JFoster
Topic Starter
Here is my original thread http://forums.whatthetech.com/index.php?sh…mp;#entry662519
I finally got around to following the directions given. It hasn't been freezing up anymore but I really haven't been doing many online employment applications again either. I have been experiencing alot of "This tab has been recovered" going on. And there seems to be a "You won a free Apple Ipad !" banner/pop up/voice over following me around the web… fairly regular "find old classmates" pop up as well even though my pop up blocker is on. Here is the log from ComboFX:
ComboFix 10-07-23.02 - James Foster 07/24/2010 0:13.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.194 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Shared
.
((((((((((((((((((((((((( Files Created from 2010-06-24 to 2010-07-24 )))))))))))))))))))))))))))))))
.
2010-07-14 17:48 . 2010-06-14 14:31 744448 ——w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-09 23:56 . 2008-04-13 18:45 26112 —-a-w- c:\windows\system32\drivers\usbser.sys
2010-07-09 23:56 . 2008-04-13 18:45 26112 —-a-w- c:\windows\system32\dllcache\usbser.sys
2010-07-09 23:55 . 2008-11-07 23:55 16928 ——w- c:\windows\system32\spmsgXP_2k3.dll
2010-07-09 23:52 . 2010-07-09 23:52 ——– d—–w- c:\documents and settings\James Foster\Application Data\Nokia
2010-07-09 23:52 . 2010-07-09 23:56 ——– d—–w- c:\documents and settings\James Foster\Application Data\PC Suite
2010-07-09 23:52 . 2010-07-09 23:52 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Suite
2010-07-09 23:48 . 2010-07-09 23:46 36406560 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Nokia_PC_Suite_eng_us_web.exe
2010-07-09 23:48 . 2010-07-09 23:48 95232 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\pcswpcsi.exe
2010-07-09 23:48 . 2010-07-09 23:48 8192 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstCCD.exe
2010-07-09 23:48 . 2010-07-09 23:48 61440 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-07-09 23:48 . 2010-07-09 23:48 10240 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstPCS.exe
2010-07-09 23:47 . 2010-07-09 23:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Installations
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-16 13:37 . 2006-10-05 17:13 ——– d—–w- c:\program files\Dl_cats
2010-07-09 23:56 . 2010-07-09 23:56 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
2010-07-09 23:56 . 2010-07-09 23:56 0 —ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2010-07-09 23:52 . 2010-07-09 23:50 ——– d—–w- c:\program files\DIFX
2010-07-09 23:51 . 2010-07-09 23:51 ——– d—–w- c:\program files\Common Files\PCSuite
2010-07-09 23:51 . 2010-07-09 23:51 ——– d—–w- c:\program files\Common Files\Nokia
2010-07-09 23:51 . 2010-07-09 23:49 ——– d—–w- c:\program files\Nokia
2010-07-09 23:50 . 2010-07-09 23:50 ——– d—–w- c:\program files\PC Connectivity Solution
2010-06-30 01:34 . 2006-08-23 03:28 ——– d—–w- c:\documents and settings\James Foster\Application Data\AdobeUM
2010-06-28 21:11 . 2010-04-12 02:53 439816 —-a-w- c:\documents and settings\James Foster\Application Data\Real\Update\setup3.10\setup.exe
2010-06-22 03:19 . 2010-06-22 03:19 388096 —-a-r- c:\documents and settings\James Foster\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-06-22 03:19 . 2010-06-22 03:19 ——– d—–w- c:\program files\Trend Micro
2010-06-22 02:47 . 2006-12-26 18:57 ——– d—–w- c:\documents and settings\All Users\Application Data\AOL Downloads
2010-06-14 14:31 . 2004-08-10 18:02 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-05-06 10:41 . 2004-08-10 17:51 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22 . 2004-08-10 17:51 1851264 —-a-w- c:\windows\system32\win32k.sys
2007-04-23 21:37 . 2006-09-13 22:14 8444 —-a-w- c:\program files\Xpcs Registry.dat
2006-09-13 22:14 . 2006-09-13 22:14 611 —-a-w- c:\program files\Uninstall AIM.lnk
2006-08-01 20:39 . 2006-09-13 22:13 116979 —-a-w- c:\program files\uninstll.exe
2006-08-01 20:36 . 2006-09-13 22:13 1511424 —-a-w- c:\program files\AimRes.dll
2006-08-01 20:35 . 2006-09-13 22:13 67112 —-a-w- c:\program files\aim.exe
2006-08-01 20:28 . 2006-09-13 22:13 131072 —-a-w- c:\program files\ateima32.dll
2006-08-01 20:28 . 2006-09-13 22:13 61440 —-a-w- c:\program files\AlertUI.ocm
2006-08-01 20:28 . 2006-09-13 22:13 25088 —-a-w- c:\program files\browse.ocm
2006-08-01 20:28 . 2006-09-13 22:13 217088 —-a-w- c:\program files\buddyui.ocm
2006-08-01 20:27 . 2006-09-13 22:13 233472 —-a-w- c:\program files\AimSecondarySvcs.dll
2006-08-01 20:24 . 2006-09-13 22:13 6656 —-a-w- c:\program files\stats.ocm
2006-08-01 20:24 . 2006-09-13 22:13 98304 —-a-w- c:\program files\ChatUI.ocm
2006-08-01 20:24 . 2006-09-13 22:13 192512 —-a-w- c:\program files\AimCoreSvcs.dll
2006-08-01 20:23 . 2006-09-13 22:13 266240 —-a-w- c:\program files\icbmui.ocm
2006-08-01 20:23 . 2006-09-13 22:13 94208 —-a-w- c:\program files\ticker.ocm
2006-08-01 20:23 . 2006-09-13 22:13 114688 —-a-w- c:\program files\aimapi.dll
2006-08-01 20:23 . 2006-09-13 22:13 16384 —-a-w- c:\program files\Admin.ocm
2006-08-01 20:23 . 2006-09-13 22:13 151552 —-a-w- c:\program files\locateui.ocm
2006-08-01 20:23 . 2006-09-13 22:13 135168 —-a-w- c:\program files\miscui.ocm
2006-08-01 20:22 . 2006-09-13 22:13 15360 —-a-w- c:\program files\NTP.ocm
2006-08-01 20:22 . 2006-09-13 22:13 77824 —-a-w- c:\program files\OscMail.ocm
2006-08-01 20:22 . 2006-09-13 22:13 19968 —-a-w- c:\program files\aimtalk.dll
2006-08-01 20:22 . 2006-09-13 22:13 69632 —-a-w- c:\program files\osclogin.ocm
2006-08-01 20:22 . 2006-09-13 22:13 9216 —-a-w- c:\program files\oscmain.ocm
2006-08-01 20:22 . 2006-09-13 22:13 39936 —-a-w- c:\program files\startup.ocm
2006-08-01 20:22 . 2006-09-13 22:13 155648 —-a-w- c:\program files\aimauto.exe
2006-08-01 20:22 . 2006-09-13 22:13 86016 —-a-w- c:\program files\OscSrch.ocm
2006-08-01 20:21 . 2006-09-13 22:13 13824 —-a-w- c:\program files\osconfig.ocm
2006-08-01 20:21 . 2006-09-13 22:13 39936 —-a-w- c:\program files\rvapps.ocm
2006-08-01 20:21 . 2006-09-13 22:13 13312 —-a-w- c:\program files\popup.ocm
2006-08-01 20:21 . 2006-09-13 22:13 229376 —-a-w- c:\program files\wndutils.dll
2006-08-01 20:16 . 2006-09-13 22:13 151552 —-a-w- c:\program files\oscarui.dll
2006-08-01 20:16 . 2006-09-13 22:13 192512 —-a-w- c:\program files\oscore.dll
2006-08-01 20:16 . 2006-09-13 22:13 192512 —-a-w- c:\program files\ate32.dll
2006-08-01 20:15 . 2006-09-13 22:13 4608 —-a-w- c:\program files\idlemon.dll
2006-07-31 21:56 . 2006-09-13 22:13 135168 —-a-w- c:\program files\sb.dll
2006-07-25 21:19 . 2006-09-13 22:13 180224 —-a-w- c:\program files\rtvideo.dll
2006-07-25 18:13 . 2006-09-13 22:13 2048 —-a-w- c:\program files\ShareFile.exe
2006-07-25 18:13 . 2006-09-13 22:13 2048 —-a-w- c:\program files\SendFile.exe
2006-07-25 18:03 . 2006-09-13 22:13 229376 —-a-w- c:\program files\inetsocket.dll
2006-07-25 16:57 . 2006-09-13 22:13 34304 —-a-w- c:\program files\proto.ocm
2005-07-11 05:39 . 2006-09-13 22:13 245408 —-a-w- c:\program files\unicows.dll
2005-06-14 20:09 . 2006-09-13 22:13 217088 —-a-w- c:\program files\xprt5.dll
2005-05-26 13:32 . 2006-09-13 22:13 38435 —-a-w- c:\program files\licens32.txt
2005-04-25 14:00 . 2006-09-13 22:13 10218 —-a-w- c:\program files\aim95.CNT
2005-04-25 14:00 . 2006-09-13 22:13 505551 —-a-w- c:\program files\AIM95.HLP
2004-08-27 23:29 . 2006-09-13 22:13 1935 —-a-w- c:\program files\icbmftvc.lst
2004-08-18 18:56 . 2006-09-13 22:13 372736 —-a-w- c:\program files\softokn3.dll
2004-08-18 18:56 . 2006-09-13 22:13 110592 —-a-w- c:\program files\ssl3.dll
2004-08-18 18:56 . 2006-09-13 22:13 106496 —-a-w- c:\program files\smime3.dll
2004-08-18 18:56 . 2006-09-13 22:13 348160 —-a-w- c:\program files\nss3.dll
2004-07-22 15:43 . 2006-09-13 22:13 106496 —-a-w- c:\program files\coolpeer.dll
2004-07-22 15:43 . 2006-09-13 22:13 3584 —-a-w- c:\program files\coolsos.dll
2004-07-22 15:43 . 2006-09-13 22:13 184320 —-a-w- c:\program files\coolbos.dll
2004-07-22 15:43 . 2006-09-13 22:13 114688 —-a-w- c:\program files\coolbucky.dll
2004-07-22 15:43 . 2006-09-13 22:13 61440 —-a-w- c:\program files\coolhttp.dll
2004-07-22 15:43 . 2006-09-13 22:13 57344 —-a-w- c:\program files\coolsecnss.dll
2004-07-22 15:42 . 2006-09-13 22:13 73728 —-a-w- c:\program files\coolsocket.dll
2004-07-22 15:42 . 2006-09-13 22:13 8192 —-a-w- c:\program files\xptl.dll
2004-07-22 15:41 . 2006-09-13 22:13 13824 —-a-w- c:\program files\xpcs.dll
2004-07-22 15:41 . 2006-09-13 22:13 135168 —-a-w- c:\program files\xprt.dll
2004-05-18 22:55 . 2006-09-13 22:13 81920 —-a-w- c:\program files\xmltok.dll
2004-05-18 22:55 . 2006-09-13 22:13 53248 —-a-w- c:\program files\xmlparse.dll
2004-04-16 21:27 . 2006-09-13 22:13 94208 —-a-w- c:\program files\jgtktlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 45056 —-a-w- c:\program files\jgsetlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 65536 —-a-w- c:\program files\jgattlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 61440 —-a-w- c:\program files\jgedtlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 40960 —-a-w- c:\program files\jgs6tlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 40960 —-a-w- c:\program files\jgs2tlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 36864 —-a-w- c:\program files\jga1tlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 32768 —-a-w- c:\program files\jgs7tlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 32768 —-a-w- c:\program files\jgs3tlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 45056 —-a-w- c:\program files\jga0tlk.dll
2004-01-09 16:38 . 2006-09-13 22:13 28672 —-a-w- c:\program files\plc4.dll
2004-01-09 16:38 . 2006-09-13 22:13 24576 —-a-w- c:\program files\plds4.dll
2004-01-09 16:38 . 2006-09-13 22:13 159744 —-a-w- c:\program files\nspr4.dll
2003-10-14 22:27 . 2006-09-13 22:13 2486 —-a-w- c:\program files\netwait.odl
2003-10-14 22:27 . 2006-09-13 22:13 2670 —-a-w- c:\program files\aim.odl
2003-01-06 21:41 . 2006-09-13 22:13 1457 —-a-w- c:\program files\rvappstm.lst
2002-07-18 16:00 . 2006-09-13 22:13 139264 —-a-w- c:\program files\dunzip32.dll
2001-09-28 22:00 . 2006-09-13 22:13 164864 —-a-w- c:\program files\unwise32.exe
2001-01-30 23:04 . 2006-09-13 22:13 1375 —-a-w- c:\program files\aimalert.gif
2001-01-30 23:03 . 2006-09-13 22:13 1370 —-a-w- c:\program files\stockalert.gif
2000-02-17 00:39 . 2006-09-13 22:13 1732 —-a-w- c:\program files\unwise32.ini
2010-01-06 19:29 . 2006-09-05 00:25 88 –sh–r- c:\windows\system32\192FFBABCD.sys
2008-04-07 22:07 . 2007-01-11 22:54 56 –sh–r- c:\windows\system32\CDABFB2F19.sys
2010-01-06 19:29 . 2006-09-05 00:25 4704 –sha-w- c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="c:\program files\NetWaiting\netWaiting.exe" [2003-09-10 20480]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2010-05-14 1479680]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-25 282624]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-04-06 1032192]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"HostManager"="c:\program files\Common Files\AOL\1156644074\ee\AOLHostManager.exe" [2005-08-02 159832]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"DLCFCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll" [2005-09-08 73728]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-29 413696]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-08-15 169984]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_12\bin\jusched.exe" [2007-05-02 75520]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-10-19 198160]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-8-14 24576]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 21:08 110592 —-a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/28/2007 10:07 PM 24652]
.
Contents of the 'Scheduled Tasks' folder
2010-07-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 22:57]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-24 00:19
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCFCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(932)
c:\program files\Intel\Wireless\Bin\LgNotify.dll
- - - - - - - > 'explorer.exe'(3156)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2010-07-24 00:22:04
ComboFix-quarantined-files.txt 2010-07-24 05:22
ComboFix2.txt 2010-07-24 00:21
Pre-Run: 40,255,852,544 bytes free
Post-Run: 40,243,134,464 bytes free
- - End Of File - - 3C2BF6F800851063774C96952232E0BA
I finally got around to following the directions given. It hasn't been freezing up anymore but I really haven't been doing many online employment applications again either. I have been experiencing alot of "This tab has been recovered" going on. And there seems to be a "You won a free Apple Ipad !" banner/pop up/voice over following me around the web… fairly regular "find old classmates" pop up as well even though my pop up blocker is on. Here is the log from ComboFX:
ComboFix 10-07-23.02 - James Foster 07/24/2010 0:13.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.194 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Shared
.
((((((((((((((((((((((((( Files Created from 2010-06-24 to 2010-07-24 )))))))))))))))))))))))))))))))
.
2010-07-14 17:48 . 2010-06-14 14:31 744448 ——w- c:\windows\system32\dllcache\helpsvc.exe
2010-07-09 23:56 . 2008-04-13 18:45 26112 —-a-w- c:\windows\system32\drivers\usbser.sys
2010-07-09 23:56 . 2008-04-13 18:45 26112 —-a-w- c:\windows\system32\dllcache\usbser.sys
2010-07-09 23:55 . 2008-11-07 23:55 16928 ——w- c:\windows\system32\spmsgXP_2k3.dll
2010-07-09 23:52 . 2010-07-09 23:52 ——– d—–w- c:\documents and settings\James Foster\Application Data\Nokia
2010-07-09 23:52 . 2010-07-09 23:56 ——– d—–w- c:\documents and settings\James Foster\Application Data\PC Suite
2010-07-09 23:52 . 2010-07-09 23:52 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Suite
2010-07-09 23:48 . 2010-07-09 23:46 36406560 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Nokia_PC_Suite_eng_us_web.exe
2010-07-09 23:48 . 2010-07-09 23:48 95232 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\pcswpcsi.exe
2010-07-09 23:48 . 2010-07-09 23:48 8192 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstCCD.exe
2010-07-09 23:48 . 2010-07-09 23:48 61440 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2010-07-09 23:48 . 2010-07-09 23:48 10240 —-a-w- c:\documents and settings\All Users\Application Data\Installations\{225DB4AA-3CFF-47E8-B3C8-6DAD713E986E}\Installer\CommonCustomActions\UninstPCS.exe
2010-07-09 23:47 . 2010-07-09 23:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Installations
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-07-16 13:37 . 2006-10-05 17:13 ——– d—–w- c:\program files\Dl_cats
2010-07-09 23:56 . 2010-07-09 23:56 0 —ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01009.Wdf
2010-07-09 23:56 . 2010-07-09 23:56 0 —ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2010-07-09 23:52 . 2010-07-09 23:50 ——– d—–w- c:\program files\DIFX
2010-07-09 23:51 . 2010-07-09 23:51 ——– d—–w- c:\program files\Common Files\PCSuite
2010-07-09 23:51 . 2010-07-09 23:51 ——– d—–w- c:\program files\Common Files\Nokia
2010-07-09 23:51 . 2010-07-09 23:49 ——– d—–w- c:\program files\Nokia
2010-07-09 23:50 . 2010-07-09 23:50 ——– d—–w- c:\program files\PC Connectivity Solution
2010-06-30 01:34 . 2006-08-23 03:28 ——– d—–w- c:\documents and settings\James Foster\Application Data\AdobeUM
2010-06-28 21:11 . 2010-04-12 02:53 439816 —-a-w- c:\documents and settings\James Foster\Application Data\Real\Update\setup3.10\setup.exe
2010-06-22 03:19 . 2010-06-22 03:19 388096 —-a-r- c:\documents and settings\James Foster\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-06-22 03:19 . 2010-06-22 03:19 ——– d—–w- c:\program files\Trend Micro
2010-06-22 02:47 . 2006-12-26 18:57 ——– d—–w- c:\documents and settings\All Users\Application Data\AOL Downloads
2010-06-14 14:31 . 2004-08-10 18:02 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-05-06 10:41 . 2004-08-10 17:51 916480 —-a-w- c:\windows\system32\wininet.dll
2010-05-02 05:22 . 2004-08-10 17:51 1851264 —-a-w- c:\windows\system32\win32k.sys
2007-04-23 21:37 . 2006-09-13 22:14 8444 —-a-w- c:\program files\Xpcs Registry.dat
2006-09-13 22:14 . 2006-09-13 22:14 611 —-a-w- c:\program files\Uninstall AIM.lnk
2006-08-01 20:39 . 2006-09-13 22:13 116979 —-a-w- c:\program files\uninstll.exe
2006-08-01 20:36 . 2006-09-13 22:13 1511424 —-a-w- c:\program files\AimRes.dll
2006-08-01 20:35 . 2006-09-13 22:13 67112 —-a-w- c:\program files\aim.exe
2006-08-01 20:28 . 2006-09-13 22:13 131072 —-a-w- c:\program files\ateima32.dll
2006-08-01 20:28 . 2006-09-13 22:13 61440 —-a-w- c:\program files\AlertUI.ocm
2006-08-01 20:28 . 2006-09-13 22:13 25088 —-a-w- c:\program files\browse.ocm
2006-08-01 20:28 . 2006-09-13 22:13 217088 —-a-w- c:\program files\buddyui.ocm
2006-08-01 20:27 . 2006-09-13 22:13 233472 —-a-w- c:\program files\AimSecondarySvcs.dll
2006-08-01 20:24 . 2006-09-13 22:13 6656 —-a-w- c:\program files\stats.ocm
2006-08-01 20:24 . 2006-09-13 22:13 98304 —-a-w- c:\program files\ChatUI.ocm
2006-08-01 20:24 . 2006-09-13 22:13 192512 —-a-w- c:\program files\AimCoreSvcs.dll
2006-08-01 20:23 . 2006-09-13 22:13 266240 —-a-w- c:\program files\icbmui.ocm
2006-08-01 20:23 . 2006-09-13 22:13 94208 —-a-w- c:\program files\ticker.ocm
2006-08-01 20:23 . 2006-09-13 22:13 114688 —-a-w- c:\program files\aimapi.dll
2006-08-01 20:23 . 2006-09-13 22:13 16384 —-a-w- c:\program files\Admin.ocm
2006-08-01 20:23 . 2006-09-13 22:13 151552 —-a-w- c:\program files\locateui.ocm
2006-08-01 20:23 . 2006-09-13 22:13 135168 —-a-w- c:\program files\miscui.ocm
2006-08-01 20:22 . 2006-09-13 22:13 15360 —-a-w- c:\program files\NTP.ocm
2006-08-01 20:22 . 2006-09-13 22:13 77824 —-a-w- c:\program files\OscMail.ocm
2006-08-01 20:22 . 2006-09-13 22:13 19968 —-a-w- c:\program files\aimtalk.dll
2006-08-01 20:22 . 2006-09-13 22:13 69632 —-a-w- c:\program files\osclogin.ocm
2006-08-01 20:22 . 2006-09-13 22:13 9216 —-a-w- c:\program files\oscmain.ocm
2006-08-01 20:22 . 2006-09-13 22:13 39936 —-a-w- c:\program files\startup.ocm
2006-08-01 20:22 . 2006-09-13 22:13 155648 —-a-w- c:\program files\aimauto.exe
2006-08-01 20:22 . 2006-09-13 22:13 86016 —-a-w- c:\program files\OscSrch.ocm
2006-08-01 20:21 . 2006-09-13 22:13 13824 —-a-w- c:\program files\osconfig.ocm
2006-08-01 20:21 . 2006-09-13 22:13 39936 —-a-w- c:\program files\rvapps.ocm
2006-08-01 20:21 . 2006-09-13 22:13 13312 —-a-w- c:\program files\popup.ocm
2006-08-01 20:21 . 2006-09-13 22:13 229376 —-a-w- c:\program files\wndutils.dll
2006-08-01 20:16 . 2006-09-13 22:13 151552 —-a-w- c:\program files\oscarui.dll
2006-08-01 20:16 . 2006-09-13 22:13 192512 —-a-w- c:\program files\oscore.dll
2006-08-01 20:16 . 2006-09-13 22:13 192512 —-a-w- c:\program files\ate32.dll
2006-08-01 20:15 . 2006-09-13 22:13 4608 —-a-w- c:\program files\idlemon.dll
2006-07-31 21:56 . 2006-09-13 22:13 135168 —-a-w- c:\program files\sb.dll
2006-07-25 21:19 . 2006-09-13 22:13 180224 —-a-w- c:\program files\rtvideo.dll
2006-07-25 18:13 . 2006-09-13 22:13 2048 —-a-w- c:\program files\ShareFile.exe
2006-07-25 18:13 . 2006-09-13 22:13 2048 —-a-w- c:\program files\SendFile.exe
2006-07-25 18:03 . 2006-09-13 22:13 229376 —-a-w- c:\program files\inetsocket.dll
2006-07-25 16:57 . 2006-09-13 22:13 34304 —-a-w- c:\program files\proto.ocm
2005-07-11 05:39 . 2006-09-13 22:13 245408 —-a-w- c:\program files\unicows.dll
2005-06-14 20:09 . 2006-09-13 22:13 217088 —-a-w- c:\program files\xprt5.dll
2005-05-26 13:32 . 2006-09-13 22:13 38435 —-a-w- c:\program files\licens32.txt
2005-04-25 14:00 . 2006-09-13 22:13 10218 —-a-w- c:\program files\aim95.CNT
2005-04-25 14:00 . 2006-09-13 22:13 505551 —-a-w- c:\program files\AIM95.HLP
2004-08-27 23:29 . 2006-09-13 22:13 1935 —-a-w- c:\program files\icbmftvc.lst
2004-08-18 18:56 . 2006-09-13 22:13 372736 —-a-w- c:\program files\softokn3.dll
2004-08-18 18:56 . 2006-09-13 22:13 110592 —-a-w- c:\program files\ssl3.dll
2004-08-18 18:56 . 2006-09-13 22:13 106496 —-a-w- c:\program files\smime3.dll
2004-08-18 18:56 . 2006-09-13 22:13 348160 —-a-w- c:\program files\nss3.dll
2004-07-22 15:43 . 2006-09-13 22:13 106496 —-a-w- c:\program files\coolpeer.dll
2004-07-22 15:43 . 2006-09-13 22:13 3584 —-a-w- c:\program files\coolsos.dll
2004-07-22 15:43 . 2006-09-13 22:13 184320 —-a-w- c:\program files\coolbos.dll
2004-07-22 15:43 . 2006-09-13 22:13 114688 —-a-w- c:\program files\coolbucky.dll
2004-07-22 15:43 . 2006-09-13 22:13 61440 —-a-w- c:\program files\coolhttp.dll
2004-07-22 15:43 . 2006-09-13 22:13 57344 —-a-w- c:\program files\coolsecnss.dll
2004-07-22 15:42 . 2006-09-13 22:13 73728 —-a-w- c:\program files\coolsocket.dll
2004-07-22 15:42 . 2006-09-13 22:13 8192 —-a-w- c:\program files\xptl.dll
2004-07-22 15:41 . 2006-09-13 22:13 13824 —-a-w- c:\program files\xpcs.dll
2004-07-22 15:41 . 2006-09-13 22:13 135168 —-a-w- c:\program files\xprt.dll
2004-05-18 22:55 . 2006-09-13 22:13 81920 —-a-w- c:\program files\xmltok.dll
2004-05-18 22:55 . 2006-09-13 22:13 53248 —-a-w- c:\program files\xmlparse.dll
2004-04-16 21:27 . 2006-09-13 22:13 94208 —-a-w- c:\program files\jgtktlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 45056 —-a-w- c:\program files\jgsetlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 65536 —-a-w- c:\program files\jgattlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 61440 —-a-w- c:\program files\jgedtlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 40960 —-a-w- c:\program files\jgs6tlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 40960 —-a-w- c:\program files\jgs2tlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 36864 —-a-w- c:\program files\jga1tlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 32768 —-a-w- c:\program files\jgs7tlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 32768 —-a-w- c:\program files\jgs3tlk.dll
2004-04-16 21:27 . 2006-09-13 22:13 45056 —-a-w- c:\program files\jga0tlk.dll
2004-01-09 16:38 . 2006-09-13 22:13 28672 —-a-w- c:\program files\plc4.dll
2004-01-09 16:38 . 2006-09-13 22:13 24576 —-a-w- c:\program files\plds4.dll
2004-01-09 16:38 . 2006-09-13 22:13 159744 —-a-w- c:\program files\nspr4.dll
2003-10-14 22:27 . 2006-09-13 22:13 2486 —-a-w- c:\program files\netwait.odl
2003-10-14 22:27 . 2006-09-13 22:13 2670 —-a-w- c:\program files\aim.odl
2003-01-06 21:41 . 2006-09-13 22:13 1457 —-a-w- c:\program files\rvappstm.lst
2002-07-18 16:00 . 2006-09-13 22:13 139264 —-a-w- c:\program files\dunzip32.dll
2001-09-28 22:00 . 2006-09-13 22:13 164864 —-a-w- c:\program files\unwise32.exe
2001-01-30 23:04 . 2006-09-13 22:13 1375 —-a-w- c:\program files\aimalert.gif
2001-01-30 23:03 . 2006-09-13 22:13 1370 —-a-w- c:\program files\stockalert.gif
2000-02-17 00:39 . 2006-09-13 22:13 1732 —-a-w- c:\program files\unwise32.ini
2010-01-06 19:29 . 2006-09-05 00:25 88 –sh–r- c:\windows\system32\192FFBABCD.sys
2008-04-07 22:07 . 2007-01-11 22:54 56 –sh–r- c:\windows\system32\CDABFB2F19.sys
2010-01-06 19:29 . 2006-09-05 00:25 4704 –sha-w- c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="c:\program files\NetWaiting\netWaiting.exe" [2003-09-10 20480]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2010-05-14 1479680]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-25 282624]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-04-06 1032192]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"HostManager"="c:\program files\Common Files\AOL\1156644074\ee\AOLHostManager.exe" [2005-08-02 159832]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"DLCFCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll" [2005-09-08 73728]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-29 413696]
"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2006-08-15 169984]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_12\bin\jusched.exe" [2007-05-02 75520]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-10-19 198160]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-8-14 24576]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 21:08 110592 —-a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/28/2007 10:07 PM 24652]
.
Contents of the 'Scheduled Tasks' folder
2010-07-19 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 22:57]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-07-24 00:19
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCFCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(932)
c:\program files\Intel\Wireless\Bin\LgNotify.dll
- - - - - - - > 'explorer.exe'(3156)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2010-07-24 00:22:04
ComboFix-quarantined-files.txt 2010-07-24 05:22
ComboFix2.txt 2010-07-24 00:21
Pre-Run: 40,255,852,544 bytes free
Post-Run: 40,243,134,464 bytes free
- - End Of File - - 3C2BF6F800851063774C96952232E0BA