hammerman
OK. Thanks for letting me know 
Spyware / Malware / Virus Removal
Google redirects and random opens
24 min read
Mike2200DP
Hammerman - Still traveling but I should be able to run these today or tomorrow - Mike
Mike2200DP
Hammerman
here is are the results of the Combofix from last instructions
ComboFix 10-08-04.05 - Mike Petrushka 08/05/2010 6:57.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2007.908 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Mike Petrushka\Desktop\CFScript.txt
AV: Sunbelt VIPRE *On-access scanning disabled* (Outdated) {964FCE60-0B18-4D30-ADD6-EB178909041C}
* Created a new restore point
FILE ::
"c:\windows\System32\gxzooqir.dll"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Legacy_AZDLB
——-\Service_azdlb
((((((((((((((((((((((((( Files Created from 2010-07-05 to 2010-08-05 )))))))))))))))))))))))))))))))
.
2010-07-30 17:43 . 2010-07-30 17:43 ——– d—–w- C:\_OTL
2010-07-29 16:09 . 2010-07-29 16:15 ——– d—–w- c:\program files\McAfee Security Scan
2010-07-29 15:27 . 2010-07-29 15:27 ——– d—–w- c:\program files\Trend Micro
2010-07-29 15:02 . 2010-07-12 08:55 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-07-29 12:41 . 2010-07-12 08:55 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-07-29 12:16 . 2010-07-29 12:16 ——– d—–w- c:\documents and settings\Mike Petrushka\Local Settings\Application Data\Sunbelt Software
2010-07-29 12:09 . 2010-07-29 12:09 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
2010-07-29 12:09 . 2010-07-29 12:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-07-29 12:09 . 2010-07-29 12:09 ——– d—–w- c:\program files\Lavasoft
2010-07-29 08:25 . 2010-07-29 08:32 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-07-29 03:48 . 2010-07-29 03:48 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Malwarebytes
2010-07-29 03:48 . 2010-04-29 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-29 03:48 . 2010-07-29 03:48 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-07-29 03:48 . 2010-07-29 03:48 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-29 03:48 . 2010-04-29 20:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-07-28 20:59 . 2010-07-28 22:40 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-07-28 20:59 . 2010-07-28 21:02 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-07-27 20:59 . 2010-01-04 11:29 69720 —-a-w- c:\windows\system32\drivers\sbapifs.sys
2010-07-27 20:59 . 2010-01-04 11:29 13400 —-a-w- c:\windows\system32\drivers\sbaphd.sys
2010-07-27 20:51 . 2010-07-27 20:51 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Sunbelt
2010-07-27 20:49 . 2010-07-27 20:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Sunbelt
2010-07-27 20:47 . 2010-05-26 18:57 204632 —-a-w- c:\windows\system32\drivers\sbtis.sys
2010-07-27 20:47 . 2010-07-27 20:47 ——– d—–w- c:\program files\Sunbelt Software
2010-07-27 19:22 . 2010-07-27 19:22 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-07-27 04:14 . 2010-07-27 04:14 277784 —-a-w- c:\windows\system32\drivers\niexerpl.sys
2010-07-27 02:33 . 2010-07-27 02:33 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Epson
2010-07-26 16:23 . 2010-07-30 21:23 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-07-24 17:13 . 2006-10-31 05:10 51360 —-a-w- c:\windows\system32\EpPicPrt.dll
2010-07-24 17:12 . 2010-07-24 17:16 ——– d—–w- c:\documents and settings\All Users\Application Data\EPSON
2010-07-24 17:12 . 2010-07-24 17:12 ——– d—–w- c:\program files\Epson Software
2010-07-24 17:11 . 2009-09-17 05:00 342016 —-a-w- c:\windows\system32\eswiaud.dll
2010-07-24 17:11 . 2009-05-01 05:00 15872 —-a-w- c:\windows\system32\escdev.dll
2010-07-24 17:11 . 2009-05-01 05:00 128392 —-a-w- c:\windows\system32\esdevapp.exe
2010-07-24 17:11 . 2010-07-24 17:12 ——– d—–w- c:\program files\epson
2010-07-21 04:50 . 2010-07-21 04:50 ——– d—–w- c:\program files\iPod
2010-07-21 04:50 . 2010-07-21 04:51 ——– d—–w- c:\program files\iTunes
2010-07-14 03:26 . 2010-06-14 14:31 744448 -c—-w- c:\windows\system32\dllcache\helpsvc.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-05 12:12 . 2010-05-10 19:44 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Skype
2010-08-05 12:11 . 2009-01-05 20:17 256 —-a-w- c:\windows\system32\pool.bin
2010-08-05 12:11 . 2008-09-25 21:23 1890 –sha-w- c:\windows\system32\KGyGaAvL.sys
2010-08-05 12:10 . 2010-02-03 13:01 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Dropbox
2010-08-05 09:10 . 2010-05-10 19:47 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\skypePM
2010-07-31 02:43 . 2010-07-31 02:43 452104 —-a-w- c:\documents and settings\Mike Petrushka\Application Data\Real\Update\setup3.12\setup.exe
2010-07-31 00:53 . 2007-11-24 04:49 14592 —-a-w- c:\windows\system32\drivers\kbdhid.sys
2010-07-29 16:14 . 2007-11-24 16:34 ——– d—–w- c:\program files\Google
2010-07-29 16:09 . 2007-11-24 04:53 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2010-07-29 15:27 . 2010-07-29 15:27 388096 —-a-r- c:\documents and settings\Mike Petrushka\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-07-29 12:41 . 2009-10-13 14:02 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-07-27 04:24 . 2010-07-29 08:25 176702 —-a-w- c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
2010-07-24 17:16 . 2010-07-24 17:13 ——– d—–w- c:\program files\Common Files\EPSON
2010-07-24 17:14 . 2010-07-24 17:14 ——– d—–w- c:\program files\EpsonNet
2010-07-24 17:14 . 2007-11-24 04:09 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-07-21 04:50 . 2010-01-16 22:05 ——– d—–w- c:\program files\Common Files\Apple
2010-07-21 04:45 . 2010-07-21 04:45 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.4\SetupAdmin.exe
2010-07-20 21:43 . 2009-06-29 17:36 2381 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2007\qbbackup.sys
2010-07-12 08:56 . 2010-07-29 12:09 2979280 -c–a-w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}\Ad-AwareInstall.exe
2010-07-08 01:44 . 2010-06-21 12:51 20 —h–w- c:\documents and settings\All Users\Application Data\PKP_DLdw.DAT
2010-07-07 05:31 . 2010-06-21 12:47 20 —h–w- c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT
2010-07-01 23:01 . 2010-05-04 16:34 439816 —-a-w- c:\documents and settings\Mike Petrushka\Application Data\Real\Update\setup3.10\setup.exe
2010-06-29 20:35 . 2010-01-16 22:09 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Apple Computer
2010-06-26 21:31 . 2010-06-26 21:31 ——– d—–w- c:\program files\3ivx
2010-06-26 21:31 . 2010-06-26 21:31 ——– d—–w- c:\program files\Flip Video
2010-06-26 21:31 . 2010-06-26 21:31 ——– d—–w- c:\documents and settings\All Users\Application Data\Flip Video
2010-06-23 21:11 . 2010-06-23 21:11 501936 —-a-w- c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb1D.tmp.exe
2010-06-21 13:05 . 2010-06-21 13:01 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Nikon
2010-06-21 13:05 . 2010-06-21 12:50 ——– d—–w- c:\program files\Common Files\Nikon
2010-06-21 13:00 . 2010-06-21 12:46 ——– d—–w- c:\documents and settings\All Users\Application Data\ArcSoft
2010-06-21 12:54 . 2010-06-21 12:54 49152 —-a-r- c:\documents and settings\Mike Petrushka\Application Data\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe
2010-06-21 12:53 . 2010-06-21 12:53 335872 —-a-r- c:\documents and settings\Mike Petrushka\Application Data\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe
2010-06-21 12:53 . 2010-06-21 12:53 57344 —-a-r- c:\documents and settings\Mike Petrushka\Application Data\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
2010-06-21 12:52 . 2010-06-21 12:50 ——– d—–w- c:\program files\Nikon
2010-06-21 12:51 . 2010-06-21 12:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Ultima_T15
2010-06-21 12:51 . 2010-06-21 12:47 ——– d—–w- c:\documents and settings\All Users\Application Data\EnterNHelp
2010-06-21 12:50 . 2010-06-21 12:50 ——– d—–w- c:\program files\Common Files\muvee Technologies
2010-06-21 12:50 . 2010-06-21 12:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Nikon
2010-06-21 12:47 . 2003-03-19 01:05 106496 —-a-w- c:\windows\system32\ATL71.DLL
2010-06-21 12:46 . 2010-03-27 10:25 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\ArcSoft
2010-06-21 12:45 . 2010-06-21 12:45 ——– d—–w- c:\program files\Common Files\ArcSoft
2010-06-21 12:45 . 2010-06-21 12:45 ——– d—–w- c:\program files\ArcSoft
2010-06-19 18:49 . 2010-06-19 18:49 ——– d—–w- c:\program files\Bonjour
2010-06-19 18:46 . 2010-06-19 18:46 ——– d—–w- c:\program files\Safari
2010-06-19 18:44 . 2010-06-19 18:44 71992 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe
2010-06-17 17:22 . 2010-06-17 17:22 27984 —-a-w- c:\windows\system32\sbbd.exe
2010-06-14 18:47 . 2010-06-14 18:47 ——– d—–w- c:\documents and settings\All Users\Application Data\FileCure
2010-06-14 18:47 . 2010-06-14 18:47 ——– d—–w- c:\program files\Common Files\ParetoLogic
2010-06-14 18:47 . 2010-06-14 18:47 ——– d—–w- c:\documents and settings\All Users\Application Data\ParetoLogic
2010-06-14 18:47 . 2010-06-14 18:47 ——– d—–w- c:\program files\ParetoLogic
2010-06-14 14:31 . 2007-11-24 02:57 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-09 12:26 . 2009-01-05 17:41 ——– d—–w- c:\program files\palmOne
2010-06-09 11:40 . 2007-11-24 04:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-05-18 21:35 . 2010-05-18 21:35 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-05-18 21:35 . 2010-05-18 21:35 107808 —-a-w- c:\windows\system32\dns-sd.exe
2010-05-10 19:47 . 2010-05-10 19:47 56 —ha-w- c:\windows\system32\ezsidmv.dat
2008-12-19 14:36 . 2008-12-19 14:36 27976 —-a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2008-12-19 14:36 . 2008-12-19 14:36 126360 —-a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2008-12-19 14:37 . 2008-12-19 14:37 46408 —-a-w- c:\program files\mozilla firefox\plugins\atmccli.dll
2008-12-19 14:37 . 2008-12-19 14:37 98712 —-a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
2008-09-25 21:23 . 2008-09-25 21:23 56 –sh–r- c:\windows\system32\4753598D8E.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Mike Petrushka\Application Data\Dropbox\bin\DropboxExt.13.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Mike Petrushka\Application Data\Dropbox\bin\DropboxExt.13.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Mike Petrushka\Application Data\Dropbox\bin\DropboxExt.13.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOvrly1]
@="{A4EEBF66-92EB-4F2A-9F1E-2F6D14B30DA6}"
[HKEY_CLASSES_ROOT\CLSID\{A4EEBF66-92EB-4F2A-9F1E-2F6D14B30DA6}]
2007-04-20 18:40 118784 —-a-w- c:\program files\TrueSuite Access Manager\IconOvrly.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2007-01-09 191552]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-05-13 26192168]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-10-15 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-10-15 137752]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-05-22 413696]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-10-08 995328]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-10-08 1101824]
"FingerPrintNotifer"="c:\program files\TrueSuite Access Manager\FpNotifier.exe" [2007-09-26 671744]
"UsbMonitor"="c:\program files\TrueSuite Access Manager\usbnotify.exe" [2007-06-05 94208]
"PwdBank"="c:\program files\TrueSuite Access Manager\PwdBank.exe" [2007-11-09 3152896]
"TabletWizard"="c:\windows\help\SplshWrp.exe" [2008-04-14 16384]
"TabletTip"="c:\program files\Common Files\microsoft shared\ink\tabtip.exe" [2008-04-14 271872]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2004-03-24 196608]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
"CrossMenu"="c:\program files\TOSHIBA\CrossMenu\CrossMenu.exe" [2007-10-12 806912]
"00THotkey"="c:\windows\system32\00THotkey.exe" [2007-08-23 258048]
"000StTHK"="000StTHK.exe" [2001-06-23 24576]
"NDSTray.exe"="NDSTray.exe" [BU]
"TAcelMgr"="c:\program files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe" [2004-12-16 90112]
"TSkrMain"="c:\program files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe" [2004-07-01 49152]
"TFncKy"="TFncKy.exe" [BU]
"DDWMon"="c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2007-04-14 311296]
"TFNF5"="TFNF5.exe" [2006-04-11 622592]
"TAudEffect"="c:\program files\TOSHIBA\TAudEffect\TAudEff.exe" [2006-08-10 344144]
"TMERzCtl.EXE"="c:\program files\TOSHIBA\TME3\TMERzCtl.EXE" [2006-04-27 90112]
"TMESRV.EXE"="c:\program files\TOSHIBA\TME3\TMESRV31.EXE" [2005-12-14 126976]
"TOSDCR"="TOSDCR.EXE" [2005-12-13 57344]
"TPSODDCtl"="TPSODDCtl.exe" [2007-11-01 126976]
"TPSMain"="TPSMain.exe" [2007-10-16 315392]
"TRot.exe"="c:\program files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe" [2006-07-21 327680]
"TouchED"="c:\program files\TOSHIBA\TouchED\TouchED.exe" [2005-06-29 126976]
"TosHKCW.exe"="c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2005-05-17 49152]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2007-04-10 159744]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2007-01-26 136816]
"Act! Preloader"="c:\program files\ACT\ACT for Windows\Act8.exe" [2006-04-06 1015808]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-08-16 236016]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-12 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SmartSoft PDF Printer (demo) Agent"="c:\program files\Smart PDF Creator\sspdfagentd.exe" [2007-10-22 94208]
"SmartSoft PDF Printer (demo) virtual printer agent"="c:\program files\Smart PDF Creator\sspdfagentd.exe" [2007-10-22 94208]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]
"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2009-09-15 479232]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-16 141608]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"SBAMTray"="c:\program files\Sunbelt Software\VIPRE\SBAMTray.exe" [2010-06-17 1295696]
c:\documents and settings\Mike Petrushka\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\Mike Petrushka\Application Data\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2007-11-12 1447184]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2009-9-16 972064]
VPN Client.lnk - c:\windows\Installer\{14FCFE7C-AB86-428A-9D2E-BFB6F5A7AA6E}\Icon3E5562ED7.ico [2008-10-31 6144]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ATFUS]
2007-11-02 19:42 176128 —-a-w- c:\windows\system32\FpWinlogonNp.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
2008-04-14 00:11 47104 —-a-w- c:\program files\Common Files\Microsoft Shared\Ink\loginkey.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
2002-08-29 11:41 11776 —-a-w- c:\windows\system32\tabbtnwl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TosBtNP]
2006-07-22 03:54 65536 —-a-w- c:\windows\system32\TosBtNP.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
2008-04-14 00:12 32256 —-a-w- c:\windows\system32\tpgwlnot.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TSigNP]
2007-11-14 05:17 65536 —-a-w- c:\windows\system32\TSigNP.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"c:\\Program Files\\ACT\\ACT for Windows\\Act8.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Mike Petrushka\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9844:TCP"= 9844:TCP:adielhla
R0 AlfaFF;AlfaFF mini-filter driver;c:\windows\system32\drivers\AlfaFF.sys [4/15/2008 2:51 PM 43184]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/29/2010 7:41 AM 64288]
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [4/27/2007 1:19 PM 21120]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [3/9/2007 6:23 PM 6528]
R1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [7/27/2010 3:59 PM 13400]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [10/13/2009 9:02 AM 95024]
R1 SbTis;SbTis;c:\windows\system32\drivers\sbtis.sys [7/27/2010 3:47 PM 204632]
R1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [11/23/2007 11:34 PM 5888]
R2 Authentec memory manager;Authentec memory manager service;c:\windows\system32\TAMSvr.exe [4/15/2008 2:51 PM 49152]
R2 FingerprintServer;Fingerprint Server;c:\windows\system32\FpLogonServ.exe [4/15/2008 2:51 PM 106496]
R2 MSSQL$ACT7;MSSQL$ACT7;c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlservr.exe -sACT7 –> c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlservr.exe -sACT7 [?]
R2 SBAMSvc;VIPRE Antivirus;c:\program files\Sunbelt Software\VIPRE\SBAMSvc.exe [6/17/2010 12:23 PM 2730120]
R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [7/27/2010 3:59 PM 69720]
R2 SBPIMSvc;SB Recovery Service;c:\program files\Sunbelt Software\VIPRE\SBPIMSvc.exe [6/17/2010 12:21 PM 181584]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [3/26/2007 3:22 PM 105856]
R2 Tmesrv;Tmesrv3;c:\program files\Toshiba\TME3\TMESRV31.exe [11/23/2007 11:34 PM 126976]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [2/19/2007 3:15 PM 134016]
R2 TTPDSrv;TOSHIBA Touch Pad Service;c:\windows\system32\TTPDSRV.exe [11/23/2007 11:09 PM 73728]
R2 UNS;Intel® Active Management Technology User Notification Service;c:\program files\Intel\AMT\UNS.exe [4/15/2008 2:43 PM 1464856]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [11/24/2007 1:11 PM 36608]
R3 TBtnKey;TOSHIBA Tablet PC Buttons Type N HID Driver;c:\windows\system32\drivers\TBtnKey.sys [11/23/2007 11:45 PM 8832]
R3 TEchoCan;Toshiba Audio Effect;c:\windows\system32\drivers\TEchoCan.sys [11/23/2007 11:33 PM 435072]
R3 WacomPen;Wacom Serial Pen HID Driver;c:\windows\system32\drivers\wacompen.sys [4/15/2008 2:41 PM 14208]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/5/2010 4:47 PM 135664]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/12/2010 3:55 AM 1352832]
S3 SQLAgent$ACT7;SQLAgent$ACT7;c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlagent.EXE -i ACT7 –> c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlagent.EXE -i ACT7 [?]
.
Contents of the 'Scheduled Tasks' folder
2010-08-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-12 08:55]
2010-07-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
2010-08-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 21:46]
2010-08-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 21:46]
2010-07-29 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-08-04 18:19]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://m.www.yahoo.com/?r472=1254844908
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://127.0.0.1:4664/first_usage&s=SzOIxg3ov9WUdTc6L7kdQmCJ750
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
FF - ProfilePath - c:\documents and settings\Mike Petrushka\Application Data\Mozilla\Firefox\Profiles\8jdyznpw.default\
FF - prefs.js: browser.startup.homepage - hxxp://dsl.sbc.yahoo.com/
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-05 07:08
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(1408)
c:\windows\system32\FpWinLogonNp.dll
c:\program files\TrueSuite Access Manager\FpSuites.dll
c:\program files\TrueSuite Access Manager\SharedResources.dll
c:\program files\TrueSuite Access Manager\FPResource.dll
c:\windows\system32\TSigNP.dll
c:\windows\system32\netprovcredman.dll
- - - - - - - > 'explorer.exe'(5300)
c:\windows\system32\WININET.dll
c:\documents and settings\Mike Petrushka\Application Data\Dropbox\bin\DropboxExt.13.dll
c:\program files\TrueSuite Access Manager\IconOvrly.dll
c:\windows\system32\ieframe.dll
c:\program files\windows journal\nbmaptip.dll
c:\windows\IME\SPGRMR.DLL
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\TPwrCfg.DLL
c:\windows\system32\TPwrReg.dll
c:\windows\system32\TPSTrace.DLL
.
———————— Other Running Processes ————————
.
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Intel\AMT\atchksrv.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Flip Video\FlipShare\FlipShareService.exe
c:\program files\Intel\AMT\LMS.exe
c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlservr.exe
c:\program files\Sprint\Pantech\Sprint Mobile Broadband (Pantech)\PWIUtilityService.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\toshiba\IVP\swupdate\swupdtmr.exe
c:\windows\system32\ThpSrv.exe
c:\windows\system32\TODDSrv.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\windows\system32\wscntfy.exe
c:\windows\System32\tabbtnu.exe
c:\program files\Common Files\Microsoft Shared\Ink\TCServer.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\RTHDCPL.EXE
c:\program files\TrueSuite Access Manager\CssSvr.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\program files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
c:\windows\system32\thpsrv.exe
c:\windows\system32\TFNF5.exe
c:\windows\system32\TPSODDCtl.exe
c:\program files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
c:\program files\TOSHIBA\TME3\TMETEMNU.EXE
c:\windows\system32\igfxext.exe
c:\program files\Apoint2K\Apntex.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
c:\windows\system32\TPSBattM.exe
c:\program files\Skype\Phone\Skype.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
c:\program files\iPod\bin\iPodService.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2010-08-05 07:14:53 - machine was rebooted
ComboFix-quarantined-files.txt 2010-08-05 12:14
ComboFix2.txt 2010-07-31 01:07
Pre-Run: 101,077,659,648 bytes free
Post-Run: 100,961,001,472 bytes free
- - End Of File - - 844C822FEEC7148C7C94F83DE5D87F23
here is are the results of the Combofix from last instructions
ComboFix 10-08-04.05 - Mike Petrushka 08/05/2010 6:57.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2007.908 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Mike Petrushka\Desktop\CFScript.txt
AV: Sunbelt VIPRE *On-access scanning disabled* (Outdated) {964FCE60-0B18-4D30-ADD6-EB178909041C}
* Created a new restore point
FILE ::
"c:\windows\System32\gxzooqir.dll"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
——-\Legacy_AZDLB
——-\Service_azdlb
((((((((((((((((((((((((( Files Created from 2010-07-05 to 2010-08-05 )))))))))))))))))))))))))))))))
.
2010-07-30 17:43 . 2010-07-30 17:43 ——– d—–w- C:\_OTL
2010-07-29 16:09 . 2010-07-29 16:15 ——– d—–w- c:\program files\McAfee Security Scan
2010-07-29 15:27 . 2010-07-29 15:27 ——– d—–w- c:\program files\Trend Micro
2010-07-29 15:02 . 2010-07-12 08:55 15880 —-a-w- c:\windows\system32\lsdelete.exe
2010-07-29 12:41 . 2010-07-12 08:55 64288 —-a-w- c:\windows\system32\drivers\Lbd.sys
2010-07-29 12:16 . 2010-07-29 12:16 ——– d—–w- c:\documents and settings\Mike Petrushka\Local Settings\Application Data\Sunbelt Software
2010-07-29 12:09 . 2010-07-29 12:09 ——– dc-h–w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}
2010-07-29 12:09 . 2010-07-29 12:41 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-07-29 12:09 . 2010-07-29 12:09 ——– d—–w- c:\program files\Lavasoft
2010-07-29 08:25 . 2010-07-29 08:32 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-07-29 03:48 . 2010-07-29 03:48 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Malwarebytes
2010-07-29 03:48 . 2010-04-29 20:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-07-29 03:48 . 2010-07-29 03:48 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-07-29 03:48 . 2010-07-29 03:48 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-29 03:48 . 2010-04-29 20:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-07-28 20:59 . 2010-07-28 22:40 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-07-28 20:59 . 2010-07-28 21:02 ——– d—–w- c:\program files\Spybot - Search & Destroy
2010-07-27 20:59 . 2010-01-04 11:29 69720 —-a-w- c:\windows\system32\drivers\sbapifs.sys
2010-07-27 20:59 . 2010-01-04 11:29 13400 —-a-w- c:\windows\system32\drivers\sbaphd.sys
2010-07-27 20:51 . 2010-07-27 20:51 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Sunbelt
2010-07-27 20:49 . 2010-07-27 20:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Sunbelt
2010-07-27 20:47 . 2010-05-26 18:57 204632 —-a-w- c:\windows\system32\drivers\sbtis.sys
2010-07-27 20:47 . 2010-07-27 20:47 ——– d—–w- c:\program files\Sunbelt Software
2010-07-27 19:22 . 2010-07-27 19:22 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-07-27 04:14 . 2010-07-27 04:14 277784 —-a-w- c:\windows\system32\drivers\niexerpl.sys
2010-07-27 02:33 . 2010-07-27 02:33 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Epson
2010-07-26 16:23 . 2010-07-30 21:23 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-07-24 17:13 . 2006-10-31 05:10 51360 —-a-w- c:\windows\system32\EpPicPrt.dll
2010-07-24 17:12 . 2010-07-24 17:16 ——– d—–w- c:\documents and settings\All Users\Application Data\EPSON
2010-07-24 17:12 . 2010-07-24 17:12 ——– d—–w- c:\program files\Epson Software
2010-07-24 17:11 . 2009-09-17 05:00 342016 —-a-w- c:\windows\system32\eswiaud.dll
2010-07-24 17:11 . 2009-05-01 05:00 15872 —-a-w- c:\windows\system32\escdev.dll
2010-07-24 17:11 . 2009-05-01 05:00 128392 —-a-w- c:\windows\system32\esdevapp.exe
2010-07-24 17:11 . 2010-07-24 17:12 ——– d—–w- c:\program files\epson
2010-07-21 04:50 . 2010-07-21 04:50 ——– d—–w- c:\program files\iPod
2010-07-21 04:50 . 2010-07-21 04:51 ——– d—–w- c:\program files\iTunes
2010-07-14 03:26 . 2010-06-14 14:31 744448 -c—-w- c:\windows\system32\dllcache\helpsvc.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-05 12:12 . 2010-05-10 19:44 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Skype
2010-08-05 12:11 . 2009-01-05 20:17 256 —-a-w- c:\windows\system32\pool.bin
2010-08-05 12:11 . 2008-09-25 21:23 1890 –sha-w- c:\windows\system32\KGyGaAvL.sys
2010-08-05 12:10 . 2010-02-03 13:01 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Dropbox
2010-08-05 09:10 . 2010-05-10 19:47 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\skypePM
2010-07-31 02:43 . 2010-07-31 02:43 452104 —-a-w- c:\documents and settings\Mike Petrushka\Application Data\Real\Update\setup3.12\setup.exe
2010-07-31 00:53 . 2007-11-24 04:49 14592 —-a-w- c:\windows\system32\drivers\kbdhid.sys
2010-07-29 16:14 . 2007-11-24 16:34 ——– d—–w- c:\program files\Google
2010-07-29 16:09 . 2007-11-24 04:53 ——– d—–w- c:\documents and settings\All Users\Application Data\McAfee
2010-07-29 15:27 . 2010-07-29 15:27 388096 —-a-r- c:\documents and settings\Mike Petrushka\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-07-29 12:41 . 2009-10-13 14:02 95024 —-a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-07-27 04:24 . 2010-07-29 08:25 176702 —-a-w- c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
2010-07-24 17:16 . 2010-07-24 17:13 ——– d—–w- c:\program files\Common Files\EPSON
2010-07-24 17:14 . 2010-07-24 17:14 ——– d—–w- c:\program files\EpsonNet
2010-07-24 17:14 . 2007-11-24 04:09 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-07-21 04:50 . 2010-01-16 22:05 ——– d—–w- c:\program files\Common Files\Apple
2010-07-21 04:45 . 2010-07-21 04:45 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.4\SetupAdmin.exe
2010-07-20 21:43 . 2009-06-29 17:36 2381 —-a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2007\qbbackup.sys
2010-07-12 08:56 . 2010-07-29 12:09 2979280 -c–a-w- c:\documents and settings\All Users\Application Data\{BD986C1B-72EC-4B82-B47B-6CAC4E6F494E}\Ad-AwareInstall.exe
2010-07-08 01:44 . 2010-06-21 12:51 20 —h–w- c:\documents and settings\All Users\Application Data\PKP_DLdw.DAT
2010-07-07 05:31 . 2010-06-21 12:47 20 —h–w- c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT
2010-07-01 23:01 . 2010-05-04 16:34 439816 —-a-w- c:\documents and settings\Mike Petrushka\Application Data\Real\Update\setup3.10\setup.exe
2010-06-29 20:35 . 2010-01-16 22:09 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Apple Computer
2010-06-26 21:31 . 2010-06-26 21:31 ——– d—–w- c:\program files\3ivx
2010-06-26 21:31 . 2010-06-26 21:31 ——– d—–w- c:\program files\Flip Video
2010-06-26 21:31 . 2010-06-26 21:31 ——– d—–w- c:\documents and settings\All Users\Application Data\Flip Video
2010-06-23 21:11 . 2010-06-23 21:11 501936 —-a-w- c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb1D.tmp.exe
2010-06-21 13:05 . 2010-06-21 13:01 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\Nikon
2010-06-21 13:05 . 2010-06-21 12:50 ——– d—–w- c:\program files\Common Files\Nikon
2010-06-21 13:00 . 2010-06-21 12:46 ——– d—–w- c:\documents and settings\All Users\Application Data\ArcSoft
2010-06-21 12:54 . 2010-06-21 12:54 49152 —-a-r- c:\documents and settings\Mike Petrushka\Application Data\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe
2010-06-21 12:53 . 2010-06-21 12:53 335872 —-a-r- c:\documents and settings\Mike Petrushka\Application Data\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe
2010-06-21 12:53 . 2010-06-21 12:53 57344 —-a-r- c:\documents and settings\Mike Petrushka\Application Data\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
2010-06-21 12:52 . 2010-06-21 12:50 ——– d—–w- c:\program files\Nikon
2010-06-21 12:51 . 2010-06-21 12:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Ultima_T15
2010-06-21 12:51 . 2010-06-21 12:47 ——– d—–w- c:\documents and settings\All Users\Application Data\EnterNHelp
2010-06-21 12:50 . 2010-06-21 12:50 ——– d—–w- c:\program files\Common Files\muvee Technologies
2010-06-21 12:50 . 2010-06-21 12:50 ——– d—–w- c:\documents and settings\All Users\Application Data\Nikon
2010-06-21 12:47 . 2003-03-19 01:05 106496 —-a-w- c:\windows\system32\ATL71.DLL
2010-06-21 12:46 . 2010-03-27 10:25 ——– d—–w- c:\documents and settings\Mike Petrushka\Application Data\ArcSoft
2010-06-21 12:45 . 2010-06-21 12:45 ——– d—–w- c:\program files\Common Files\ArcSoft
2010-06-21 12:45 . 2010-06-21 12:45 ——– d—–w- c:\program files\ArcSoft
2010-06-19 18:49 . 2010-06-19 18:49 ——– d—–w- c:\program files\Bonjour
2010-06-19 18:46 . 2010-06-19 18:46 ——– d—–w- c:\program files\Safari
2010-06-19 18:44 . 2010-06-19 18:44 71992 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.33.16.0\SetupAdmin.exe
2010-06-17 17:22 . 2010-06-17 17:22 27984 —-a-w- c:\windows\system32\sbbd.exe
2010-06-14 18:47 . 2010-06-14 18:47 ——– d—–w- c:\documents and settings\All Users\Application Data\FileCure
2010-06-14 18:47 . 2010-06-14 18:47 ——– d—–w- c:\program files\Common Files\ParetoLogic
2010-06-14 18:47 . 2010-06-14 18:47 ——– d—–w- c:\documents and settings\All Users\Application Data\ParetoLogic
2010-06-14 18:47 . 2010-06-14 18:47 ——– d—–w- c:\program files\ParetoLogic
2010-06-14 14:31 . 2007-11-24 02:57 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-09 12:26 . 2009-01-05 17:41 ——– d—–w- c:\program files\palmOne
2010-06-09 11:40 . 2007-11-24 04:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-05-18 21:35 . 2010-05-18 21:35 91424 —-a-w- c:\windows\system32\dnssd.dll
2010-05-18 21:35 . 2010-05-18 21:35 107808 —-a-w- c:\windows\system32\dns-sd.exe
2010-05-10 19:47 . 2010-05-10 19:47 56 —ha-w- c:\windows\system32\ezsidmv.dat
2008-12-19 14:36 . 2008-12-19 14:36 27976 —-a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll
2008-12-19 14:36 . 2008-12-19 14:36 126360 —-a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll
2008-12-19 14:37 . 2008-12-19 14:37 46408 —-a-w- c:\program files\mozilla firefox\plugins\atmccli.dll
2008-12-19 14:37 . 2008-12-19 14:37 98712 —-a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll
2008-09-25 21:23 . 2008-09-25 21:23 56 –sh–r- c:\windows\system32\4753598D8E.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Mike Petrushka\Application Data\Dropbox\bin\DropboxExt.13.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Mike Petrushka\Application Data\Dropbox\bin\DropboxExt.13.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 —-a-w- c:\documents and settings\Mike Petrushka\Application Data\Dropbox\bin\DropboxExt.13.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOvrly1]
@="{A4EEBF66-92EB-4F2A-9F1E-2F6D14B30DA6}"
[HKEY_CLASSES_ROOT\CLSID\{A4EEBF66-92EB-4F2A-9F1E-2F6D14B30DA6}]
2007-04-20 18:40 118784 —-a-w- c:\program files\TrueSuite Access Manager\IconOvrly.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2007-01-09 191552]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-05-13 26192168]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThpSrv"="c:\windows\system32\thpsrv" [X]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-10-15 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-10-15 137752]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2007-05-22 413696]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-10-08 995328]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-10-08 1101824]
"FingerPrintNotifer"="c:\program files\TrueSuite Access Manager\FpNotifier.exe" [2007-09-26 671744]
"UsbMonitor"="c:\program files\TrueSuite Access Manager\usbnotify.exe" [2007-06-05 94208]
"PwdBank"="c:\program files\TrueSuite Access Manager\PwdBank.exe" [2007-11-09 3152896]
"TabletWizard"="c:\windows\help\SplshWrp.exe" [2008-04-14 16384]
"TabletTip"="c:\program files\Common Files\microsoft shared\ink\tabtip.exe" [2008-04-14 271872]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2004-03-24 196608]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
"CrossMenu"="c:\program files\TOSHIBA\CrossMenu\CrossMenu.exe" [2007-10-12 806912]
"00THotkey"="c:\windows\system32\00THotkey.exe" [2007-08-23 258048]
"000StTHK"="000StTHK.exe" [2001-06-23 24576]
"NDSTray.exe"="NDSTray.exe" [BU]
"TAcelMgr"="c:\program files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe" [2004-12-16 90112]
"TSkrMain"="c:\program files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe" [2004-07-01 49152]
"TFncKy"="TFncKy.exe" [BU]
"DDWMon"="c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2007-04-14 311296]
"TFNF5"="TFNF5.exe" [2006-04-11 622592]
"TAudEffect"="c:\program files\TOSHIBA\TAudEffect\TAudEff.exe" [2006-08-10 344144]
"TMERzCtl.EXE"="c:\program files\TOSHIBA\TME3\TMERzCtl.EXE" [2006-04-27 90112]
"TMESRV.EXE"="c:\program files\TOSHIBA\TME3\TMESRV31.EXE" [2005-12-14 126976]
"TOSDCR"="TOSDCR.EXE" [2005-12-13 57344]
"TPSODDCtl"="TPSODDCtl.exe" [2007-11-01 126976]
"TPSMain"="TPSMain.exe" [2007-10-16 315392]
"TRot.exe"="c:\program files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe" [2006-07-21 327680]
"TouchED"="c:\program files\TOSHIBA\TouchED\TouchED.exe" [2005-06-29 126976]
"TosHKCW.exe"="c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2005-05-17 49152]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2007-04-10 159744]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2007-01-26 136816]
"Act! Preloader"="c:\program files\ACT\ACT for Windows\Act8.exe" [2006-04-06 1015808]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-08-16 236016]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-12 198160]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SmartSoft PDF Printer (demo) Agent"="c:\program files\Smart PDF Creator\sspdfagentd.exe" [2007-10-22 94208]
"SmartSoft PDF Printer (demo) virtual printer agent"="c:\program files\Smart PDF Creator\sspdfagentd.exe" [2007-10-22 94208]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]
"Nikon Transfer Monitor"="c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe" [2009-09-15 479232]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-16 141608]
"EEventManager"="c:\program files\Epson Software\Event Manager\EEventManager.exe" [2009-12-03 976320]
"SBAMTray"="c:\program files\Sunbelt Software\VIPRE\SBAMTray.exe" [2010-06-17 1295696]
c:\documents and settings\Mike Petrushka\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\Mike Petrushka\Application Data\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2007-11-12 1447184]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2009-9-16 972064]
VPN Client.lnk - c:\windows\Installer\{14FCFE7C-AB86-428A-9D2E-BFB6F5A7AA6E}\Icon3E5562ED7.ico [2008-10-31 6144]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ATFUS]
2007-11-02 19:42 176128 —-a-w- c:\windows\system32\FpWinlogonNp.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
2008-04-14 00:11 47104 —-a-w- c:\program files\Common Files\Microsoft Shared\Ink\loginkey.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
2002-08-29 11:41 11776 —-a-w- c:\windows\system32\tabbtnwl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TosBtNP]
2006-07-22 03:54 65536 —-a-w- c:\windows\system32\TosBtNP.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
2008-04-14 00:12 32256 —-a-w- c:\windows\system32\tpgwlnot.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TSigNP]
2007-11-14 05:17 65536 —-a-w- c:\windows\system32\TSigNP.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"c:\\Program Files\\ACT\\ACT for Windows\\Act8.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\Mike Petrushka\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Epson Software\\Event Manager\\EEventManager.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9844:TCP"= 9844:TCP:adielhla
R0 AlfaFF;AlfaFF mini-filter driver;c:\windows\system32\drivers\AlfaFF.sys [4/15/2008 2:51 PM 43184]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [7/29/2010 7:41 AM 64288]
R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\drivers\thpdrv.sys [4/27/2007 1:19 PM 21120]
R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\drivers\Thpevm.sys [3/9/2007 6:23 PM 6528]
R1 sbaphd;sbaphd;c:\windows\system32\drivers\sbaphd.sys [7/27/2010 3:59 PM 13400]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [10/13/2009 9:02 AM 95024]
R1 SbTis;SbTis;c:\windows\system32\drivers\sbtis.sys [7/27/2010 3:47 PM 204632]
R1 TMEI3E;TMEI3E;c:\windows\system32\drivers\TMEI3E.sys [11/23/2007 11:34 PM 5888]
R2 Authentec memory manager;Authentec memory manager service;c:\windows\system32\TAMSvr.exe [4/15/2008 2:51 PM 49152]
R2 FingerprintServer;Fingerprint Server;c:\windows\system32\FpLogonServ.exe [4/15/2008 2:51 PM 106496]
R2 MSSQL$ACT7;MSSQL$ACT7;c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlservr.exe -sACT7 –> c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlservr.exe -sACT7 [?]
R2 SBAMSvc;VIPRE Antivirus;c:\program files\Sunbelt Software\VIPRE\SBAMSvc.exe [6/17/2010 12:23 PM 2730120]
R2 sbapifs;sbapifs;c:\windows\system32\drivers\sbapifs.sys [7/27/2010 3:59 PM 69720]
R2 SBPIMSvc;SB Recovery Service;c:\program files\Sunbelt Software\VIPRE\SBPIMSvc.exe [6/17/2010 12:21 PM 181584]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [3/26/2007 3:22 PM 105856]
R2 Tmesrv;Tmesrv3;c:\program files\Toshiba\TME3\TMESRV31.exe [11/23/2007 11:34 PM 126976]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [2/19/2007 3:15 PM 134016]
R2 TTPDSrv;TOSHIBA Touch Pad Service;c:\windows\system32\TTPDSRV.exe [11/23/2007 11:09 PM 73728]
R2 UNS;Intel® Active Management Technology User Notification Service;c:\program files\Intel\AMT\UNS.exe [4/15/2008 2:43 PM 1464856]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [11/24/2007 1:11 PM 36608]
R3 TBtnKey;TOSHIBA Tablet PC Buttons Type N HID Driver;c:\windows\system32\drivers\TBtnKey.sys [11/23/2007 11:45 PM 8832]
R3 TEchoCan;Toshiba Audio Effect;c:\windows\system32\drivers\TEchoCan.sys [11/23/2007 11:33 PM 435072]
R3 WacomPen;Wacom Serial Pen HID Driver;c:\windows\system32\drivers\wacompen.sys [4/15/2008 2:41 PM 14208]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/5/2010 4:47 PM 135664]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/12/2010 3:55 AM 1352832]
S3 SQLAgent$ACT7;SQLAgent$ACT7;c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlagent.EXE -i ACT7 –> c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlagent.EXE -i ACT7 [?]
.
Contents of the 'Scheduled Tasks' folder
2010-08-05 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2010-07-12 08:55]
2010-07-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
2010-08-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 21:46]
2010-08-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-05 21:46]
2010-07-29 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2009-08-04 18:19]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://m.www.yahoo.com/?r472=1254844908
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://127.0.0.1:4664/first_usage&s=SzOIxg3ov9WUdTc6L7kdQmCJ750
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
FF - ProfilePath - c:\documents and settings\Mike Petrushka\Application Data\Mozilla\Firefox\Profiles\8jdyznpw.default\
FF - prefs.js: browser.startup.homepage - hxxp://dsl.sbc.yahoo.com/
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-05 07:08
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(1408)
c:\windows\system32\FpWinLogonNp.dll
c:\program files\TrueSuite Access Manager\FpSuites.dll
c:\program files\TrueSuite Access Manager\SharedResources.dll
c:\program files\TrueSuite Access Manager\FPResource.dll
c:\windows\system32\TSigNP.dll
c:\windows\system32\netprovcredman.dll
- - - - - - - > 'explorer.exe'(5300)
c:\windows\system32\WININET.dll
c:\documents and settings\Mike Petrushka\Application Data\Dropbox\bin\DropboxExt.13.dll
c:\program files\TrueSuite Access Manager\IconOvrly.dll
c:\windows\system32\ieframe.dll
c:\program files\windows journal\nbmaptip.dll
c:\windows\IME\SPGRMR.DLL
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\TPwrCfg.DLL
c:\windows\system32\TPwrReg.dll
c:\windows\system32\TPSTrace.DLL
.
———————— Other Running Processes ————————
.
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
c:\program files\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Intel\AMT\atchksrv.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Flip Video\FlipShare\FlipShareService.exe
c:\program files\Intel\AMT\LMS.exe
c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlservr.exe
c:\program files\Sprint\Pantech\Sprint Mobile Broadband (Pantech)\PWIUtilityService.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\toshiba\IVP\swupdate\swupdtmr.exe
c:\windows\system32\ThpSrv.exe
c:\windows\system32\TODDSrv.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\windows\system32\wscntfy.exe
c:\windows\System32\tabbtnu.exe
c:\program files\Common Files\Microsoft Shared\Ink\TCServer.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\RTHDCPL.EXE
c:\program files\TrueSuite Access Manager\CssSvr.exe
c:\program files\TOSHIBA\ConfigFree\NDSTray.exe
c:\program files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
c:\windows\system32\thpsrv.exe
c:\windows\system32\TFNF5.exe
c:\windows\system32\TPSODDCtl.exe
c:\program files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
c:\program files\TOSHIBA\TME3\TMETEMNU.EXE
c:\windows\system32\igfxext.exe
c:\program files\Apoint2K\Apntex.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
c:\windows\system32\TPSBattM.exe
c:\program files\Skype\Phone\Skype.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
c:\program files\iPod\bin\iPodService.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2010-08-05 07:14:53 - machine was rebooted
ComboFix-quarantined-files.txt 2010-08-05 12:14
ComboFix2.txt 2010-07-31 01:07
Pre-Run: 101,077,659,648 bytes free
Post-Run: 100,961,001,472 bytes free
- - End Of File - - 844C822FEEC7148C7C94F83DE5D87F23
Mike2200DP
hammerman
here is the VIruscan report results
VirSCAN.org Scanned Report :
Scanned time : 2010/08/05 08:23:52 (EDT)
Scanner results: Scanners did not find malware!
File Name : niexerpl.sys
File Size : 277784 byte
File Type : PE32 executable for MS Windows (native) Intel 80386 32-bit
MD5 : fd7f9d74c2b35dbda400804a3f5ed5d8
SHA1 : 39feded925d83da3ca6e1bc29415d141864e53ff
Online report : http://virscan.org/report/9dec44bb4a9fc6ac…d59aaf28fa.html
Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.0.0.13 20100804070612 2010-08-04 0.19 -
AhnLab V3 2010.07.14.00 2010.07.14 2010-07-14 0.14 -
AntiVir 8.2.4.32 7.10.10.76 2010-08-05 0.31 -
Antiy 2.0.18 20100731.4890273 2010-07-31 0.04 -
Arcavir 2009 201006281601 2010-06-28 0.01 -
Authentium 5.1.1 201008050228 2010-08-05 2.81 -
AVAST! 4.7.4 100805-0 2010-08-05 0.06 -
AVG 8.5.793 271.1.1/3052 2010-08-05 3.40 -
BitDefender 7.90123.6201409 7.33199 2010-08-05 6.04 -
ClamAV 0.96.1 11501 2010-08-05 0.08 -
Comodo 4.0 5637 2010-08-03 0.19 -
CP Secure 1.3.0.5 2010.08.05 2010-08-05 0.08 -
Dr.Web 5.0.2.3300 2010.08.05 2010-08-05 12.28 -
F-Prot 4.4.4.56 20100804 2010-08-04 3.34 -
F-Secure 7.02.73807 2010.08.05.05 2010-08-05 0.55 -
Fortinet 4.1.143 12.209 2010-08-03 0.19 -
GData 21.621/21.233 20100803 2010-08-03 0.15 -
ViRobot 20100803 2010.08.03 2010-08-03 0.19 -
Ikarus T3. … – 10.84 -
JiangMin 13.0.900 2010.08.03 2010-08-03 0.12 -
Kaspersky 5.5.10 2010.08.05 2010-08-05 0.17 -
KingSoft 2009.2.5.15 2010.8.3.18 2010-08-03 0.19 -
McAfee 5400.1158 6064 2010-08-04 22.44 -
Microsoft 1.6004 2010.08.04 2010-08-04 0.19 -
Norman 6.05.11 6.05.00 2010-08-04 12.87 -
Panda 9.05.01 2010.08.01 2010-08-01 0.09 -
Trend Micro 9.120-1004 7.364.05 2010-08-05 0.03 -
Quick Heal 11.00 2010.08.02 2010-08-02 0.08 -
Rising 20.0 22.59.01.04 2010-08-03 0.14 -
Sophos 3.10.0 4.56 2010-08-05 5.54 -
Sunbelt 3.9.2432.2 6679 2010-08-03 0.17 -
Symantec 1.3.0.24 20100804.002 2010-08-04 0.25 -
nProtect 20100803.01 8830284 2010-08-03 0.16 -
The Hacker 6.5.2.1 v00330 2010-08-03 0.09 -
VBA32 3.12.12.8 20100805.0819 2010-08-05 4.99 -
VirusBuster 4.5.11.10 10.127.42/2042444 2010-08-05 2.81 -
here is the VIruscan report results
VirSCAN.org Scanned Report :
Scanned time : 2010/08/05 08:23:52 (EDT)
Scanner results: Scanners did not find malware!
File Name : niexerpl.sys
File Size : 277784 byte
File Type : PE32 executable for MS Windows (native) Intel 80386 32-bit
MD5 : fd7f9d74c2b35dbda400804a3f5ed5d8
SHA1 : 39feded925d83da3ca6e1bc29415d141864e53ff
Online report : http://virscan.org/report/9dec44bb4a9fc6ac…d59aaf28fa.html
Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 5.0.0.13 20100804070612 2010-08-04 0.19 -
AhnLab V3 2010.07.14.00 2010.07.14 2010-07-14 0.14 -
AntiVir 8.2.4.32 7.10.10.76 2010-08-05 0.31 -
Antiy 2.0.18 20100731.4890273 2010-07-31 0.04 -
Arcavir 2009 201006281601 2010-06-28 0.01 -
Authentium 5.1.1 201008050228 2010-08-05 2.81 -
AVAST! 4.7.4 100805-0 2010-08-05 0.06 -
AVG 8.5.793 271.1.1/3052 2010-08-05 3.40 -
BitDefender 7.90123.6201409 7.33199 2010-08-05 6.04 -
ClamAV 0.96.1 11501 2010-08-05 0.08 -
Comodo 4.0 5637 2010-08-03 0.19 -
CP Secure 1.3.0.5 2010.08.05 2010-08-05 0.08 -
Dr.Web 5.0.2.3300 2010.08.05 2010-08-05 12.28 -
F-Prot 4.4.4.56 20100804 2010-08-04 3.34 -
F-Secure 7.02.73807 2010.08.05.05 2010-08-05 0.55 -
Fortinet 4.1.143 12.209 2010-08-03 0.19 -
GData 21.621/21.233 20100803 2010-08-03 0.15 -
ViRobot 20100803 2010.08.03 2010-08-03 0.19 -
Ikarus T3. … – 10.84 -
JiangMin 13.0.900 2010.08.03 2010-08-03 0.12 -
Kaspersky 5.5.10 2010.08.05 2010-08-05 0.17 -
KingSoft 2009.2.5.15 2010.8.3.18 2010-08-03 0.19 -
McAfee 5400.1158 6064 2010-08-04 22.44 -
Microsoft 1.6004 2010.08.04 2010-08-04 0.19 -
Norman 6.05.11 6.05.00 2010-08-04 12.87 -
Panda 9.05.01 2010.08.01 2010-08-01 0.09 -
Trend Micro 9.120-1004 7.364.05 2010-08-05 0.03 -
Quick Heal 11.00 2010.08.02 2010-08-02 0.08 -
Rising 20.0 22.59.01.04 2010-08-03 0.14 -
Sophos 3.10.0 4.56 2010-08-05 5.54 -
Sunbelt 3.9.2432.2 6679 2010-08-03 0.17 -
Symantec 1.3.0.24 20100804.002 2010-08-04 0.25 -
nProtect 20100803.01 8830284 2010-08-03 0.16 -
The Hacker 6.5.2.1 v00330 2010-08-03 0.09 -
VBA32 3.12.12.8 20100805.0819 2010-08-05 4.99 -
VirusBuster 4.5.11.10 10.127.42/2042444 2010-08-05 2.81 -
Mike2200DP
hammerman
re: how the pc is running, I haven't been on a lot but the random browser redirects seem to be gone. Generally better I would say. thanks, Mike
hammerman
Hi,
Please follow these steps.
– Step 1 –
Download TFC to your desktop
– Step 2 –
Run Malwarebytes' Anti-Malware.
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
– Step 3 –
– Step 4 –
Please do an online scan with Kaspersky WebScanner
Click on Accept
You may be promted to install an ActiveX component from Kaspersky, Click Yes.
Please follow these steps.
– Step 1 –
Download TFC to your desktop
- Open the file and close any other windows.
- It will close all programs itself when run, make sure to let it run uninterrupted.
- Click the Start button to begin the process. The program should not take long to finish its job
- Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean
– Step 2 –
Run Malwarebytes' Anti-Malware.
- Select the Update tab and then click Check for Updates. If an update is found, it will download and install the latest version.
- Select the Scanner tab, select "Perform Quick Scan", then click Scan
- The scan may take some time to finish, so please be patient.
- When the scan is complete, click OK, then Show Results to view the results.
- Make sure that everything is checked, and click Remove Selected.
- When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
- The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
- Copy&Paste the entire report in your next reply.
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
– Step 3 –
- Download the latest version of Java Runtime Environment (JRE) 6 Update 21.
- Click the "Download JRE" button to the right.
- Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
- Click on Continue.
- Click on the link to download Windows Offline Installation (jre-6u21-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
- Close any programs you may have running - especially your web browser.
- Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
- Check any item with Java Runtime Environment (JRE or J2SE) in the name.
- Click the Remove or Change/Remove button.
- Repeat as many times as necessary to remove each Java version.
- Reboot your computer once all Java components are removed.
- Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u21-windows-i586.exe and select "Run as an Administrator.")
– Step 4 –
Please do an online scan with Kaspersky WebScanner
Click on Accept
You may be promted to install an ActiveX component from Kaspersky, Click Yes.
- The program will launch and then begin downloading the latest definition files:
- Once the files have been downloaded click on Settings
- In the scan settings, select the following:
- Scan using the following Anti-Virus database:
- Scan Options:
Scan Archives
Scan E-mail databases - Click Save
- Now under ScanSelect My Computer
- This will start the scanning of your system.
- The scan will take a while so be patient and let it run.
- Once the scan is complete it will display if your system has been infected.
- Now click on View Report and then Save Report
- Save the file to your desktop as a text file.
- Copy and paste that information in your next post.
Mike2200DP
Hammerman - thanks for the update, I was driving over the last few days and couldn't get to it. I will process Monday afternoon.
Mike
hammerman
K. Thank's for letting me know
Mike2200DP
Hammerman
Ran TFC - no issues
Here is log for MBAM - it found nothing that needed fixed
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Database version: 4418
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
8/11/2010 7:32:51 AM
mbam-log-2010-08-11 (07-32-51).txt
Scan type: Quick scan
Objects scanned: 159413
Time elapsed: 7 minute(s), 42 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
Mike2200DP
Hammerman
in the add/remove programs part of your last instructions about Java, I can't find any that specifically reference JRE or JRE2 in the headings.
There is only one that references Java in the list - it is labeled Jave ™ 6 Update 3. Is that one to get rid of? Or if I don't have any with JRE or JRE2 then do I go ahead and run the JRE 6 Update 21 executable that I downloaded?
Just wanted to clarify
thanks
Mike
hammerman
Hi,
Remove Java 6 Update 3 and then install JRE 6 Update 21.
Mike2200DP
Hammerman
OK I deleted Java 6 update 3 and installed JRE 6 update 21.
I then tried to run Kaspersky.
I get an error message saying
"Launch of the Java application is interrupted - please establish an uninterrupted internet connection for work with this program"
I click ok and Kaspersky looks like its just hung there waiting for something.
The update status says "program download and update status: 0%
I had shut down Vipre antivirus and the windows firewall prior to this attempt.
So no Kaspersky as yet - ideas?
Mike
hammerman
Hi,
Let's try a different scanner.
Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan
Let's try a different scanner.
Please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan
- Tick the box next to YES, I accept the Terms of Use
- Click Start
- When asked, allow the ActiveX control to install
- Click Start
- Make sure that the options Remove found threats and the option Scan unwanted applications is checked
- Click Scan (This scan can take several hours, so please be patient)
- Once the scan is completed, you may close the window
- Use Notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt
- Copy and paste that log as a reply to this topic
Mike2200DP
Hammerman
ok, I ran the ESET scanner - it found no problems and there was no log file to post.
PC is running fine, browser isn't being hijacked, but there are occasions where something won't run on a site or I get a big delay launching a link.
thanks
Mike
hammerman
Hi,
Are you getting these issues with Firefox and/or Internet Explorer?
Run OTL
Are you getting these issues with Firefox and/or Internet Explorer?
Run OTL
- When the window appears, underneath Output at the top change it to Minimal Output.
- Under the Custom Scans/Fixes box paste this in the following.
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
- Under Extra Registry select Use Safelist
- Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI