2010-06-06 16:21 . 2010-02-24 13:11 455680 -c—-w- c:\windows\system32\dllcache\mrxsmb.sys
2010-06-06 16:21 . 2009-11-21 15:51 471552 -c—-w- c:\windows\system32\dllcache\aclayers.dll
2010-06-06 16:20 . 2009-05-21 18:46 268288 -c—-w- c:\windows\system32\dllcache\httpext.dll
2010-06-06 16:19 . 2009-10-15 16:28 81920 -c—-w- c:\windows\system32\dllcache\fontsub.dll
2010-06-06 16:19 . 2009-10-15 16:28 119808 -c—-w- c:\windows\system32\dllcache\t2embed.dll
2010-06-06 16:19 . 2009-03-06 14:22 284160 -c—-w- c:\windows\system32\dllcache\pdh.dll
2010-06-06 16:19 . 2009-02-09 12:10 401408 -c—-w- c:\windows\system32\dllcache\rpcss.dll
2010-06-06 16:19 . 2009-02-06 11:11 110592 -c—-w- c:\windows\system32\dllcache\services.exe
2010-06-06 16:19 . 2009-02-09 12:10 473600 -c—-w- c:\windows\system32\dllcache\fastprox.dll
2010-06-06 16:19 . 2009-02-06 10:10 227840 -c—-w- c:\windows\system32\dllcache\wmiprvse.exe
2010-06-06 16:19 . 2009-02-09 12:10 453120 -c—-w- c:\windows\system32\dllcache\wmiprvsd.dll
2010-06-06 16:19 . 2009-06-25 08:25 730112 -c—-w- c:\windows\system32\dllcache\lsasrv.dll
2010-06-06 16:19 . 2009-02-09 12:10 617472 -c—-w- c:\windows\system32\dllcache\advapi32.dll
2010-06-06 16:19 . 2009-02-09 12:10 714752 -c—-w- c:\windows\system32\dllcache\ntdll.dll
2010-06-06 16:18 . 2010-02-16 14:08 2146304 -c—-w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-06-06 16:18 . 2010-02-17 13:10 2189952 -c—-w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-06-06 16:18 . 2010-02-16 13:25 2024448 -c—-w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-06-06 16:18 . 2010-06-06 16:33 ——– d—–w- c:\program files\VERITAS Software
2010-06-06 16:17 . 2009-10-23 15:28 3558912 -c—-w- c:\windows\system32\dllcache\moviemk.exe
2010-06-06 16:11 . 2008-05-08 14:02 203136 -c—-w- c:\windows\system32\dllcache\rmcast.sys
2010-06-06 16:10 . 2008-05-01 14:33 331776 -c—-w- c:\windows\system32\dllcache\msadce.dll
2010-06-06 16:06 . 2009-06-10 13:19 2066432 -c—-w- c:\windows\system32\dllcache\mstscax.dll
2010-06-06 16:05 . 2008-10-15 16:34 337408 -c—-w- c:\windows\system32\dllcache\netapi32.dll
2010-06-06 16:03 . 2008-05-03 11:55 2560 ——w- c:\windows\system32\xpsp4res.dll
2010-06-06 16:03 . 2008-04-21 12:08 215552 -c—-w- c:\windows\system32\dllcache\wordpad.exe
2010-06-06 00:00 . 2004-04-01 20:47 69632 ——w- c:\windows\erase_SR.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-17 21:38 . 2003-06-16 22:19 94291 —-a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat
2010-06-17 21:28 . 2003-06-16 22:13 ——– d—–w- c:\program files\Windows Journal
2010-06-12 05:23 . 2005-10-15 13:40 ——– d—–w- c:\program files\Yahoo!
2010-06-06 16:41 . 2003-06-17 19:19 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-06-06 00:03 . 2005-08-25 16:34 ——– d—–w- c:\program files\CheckPoint
2010-05-06 10:41 . 2003-06-16 21:56 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22 . 2003-06-16 21:56 1851264 —-a-w- c:\windows\system32\win32k.sys
2010-04-20 05:30 . 2003-06-16 21:55 285696 —-a-w- c:\windows\system32\atmfd.dll
2010-04-07 03:50 . 2010-04-07 03:50 3693160 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\yau\{45BD9EDA-B512-4C2C-9672-44F1118CAC33}\ytb_8.1.4.26_2.1.3_ysp_2.0.1.13_mail_bts_pub_us_setup_.exe
2010-04-07 03:50 . 2010-04-07 03:50 3693160 —-a-w- c:\documents and settings\All Users\Application Data\Yahoo!\yau\{B7C919AA-51EB-4945-A59B-C37F6F827443}\ytb_8.1.4.26_2.1.3_ysp_2.0.1.13_mail_bts_pub_us_setup_.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-10-30 01:55 333192 —-a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{474597C5-AB09-49d6-A4D5-2E8D7341384E}]
2010-03-24 15:36 392624 —-a-w- c:\program files\iMesh Applications\MediaBar\DataMngr\IEBHO.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}]
2009-11-20 17:34 87472 —-a-w- c:\program files\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F}"= "c:\program files\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll" [2009-11-20 87472]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-30 333192]
[HKEY_CLASSES_ROOT\clsid\{abb49b3b-ab7d-4ed0-9135-93fd5aa4f69f}]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-30 333192]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PRISMSTA.EXE"="PRISMSTA.EXE START" [X]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2002-12-04 114688]
"LTSMMSG"="LTSMMSG.exe" [2001-12-17 32768]
"TabletWizard"="c:\windows\help\SplshWrp.exe" [2008-04-14 16384]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-08-18 94208]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 139320]
"Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 147514]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 19968]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-02-09 180269]
"StorageGuard"="c:\program files\VERITAS Software\Update Manager\sgtray.exe" [2002-06-18 155648]
"DataMngr"="c:\progra~1\IMESHA~1\MediaBar\DataMngr\DataMngrUI.exe" [2010-03-24 797104]
"Easy Dock"="c:\documents and settings\Jess\My Documents\RCA easyRip\EZDock.exe" [2009-04-03 573440]
c:\documents and settings\Jess\Start Menu\Programs\Startup\
RCA Detective.lnk - c:\documents and settings\Jess\My Documents\RCA Detective\RCADetective.exe [2010-6-12 942592]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
2008-04-14 00:11 47104 —-a-w- c:\program files\Common Files\Microsoft Shared\Ink\loginkey.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
2002-08-29 10:41 11776 —-a-w- c:\windows\system32\tabbtnwl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
2008-04-14 00:12 32256 —-a-w- c:\windows\system32\tpgwlnot.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-602162358-1220945662-1801674531-4635\Scripts\Logon\0\0]
"Script"=\\bos.altova.com\SysVol\bos.altova.com\scripts\logon1.bat
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-602162358-1220945662-1801674531-4663\Scripts\Logon\0\0]
"Script"=\\bos.altova.com\sysvol\bos.altova.com\scripts\logon1.bat
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRISMSTA.EXE]
PRISMSTA.EXE START [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FjMenu]
2003-01-20 22:26 32768 -c–a-w- c:\program files\Fujitsu\FjMenu\FjMenu.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 –sh–w- c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2005-12-14 00:27 7094272 —-a-w- c:\program files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TabletTip]
2008-04-14 00:12 271872 —-a-w- c:\program files\Common Files\Microsoft Shared\Ink\tabtip.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
R1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [10/14/2005 1:02 PM 58016]
R3 {6D08DE67-D457-4d38-A7F5-D88CCB81EE00};AIM 3.0 NS2501;c:\windows\system32\drivers\A306.sys [6/17/2003 3:19 PM 15927]
R3 FJTabBtn;Fujitsu Stylistic ST4000 Button Driver;c:\windows\system32\drivers\FjTabBtn.sys [6/16/2003 7:16 PM 10368]
R3 hidpen;Wacom Serial Pen HID MiniDriver;c:\windows\system32\drivers\hidpen.sys [6/17/2003 3:33 PM 30592]
R3 LucentSoftModem;Lucent Technologies Soft Modem;c:\windows\system32\drivers\LTSM.sys [6/16/2003 7:15 PM 807021]
R3 PRISM;Intersil PRISM Wireless LAN Driver;c:\windows\system32\drivers\PRISMNDS.sys [8/24/2005 12:20 PM 642560]
S3 WacomPen;Wacom Serial Pen HID Driver;c:\windows\system32\drivers\wacompen.sys [6/16/2003 11:09 AM 14208]
— Other Services/Drivers In Memory —
*NewlyCreated* - ENTDRV51
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyServer = http=127.0.0.1:1053
uInternet Settings,ProxyOverride =
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-Weather - c:\program files\AWS\WeatherBug\Weather.exe
Notify-ckpNotify - (no file)
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-19 21:41
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(396)
c:\windows\SYSTEM32\igfxsrvc.dll
c:\windows\SYSTEM32\hccutils.DLL
- - - - - - - > 'lsass.exe'(452)
c:\windows\system32\EntApi.dll
c:\windows\system32\WININET.dll
.
Completion time: 2010-06-19 21:47:17
ComboFix-quarantined-files.txt 2010-06-20 01:47
Pre-Run: 12,631,384,064 bytes free
Post-Run: 13,250,248,704 bytes free
- - End Of File - - EFA388C3E12BD2AE08D528D6D6C77E0A
LDTate
Reboot that computer and see if the internet is working now
bob5326
Still not yet…. ran the diagnostic again and the last three lines still say that it could not make connection with HTTP, HTTPS, FTP………
bob5326
and it tell you to go to that link I sent you about how to determine and to recover from Winsock2 corruption in windows server 2003, in windows XP, and in windows vista…
LDTate
Click Start > Control Panel-
open Add/Remove Programs in Control Panel
- select 'Set Program Access and Defaults'
- select Windows and 'OK"
Windows will run through its little routine
Reboot and let me know.
bob5326
No, not yet…..
LDTate
I'm out of ideas.
I suggest you start a new toipc in our Browser Forum to get some Tech help
I suggest you start a new toipc in our Browser Forum to get some Tech help
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI