What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

dds.scr opens in notepad

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello. I am trying to generate log files to create a post to determine whether I have a pc with the nukesploit bug. Problem is that System Mechanic has associated files with extension '.scr' to open with notepad and I'm having a heck of a time with getting dds.scr to run. Currently, .scr is associated as follows: assoc .scr = scrfile In order to generate the desired log file: 1) to what program do I associate dds.scr? 2) once this association is set, will the application run when 'double clicked'? Thanks very much, in advance. robearz
Post #2
fyi: I searched this website several times and the search consistently returned 'no results'. I am using firefox - it is possible that 'no script' blocked the search. I'll try to determine if that is the case tomorrow.
Post #3
apparently 'no script' was interfering with search. Once 'whatthetec.com' was added to the whitelist and i searched for dds*scr, some results appeared. further, the software that set .scr to open with notepad is iolo system mechanic, latest version as I have a subscription. Thanks
Post #4
Hi

Please do the following:



Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.



NEXT


Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under the Custom Scan box paste this in


    netsvcs
    drivers32 /all
    %SYSTEMDRIVE%\*.*
    %systemroot%\system32\*.wt
    %systemroot%\system32\*.ruy
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles
    %systemroot%\System32\config\*.sav
    %systemroot%\system32\user32.dll /md5
    %systemroot%\system32\ws2_32.dll /md5
    %systemroot%\system32\ws2help.dll /md5
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in your next reply.





NEXT


Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #5 last edited
The OTL scan did not generate 'Extras.Txt' The first time I ran GMER Rootkit Scanner, it caused my system to crash. Upon reboot, the system was unstable (non-responsive) so I shut it down and saw a bsod for a very brief time. Upon restart, I ran GMER Rootkit Scanner a second time, system crashed second time too. Hence, no GMER log. Log files following are: MBRCheck and OTL as labeled each in a separate post. edit: running gmer third time, seems to be going to completion. did not complete - system rebooted before I could save gmer.txt
Post #6
MBRCheck_08.19.10_23.28.56.txt MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Professional Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x0000000c Kernel Drivers (total 145): 0x804D7000 \WINDOWS\system32\ntkrnlpa.exe 0x806E4000 \WINDOWS\system32\hal.dll 0xBA5A8000 \WINDOWS\system32\KDCOM.DLL 0xBA4B8000 \WINDOWS\system32\BOOTVID.dll 0xB9F79000 ACPI.sys 0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xB9F68000 pci.sys 0xBA0A8000 isapnp.sys 0xBA0B8000 ohci1394.sys 0xBA0C8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS 0xBA4BC000 compbatt.sys 0xBA4C0000 \WINDOWS\system32\DRIVERS\BATTC.SYS 0xBA670000 pciide.sys 0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS 0xB9F4A000 pcmcia.sys 0xBA0D8000 MountMgr.sys 0xB9F2B000 ftdisk.sys 0xBA5AC000 dmload.sys 0xB9F05000 dmio.sys 0xBA4C4000 ACPIEC.sys 0xBA671000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS 0xBA330000 PartMgr.sys 0xBA0E8000 VolSnap.sys 0xB9EED000 atapi.sys 0xBA0F8000 disk.sys 0xBA108000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xB9ECD000 fltmgr.sys 0xBA118000 PxHelp20.sys 0xB9EB6000 KSecDD.sys 0xB9E29000 Ntfs.sys 0xB9DFC000 NDIS.sys 0xB9DDF000 SysPlant.sys 0xB9DC5000 Mup.sys 0xBA55C000 \SystemRoot\system32\DRIVERS\tunmp.sys 0xBA1D8000 \SystemRoot\system32\DRIVERS\intelppm.sys 0xB99F9000 \SystemRoot\system32\DRIVERS\nv4_mini.sys 0xB99E5000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xB9995000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0xB997A000 \SystemRoot\system32\DRIVERS\Rtenicxp.sys 0xBA398000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0xB9956000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xBA3A0000 \SystemRoot\system32\DRIVERS\usbehci.sys 0xB9942000 \SystemRoot\system32\DRIVERS\sdbus.sys 0xBA1E8000 \SystemRoot\system32\DRIVERS\nic1394.sys 0xBA1F8000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0xBA3A8000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xBA3B0000 \??\C:\WINDOWS\system32\drivers\VMkbd.sys 0xBA3B8000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xBA570000 \SystemRoot\system32\DRIVERS\CmBatt.sys 0xBA208000 \SystemRoot\system32\DRIVERS\imapi.sys 0xBA3C0000 \SystemRoot\system32\drivers\Afc.sys 0xBA218000 \SystemRoot\system32\DRIVERS\cdrom.sys 0xBA228000 \SystemRoot\system32\DRIVERS\redbook.sys 0xB991F000 \SystemRoot\system32\DRIVERS\ks.sys 0xBA3C8000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys 0xBA78D000 \SystemRoot\system32\DRIVERS\audstub.sys 0xBA238000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xBA578000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xB9908000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xBA248000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xBA258000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xBA3D0000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xB98F7000 \SystemRoot\system32\DRIVERS\psched.sys 0xBA268000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xBA3D8000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xBA3E0000 \SystemRoot\system32\DRIVERS\raspti.sys 0xB98C7000 \SystemRoot\system32\DRIVERS\rdpdr.sys 0xBA278000 \SystemRoot\system32\DRIVERS\termdd.sys 0xB97F1000 \SystemRoot\system32\DRIVERS\teefer2.sys 0xBA5BC000 \SystemRoot\system32\DRIVERS\swenum.sys 0xB976B000 \SystemRoot\system32\DRIVERS\update.sys 0xBA59C000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xBA5A0000 \SystemRoot\system32\DRIVERS\vmnetadapter.sys 0xBA5A4000 \SystemRoot\system32\DRIVERS\VMNET.SYS 0xBA288000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xB72CD000 \SystemRoot\system32\drivers\RtkHDAud.sys 0xB72A9000 \SystemRoot\system32\drivers\portcls.sys 0xBA2C8000 \SystemRoot\system32\drivers\drmk.sys 0xBA178000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xBA5C2000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xB6610000 \SystemRoot\System32\Drivers\SRTSP.SYS 0xB654F000 \SystemRoot\System32\Drivers\BisonCam.sys 0xBA1B8000 \SystemRoot\System32\Drivers\STREAM.SYS 0xB64DE000 \SystemRoot\system32\DRIVERS\rt73.sys 0xB636D000 \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS 0xB9837000 \SystemRoot\System32\Drivers\SRTSPX.SYS 0xBA5D2000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xBA791000 \SystemRoot\System32\Drivers\Null.SYS 0xBA5DA000 \SystemRoot\System32\Drivers\Beep.SYS 0xBA418000 \SystemRoot\System32\drivers\vga.sys 0xBA5DC000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xBA5DE000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xBA428000 \SystemRoot\System32\Drivers\Msfs.SYS 0xBA430000 \SystemRoot\System32\Drivers\Npfs.SYS 0xB72A5000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xB6326000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xB62CD000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xB6277000 \SystemRoot\System32\Drivers\SYMTDI.SYS 0xB6251000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xBA188000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xBA318000 \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys 0xBA1A8000 \SystemRoot\system32\DRIVERS\arp1394.sys 0xB6229000 \SystemRoot\system32\DRIVERS\netbt.sys 0xB61F1000 \SystemRoot\system32\DRIVERS\tcpip6.sys 0xB6C3D000 \SystemRoot\System32\drivers\ws2ifsl.sys 0xB9897000 \SystemRoot\system32\drivers\ip6fw.sys 0xB612F000 \SystemRoot\System32\drivers\afd.sys 0xB9867000 \SystemRoot\system32\DRIVERS\netbios.sys 0xB60C6000 \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys 0xB609B000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xB602B000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xBA2F8000 \SystemRoot\System32\Drivers\Fips.SYS 0xB5FCD000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 0xB5FB0000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 0xBA2E8000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xB5F70000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xBA5FE000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xB97E1000 \SystemRoot\System32\drivers\Dxapi.sys 0xBA460000 \SystemRoot\System32\watchdog.sys 0xBF000000 \SystemRoot\System32\drivers\dxg.sys 0xBA7FA000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF012000 \SystemRoot\System32\nv4_disp.dll 0xBA3F0000 \SystemRoot\system32\DRIVERS\vmnetbridge.sys 0xB51D7000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xBFFA0000 \SystemRoot\System32\ATMFD.DLL 0xB44E3000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0xB50D7000 \??\C:\WINDOWS\system32\drivers\hcmon.sys 0xB46D7000 \??\C:\WINDOWS\system32\Drivers\vmci.sys 0xB434C000 \??\C:\WINDOWS\system32\Drivers\vmx86.sys 0xBA368000 \SystemRoot\system32\drivers\npf.sys 0xBA7A2000 \??\C:\WINDOWS\system32\Drivers\mchInjDrv.sys 0xB413D000 \SystemRoot\system32\DRIVERS\srv.sys 0xB37EF000 \SystemRoot\system32\drivers\wdmaud.sys 0xB421C000 \SystemRoot\system32\drivers\sysaudio.sys 0xB3732000 \??\C:\Program Files\Sandboxie\SbieDrv.sys 0xBA408000 \??\C:\WINDOWS\system32\drivers\vmnetuserif.sys 0xB3712000 \??\C:\Program Files\VMware\VMware Workstation\vstor2-ws60.sys 0xBA340000 \SystemRoot\System32\Drivers\SYMREDRV.SYS 0xB2245000 \SystemRoot\System32\Drivers\HTTP.sys 0xB1616000 \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20100819.019\NAVEX15.SYS 0xB1602000 \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20100819.019\NAVENG.SYS 0xB155F000 \SystemRoot\system32\drivers\kmixer.sys 0xB1519000 \SystemRoot\System32\Drivers\Fastfat.SYS 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 50): 0 System Idle Process 4 System 444 C:\WINDOWS\system32\smss.exe 1672 C:\WINDOWS\system32\csrss.exe 920 C:\WINDOWS\system32\winlogon.exe 1156 C:\WINDOWS\system32\services.exe 1168 C:\WINDOWS\system32\lsass.exe 1324 C:\WINDOWS\system32\svchost.exe 1516 C:\WINDOWS\system32\svchost.exe 1932 C:\WINDOWS\system32\svchost.exe 732 C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe 1300 C:\WINDOWS\system32\svchost.exe 1824 C:\WINDOWS\system32\svchost.exe 1416 C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe 1492 C:\WINDOWS\system32\spoolsv.exe 1116 C:\WINDOWS\system32\svchost.exe 192 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 1568 C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe 1664 C:\Program Files\Bonjour\mDNSResponder.exe 1956 C:\WINDOWS\system32\svchost.exe 1988 C:\Program Files\GNU\GnuPG\dirmngr.exe 1960 C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe 804 C:\Program Files\iolo\System Mechanic\IoloSGCtrl.exe 660 C:\WINDOWS\system32\nvsvc32.exe 992 C:\Program Files\TestOut\Orbis\OrbisClient.Services.exe 1120 C:\WINDOWS\explorer.exe 1864 C:\Program Files\Sandboxie\SbieSvc.exe 3332 C:\Program Files\Common Files\SupportSoft\bin\sprtlisten.exe 3588 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe 3692 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe 1968 C:\WINDOWS\system32\svchost.exe 1688 C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe 2964 C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe 3420 C:\WINDOWS\system32\vmnat.exe 3456 C:\WINDOWS\system32\vmnetdhcp.exe 2456 C:\Program Files\Common Files\Symantec Shared\ccApp.exe 2544 C:\WINDOWS\system32\rundll32.exe 2684 C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe 2804 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe 3084 C:\Program Files\VMware\VMware Workstation\vmware-tray.exe 4000 C:\WINDOWS\RTHDCPL.exe 1048 C:\Program Files\iTunes\iTunesHelper.exe 2332 C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe 2340 C:\WINDOWS\system32\ctfmon.exe 2916 C:\Documents and Settings\All Users\Application Data\U3\U3Launcher\LaunchU3.exe 2132 C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe 2496 C:\Program Files\iPod\bin\iPodService.exe 2192 C:\WINDOWS\system32\alg.exe 2164 C:\WINDOWS\system32\wscntfy.exe 5712 C:\Documents and Settings\Robearz\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) PhysicalDrive0 Model Number: HTS721010G9SA00, Rev: MCZOC10V Size Device Name MBR Status ——————————————– 93 GB \\.\PhysicalDrive0 Windows XP MBR code detected SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A Done!
Post #7
OLT.txt

OTL logfile created on: 8/19/2010 11:31:22 PM - Run 2
OTL by OldTimer - Version 3.2.10.0 Folder = C:\Documents and Settings\Robearz\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 71.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 93.15 Gb Total Space | 62.19 Gb Free Space | 66.76% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SISMOUR
Current User Name: Robearz
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Robearz\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\iolo\System Mechanic\IoloSGCtrl.exe ()
PRC - C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe ()
PRC - C:\Program Files\Sandboxie\SbieSvc.exe (tzuk)
PRC - C:\Program Files\TestOut\Orbis\OrbisClient.Services.exe ()
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\GNU\GnuPG\dirmngr.exe ()
PRC - C:\WINDOWS\system32\vmnat.exe (VMware, Inc.)
PRC - C:\Program Files\VMware\VMware Workstation\vmware-tray.exe (VMware, Inc.)
PRC - C:\WINDOWS\system32\vmnetdhcp.exe (VMware, Inc.)
PRC - C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe (VMware, Inc.)
PRC - c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)
PRC - C:\Program Files\Common Files\SupportSoft\bin\sprtlisten.exe (SupportSoft, Inc.)
PRC - C:\Documents and Settings\All Users\Application Data\U3\U3Launcher\LaunchU3.exe ()
PRC - C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Robearz\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\iolo\Common\Lib\sguard.dll ()
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
MOD - C:\WINDOWS\system32\sysfer.dll (Symantec Corporation)


========== Win32 Services (SafeList) ==========

SRV - (IOLO_SRV) – C:\Program Files\iolo\System Mechanic\IoloSGCtrl.exe ()
SRV - (ioloSystemService) – C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe ()
SRV - (ioloFileInfoList) – C:\Program Files\iolo\Common\Lib\ioloServiceManager.exe ()
SRV - (SbieSvc) – C:\Program Files\Sandboxie\SbieSvc.exe (tzuk)
SRV - (rpcapd) Remote Packet Capture Protocol v.0 (experimental) – C:\Program Files\WinPcap\rpcapd.exe (CACE Technologies, Inc.)
SRV - (OrbisClient.Services) – C:\Program Files\TestOut\Orbis\OrbisClient.Services.exe ()
SRV - (Apple Mobile Device) – C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (DirMngr) – C:\Program Files\GNU\GnuPG\dirmngr.exe ()
SRV - (VMware NAT Service) – C:\WINDOWS\system32\vmnat.exe (VMware, Inc.)
SRV - (VMnetDHCP) – C:\WINDOWS\system32\vmnetdhcp.exe (VMware, Inc.)
SRV - (VMAuthdService) – C:\Program Files\VMware\VMware Workstation\vmware-authd.exe (VMware, Inc.)
SRV - (VMUSBArbService) – C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe (VMware, Inc.)
SRV - (ufad-ws60) – C:\Program Files\VMware\VMware Workstation\vmware-ufad.exe (VMware, Inc.)
SRV - (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ) – c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLWriter) – c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (SQLBrowser) – c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (MSSQLServerADHelper) – c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)
SRV - (ACDaemon) – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (ArcSoft Inc.)
SRV - (SupportSoft RemoteAssist) – C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe (SupportSoft, Inc.)
SRV - (Symantec AntiVirus) – C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)
SRV - (SmcService) – C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation)
SRV - (SNAC) – C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE (Symantec Corporation)
SRV - (ccSetMgr) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccEvtMgr) – C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (BcmSqlStartupSvc) – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)
SRV - (sprtlisten) – C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe (SupportSoft, Inc.)
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE (Symantec Corporation)


========== Driver Services (SafeList) ==========

DRV - (MEMSWEEP2) – C:\WINDOWS\System32\8.tmp File not found
DRV - (NAVEX15) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100819.019\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100819.019\NAVENG.SYS (Symantec Corporation)
DRV - (SbieDrv) – C:\Program Files\Sandboxie\SbieDrv.sys (tzuk)
DRV - (NPF) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (WpsHelper) – C:\WINDOWS\system32\drivers\WpsHelper.sys (Symantec Corporation)
DRV - (PSI) – C:\WINDOWS\system32\drivers\psi_mf.sys (Secunia)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (PSSDK42) – C:\WINDOWS\system32\drivers\pssdk42.sys (microOLAP Technologies LTD)
DRV - (Tcpip6) – C:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (VMnetBridge) – C:\WINDOWS\system32\drivers\vmnetbridge.sys (VMware, Inc.)
DRV - (VMnetuserif) – C:\WINDOWS\system32\drivers\vmnetuserif.sys (VMware, Inc.)
DRV - (vmkbd) – C:\WINDOWS\system32\drivers\VMkbd.sys (VMware, Inc.)
DRV - (vmx86) – C:\WINDOWS\system32\drivers\vmx86.sys (VMware, Inc.)
DRV - (vmci) – C:\WINDOWS\system32\drivers\vmci.sys (VMware, Inc.)
DRV - (hcmon) – C:\WINDOWS\system32\drivers\hcmon.sys (VMware, Inc.)
DRV - (vmusb) – C:\WINDOWS\system32\drivers\vmusb.sys (VMware, Inc.)
DRV - (VMnetAdapter) – C:\WINDOWS\system32\drivers\vmnetadapter.sys (VMware, Inc.)
DRV - (vstor2-ws60) – C:\Program Files\VMware\VMware Workstation\vstor2-ws60.sys (VMware, Inc.)
DRV - (COH_Mon) – C:\WINDOWS\system32\drivers\COH_Mon.sys (Symantec Corporation)
DRV - (SymEvent) – C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (nm) – C:\WINDOWS\system32\drivers\nmnt.sys (Microsoft Corporation)
DRV - (HDAudBus) – C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)
DRV - (SysPlant) – C:\WINDOWS\SYSTEM32\Drivers\SysPlant.sys (Symantec Corporation)
DRV - (WPS) – C:\WINDOWS\system32\drivers\WPSDRVnt.sys (Symantec Corporation)
DRV - (SRTSPL) – C:\WINDOWS\system32\drivers\srtspl.sys (Symantec Corporation)
DRV - (SRTSP) – C:\WINDOWS\system32\drivers\srtsp.sys (Symantec Corporation)
DRV - (SRTSPX) – C:\WINDOWS\system32\drivers\srtspx.sys (Symantec Corporation)
DRV - (Teefer2) – C:\WINDOWS\system32\drivers\Teefer2.sys (Symantec Corporation)
DRV - (SPBBCDrv) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (RT73) – C:\WINDOWS\system32\drivers\rt73.sys (Ralink Technology, Corp.)
DRV - (SYMTDI) – C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMREDRV) – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (n558) – C:\WINDOWS\system32\drivers\n558.sys ()
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (netr73) – C:\WINDOWS\system32\drivers\netr73.sys (Ralink Technology Inc.)
DRV - (nv) – C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (Cam5603D) – C:\WINDOWS\system32\drivers\BisonCam.sys (Bison Electronics. Inc. )
DRV - (Afc) – C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.blinkpro.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = AE 17 09 A2 36 3B CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.blinkpro.com/|http://www.google.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: [removed]:1.0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/13 20:20:32 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/13 20:22:01 | 000,000,000 | —D | M]

[2010/08/02 14:03:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Robearz\Application Data\Mozilla\Extensions
[2010/08/13 15:32:15 | 000,000,000 | —D | M] – C:\Documents and Settings\Robearz\Application Data\Mozilla\Firefox\Profiles\3bosuaej.default\extensions
[2010/08/13 15:32:11 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Robearz\Application Data\Mozilla\Firefox\Profiles\3bosuaej.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/08/13 15:32:15 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2010/05/17 16:46:13 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/05/17 16:45:19 | 000,411,368 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009/08/03 16:07:42 | 000,373,104 | —- | M] (Microsoft Corporation) – C:\Program Files\Mozilla Firefox\plugins\npOGAPlugin.dll

O1 HOSTS File: ([2010/08/13 16:15:44 | 001,016,538 | R— | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts:
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.123topsearch.com
O1 - Hosts: 127.0.0.1 123topsearch.com
O1 - Hosts: 127.0.0.1 www.132.com
O1 - Hosts: 127.0.0.1 132.com
O1 - Hosts: 127.0.0.1 www.136136.net
O1 - Hosts: 127.0.0.1 136136.net
O1 - Hosts: 127.0.0.1 www.163ns.com
O1 - Hosts: 30652 more lines…
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (no name) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - No CLSID value found.
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKCU\..\Toolbar\WebBrowser: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [EEventManager] C:\Program Files\EPSON\Creativity Suite\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [ScreenPrint32] C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe (Provtech Limited)
O4 - HKLM..\Run: [SkyTel] C:\WINDOWS\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SystemGuardAlerter] C:\Program Files\iolo\System Mechanic\SystemGuardAlerter.exe ()
O4 - HKLM..\Run: [vmware-tray] C:\Program Files\VMware\VMware Workstation\vmware-tray.exe (VMware, Inc.)
O4 - HKCU..\Run: [EPSON Stylus Photo 1400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBUA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [SandboxieControl] C:\Program Files\Sandboxie\SbieCtrl.exe (tzuk)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\LaunchU3.exe.lnk = C:\WINDOWS\Installer\{D8E363A7-88B7-446D-B2C0-E26CE4DC8E54}\_294823.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PHOTOfunSTUDIO -viewer-.lnk.disabled ()
O4 - Startup: C:\Documents and Settings\Robearz\Start Menu\Programs\Startup\Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe (Secunia)
O4 - Startup: C:\Documents and Settings\Robearz\Start Menu\Programs\Startup\Windows Explorer.lnk = C:\WINDOWS\explorer.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: E&xport; to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files\VMware\VMware Workstation\vsocklib.dll (VMware, Inc.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5…heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} http://download.microsoft.com/download/7/4…helpcontrol.cab (Microsoft Genuine Advantage Self Support Tool)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/…lscbase6087.cab (Windows Live Safety Center Base Module)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd…b?1216773839349 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/07/22 16:16:41 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: aux - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midi - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: midimapper - C:\WINDOWS\System32\midimap.dll (Microsoft Corporation)
Drivers32: mixer - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.imaadpcm - C:\WINDOWS\System32\imaadp32.acm (Microsoft Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.msadpcm - C:\WINDOWS\System32\msadp32.acm (Microsoft Corporation)
Drivers32: msacm.msaudio1 - C:\WINDOWS\System32\msaud32.acm (Microsoft Corporation)
Drivers32: msacm.msg711 - C:\WINDOWS\System32\msg711.acm (Microsoft Corporation)
Drivers32: msacm.msg723 - C:\WINDOWS\System32\msg723.acm (Microsoft Corporation)
Drivers32: msacm.msgsm610 - C:\WINDOWS\System32\msgsm32.acm (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.I420 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.IYUV - C:\WINDOWS\System32\iyuv_32.dll (Microsoft Corporation)
Drivers32: vidc.M261 - C:\WINDOWS\System32\msh261.drv (Microsoft Corporation)
Drivers32: vidc.M263 - C:\WINDOWS\System32\msh263.drv (Microsoft Corporation)
Drivers32: vidc.mrle - C:\WINDOWS\System32\msrle32.dll (Microsoft Corporation)
Drivers32: vidc.msvc - C:\WINDOWS\System32\msvidc32.dll (Microsoft Corporation)
Drivers32: vidc.tscc - C:\WINDOWS\System32\TSCCVID.DLL (TechSmith Corporation)
Drivers32: VIDC.UYVY - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.VMnc - C:\WINDOWS\System32\vmnc.dll (VMware, Inc.)
Drivers32: VIDC.YUY2 - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVU9 - C:\WINDOWS\System32\tsbyuv.dll (Microsoft Corporation)
Drivers32: VIDC.YVYU - C:\WINDOWS\System32\msyuv.dll (Microsoft Corporation)
Drivers32: wave - C:\WINDOWS\System32\wdmaud.drv (Microsoft Corporation)
Drivers32: wavemapper - C:\WINDOWS\System32\msacm32.drv (Microsoft Corporation)

CREATERESTOREPOINT
Error starting restore point: System Restore is disabled.
Error closing restore point: System Restore is disabled.

========== Files/Folders - Created Within 90 Days ==========

[2010/08/17 19:03:08 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Robearz\Desktop\HiJackThis.exe
[2010/08/17 17:34:39 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Robearz\Desktop\OTL.exe
[2010/08/13 20:20:00 | 000,000,000 | —D | C] – C:\Program Files\QuickTime
[2010/08/13 20:07:40 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Local Settings\Application Data\Adobe
[2010/08/13 20:06:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Application Data\Wireshark
[2010/08/13 17:13:21 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Application Data\Malwarebytes
[2010/08/13 17:13:14 | 000,038,224 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010/08/13 17:13:14 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2010/08/13 17:13:12 | 000,020,952 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2010/08/13 17:13:12 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2010/08/13 15:28:10 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Robearz\IECompatCache
[2010/08/05 14:04:52 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Local Settings\Application Data\ABBYY
[2010/08/05 14:04:00 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Application Data\EPSON
[2010/08/05 13:45:41 | 000,000,000 | —D | C] – C:\EPSONREG
[2010/08/05 13:34:11 | 000,000,000 | —D | C] – C:\Program Files\ABBYY FineReader 6.0 Sprint
[2010/08/04 17:36:04 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2010/08/03 21:26:59 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Application Data\Helios
[2010/08/03 21:26:47 | 000,000,000 | —D | C] – C:\Program Files\TextPad 5
[2010/08/03 19:29:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Application Data\Leadertech
[2010/08/03 19:20:47 | 000,000,000 | —D | C] – C:\Program Files\EPSON Print CD
[2010/08/03 19:20:24 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\EPSON
[2010/08/03 19:19:20 | 000,000,000 | —D | C] – C:\Program Files\EPSON
[2010/08/03 19:18:24 | 000,000,000 | R–D | C] – C:\Documents and Settings\Robearz\My Documents\My Videos
[2010/08/02 14:04:53 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Local Settings\Application Data\Opera
[2010/08/02 14:04:53 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Application Data\Opera
[2010/08/02 14:04:02 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\My Documents\Downloads
[2010/08/02 14:02:55 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Local Settings\Application Data\Mozilla
[2010/08/02 14:02:55 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Application Data\Mozilla
[2010/08/02 13:42:31 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Application Data\InstallShield
[2010/08/02 13:23:31 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Qwest
[2010/08/02 13:23:15 | 000,000,000 | —D | C] – C:\WINDOWS\XSxS
[2010/08/02 13:23:15 | 000,000,000 | —D | C] – C:\Program Files\Xenocode
[2010/08/02 13:23:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Local Settings\Application Data\Xenocode
[2010/07/29 23:01:35 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Robearz\PrivacIE
[2010/07/29 22:14:07 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Application Data\Adobe
[2010/07/29 21:07:14 | 000,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2010/07/29 17:06:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Application Data\Apple Computer
[2010/07/29 17:06:14 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Local Settings\Application Data\Apple Computer
[2010/07/29 17:06:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Application Data\U3
[2010/07/29 17:06:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Application Data\iolo
[2010/07/29 17:05:46 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Application Data\Identities
[2010/07/29 17:05:42 | 000,000,000 | R–D | C] – C:\Documents and Settings\Robearz\My Documents\My Pictures
[2010/07/29 17:05:42 | 000,000,000 | R–D | C] – C:\Documents and Settings\Robearz\My Documents\My Music
[2010/07/29 17:05:42 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Robearz\IETldCache
[2010/07/29 17:05:41 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Local Settings\Application Data\Symantec
[2010/07/29 17:05:35 | 000,000,000 | –SD | C] – C:\Documents and Settings\Robearz\Application Data\Microsoft
[2010/07/29 17:05:35 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Robearz\SendTo
[2010/07/29 17:05:35 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Robearz\Recent
[2010/07/29 17:05:35 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Robearz\Application Data
[2010/07/29 17:05:35 | 000,000,000 | R–D | C] – C:\Documents and Settings\Robearz\My Documents
[2010/07/29 17:05:35 | 000,000,000 | R–D | C] – C:\Documents and Settings\Robearz\Favorites
[2010/07/29 17:05:35 | 000,000,000 | -HSD | C] – C:\Documents and Settings\Robearz\Cookies
[2010/07/29 17:05:35 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Robearz\PrintHood
[2010/07/29 17:05:35 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Robearz\NetHood
[2010/07/29 17:05:35 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Robearz\Local Settings
[2010/07/29 17:05:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Local Settings\Application Data\Microsoft Help
[2010/07/29 17:05:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Local Settings\Application Data\Microsoft
[2010/07/29 17:05:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Application Data\Macromedia
[2010/07/29 17:05:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Robearz\Desktop
[2010/07/29 17:05:34 | 000,000,000 | R–D | C] – C:\Documents and Settings\Robearz\Start Menu
[2010/07/29 17:05:34 | 000,000,000 | -H-D | C] – C:\Documents and Settings\Robearz\Templates
[2010/07/29 16:29:47 | 000,000,000 | —D | C] – C:\Program Files\iPod
[2010/07/29 16:14:24 | 000,000,000 | —D | C] – C:\Program Files\ConvertHelper
[2010/07/23 07:40:02 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Documents\zBob
[2010/07/17 21:54:51 | 000,160,272 | —- | C] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmcomm.sys
[2010/06/30 22:34:00 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2010/06/30 22:27:04 | 000,000,000 | —D | C] – C:\Program Files\Bonjour
[2010/06/25 10:07:24 | 000,281,104 | —- | C] (CACE Technologies, Inc.) – C:\WINDOWS\System32\wpcap.dll
[2010/06/25 10:07:18 | 000,100,880 | —- | C] (CACE Technologies, Inc.) – C:\WINDOWS\System32\Packet.dll
[2010/06/25 10:07:14 | 000,035,088 | —- | C] (CACE Technologies, Inc.) – C:\WINDOWS\System32\drivers\npf.sys
[2010/06/10 22:12:00 | 000,000,000 | R–D | C] – C:\Program Files\Skype
[2010/06/05 11:21:36 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Application Data\gnupg
[2010/06/05 11:21:36 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\GNU
[2010/06/05 11:21:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\GNU
[2010/06/05 11:21:19 | 000,000,000 | —D | C] – C:\Program Files\GNU
[2010/06/04 22:15:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\PKWARE
[2010/06/04 22:07:21 | 000,000,000 | —D | C] – C:\WINDOWS\Downloaded Installations
[2010/06/02 12:36:53 | 000,000,000 | —D | C] – C:\Program Files\Secunia
[2010/05/28 04:04:52 | 000,014,896 | —- | C] (Secunia) – C:\WINDOWS\System32\drivers\psi_mf.sys
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/08/19 23:16:51 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/08/19 23:16:16 | 000,002,539 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\LaunchU3.exe.lnk
[2010/08/19 23:15:57 | 000,051,048 | —- | M] () – C:\WINDOWS\System32\nvapps.xml
[2010/08/19 23:15:19 | 000,000,021 | —- | M] () – C:\WINDOWS\S.dirmngr
[2010/08/19 23:14:59 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/08/19 23:14:49 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/08/19 23:13:22 | 006,029,312 | -H– | M] () – C:\Documents and Settings\Robearz\NTUSER.DAT
[2010/08/19 23:13:22 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Robearz\ntuser.ini
[2010/08/19 21:00:00 | 000,000,344 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy - Scheduled Task.job
[2010/08/19 13:47:56 | 000,293,376 | —- | M] () – C:\Documents and Settings\Robearz\Desktop\6o9f7ysl.exe
[2010/08/19 13:47:04 | 000,080,384 | —- | M] () – C:\Documents and Settings\Robearz\Desktop\MBRCheck.exe
[2010/08/18 16:00:00 | 000,000,330 | —- | M] () – C:\WINDOWS\tasks\Spybot - Search & Destroy Updater - Scheduled Task.job
[2010/08/18 13:44:08 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/08/18 00:28:22 | 000,294,400 | —- | M] () – C:\Documents and Settings\Robearz\Desktop\exeHelper.com
[2010/08/18 00:00:49 | 000,359,929 | —- | M] () – C:\Documents and Settings\Robearz\Desktop\dds.scr
[2010/08/17 23:53:47 | 000,001,620 | —- | M] () – C:\Documents and Settings\Robearz\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/08/17 22:13:07 | 000,582,304 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/08/17 22:13:07 | 000,485,220 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/08/17 22:13:07 | 000,087,012 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/08/17 19:03:14 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Robearz\Desktop\HiJackThis.exe
[2010/08/17 17:56:13 | 000,000,923 | —- | M] () – C:\Documents and Settings\Robearz\Desktop\Shortcut to gmer.exe.lnk
[2010/08/17 17:55:10 | 000,004,844 | —- | M] () – C:\WINDOWS\Sandboxie.ini
[2010/08/17 17:34:45 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Robearz\Desktop\OTL.exe
[2010/08/13 20:20:23 | 000,001,604 | —- | M] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/08/13 20:14:22 | 000,000,592 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Opera.lnk
[2010/08/13 17:13:17 | 000,000,696 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/08/13 16:15:44 | 001,016,538 | R— | M] () – C:\WINDOWS\System32\drivers\etc\hosts
[2010/08/13 15:57:35 | 000,210,752 | —- | M] () – C:\Documents and Settings\Robearz\My Documents\System Guard 2009 removal using Malwarebytes.docx
[2010/08/12 09:36:42 | 000,270,192 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/07 15:20:28 | 000,000,073 | —- | M] () – C:\WINDOWS\System32\-1
[2010/08/07 15:19:49 | 000,001,479 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Wireshark.lnk
[2010/08/07 10:11:44 | 000,000,719 | —- | M] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2010/08/05 14:06:58 | 000,013,448 | —- | M] () – C:\WINDOWS\M2000Twn.src
[2010/08/05 13:45:40 | 000,000,044 | —- | M] () – C:\WINDOWS\PERFV500P.ini
[2010/08/05 13:35:01 | 000,000,815 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Perfection V500P User's Guide.lnk
[2010/08/05 13:30:31 | 000,000,665 | —- | M] () – C:\Documents and Settings\All Users\Desktop\EPSON Scan.lnk
[2010/08/05 10:47:27 | 000,000,386 | —- | M] () – C:\WINDOWS\System32\ioloBootDefrag.cfg
[2010/08/03 19:28:56 | 000,000,083 | —- | M] () – C:\WINDOWS\EPSP1400.ini
[2010/08/03 19:24:34 | 000,000,190 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Epson CreativeZone.url
[2010/08/03 19:18:06 | 000,000,782 | —- | M] () – C:\Documents and Settings\Robearz\Desktop\Windows Media Player.lnk
[2010/08/03 19:16:15 | 000,003,584 | —- | M] () – C:\Documents and Settings\Robearz\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/08/02 13:23:33 | 000,070,432 | —- | M] () – C:\Documents and Settings\Robearz\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2010/07/30 12:34:48 | 004,318,622 | -H– | M] () – C:\Documents and Settings\Robearz\Local Settings\Application Data\IconCache.db
[2010/07/29 17:25:12 | 000,002,341 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/07/29 17:06:00 | 000,000,815 | —- | M] () – C:\Documents and Settings\Robearz\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/07/29 17:05:59 | 000,000,079 | —- | M] () – C:\Documents and Settings\Robearz\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2010/07/29 15:28:26 | 000,001,602 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2010/07/21 21:56:49 | 000,002,315 | —- | M] () – C:\Documents and Settings\All Users\Desktop\LabSim.lnk
[2010/07/17 21:54:51 | 000,160,272 | —- | M] (Trend Micro Inc.) – C:\WINDOWS\System32\drivers\tmcomm.sys
[2010/07/06 15:16:12 | 000,094,384 | —- | M] (iolo technologies, LLC) – C:\WINDOWS\System32\IncContxMenu.dll
[2010/07/06 15:16:06 | 002,319,536 | —- | M] () – C:\WINDOWS\System32\Incinerator.dll
[2010/06/25 10:07:24 | 000,281,104 | —- | M] (CACE Technologies, Inc.) – C:\WINDOWS\System32\wpcap.dll
[2010/06/25 10:07:18 | 000,100,880 | —- | M] (CACE Technologies, Inc.) – C:\WINDOWS\System32\Packet.dll
[2010/06/25 10:07:14 | 000,035,088 | —- | M] (CACE Technologies, Inc.) – C:\WINDOWS\System32\drivers\npf.sys
[2010/06/25 10:03:12 | 000,053,299 | —- | M] () – C:\WINDOWS\System32\pthreadVC.dll
[2010/06/10 22:12:03 | 000,001,878 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/06/10 14:33:06 | 000,000,063 | —- | M] () – C:\WINDOWS\vbaddin.ini
[2010/06/02 19:59:06 | 000,161,920 | —- | M] (Symantec Corporation) – C:\WINDOWS\System32\drivers\WpsHelper.sys
[2010/06/02 12:37:17 | 000,000,720 | —- | M] () – C:\Documents and Settings\Robearz\Start Menu\Programs\Startup\Secunia PSI.lnk
[2010/05/28 04:04:52 | 000,014,896 | —- | M] (Secunia) – C:\WINDOWS\System32\drivers\psi_mf.sys
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/19 23:15:19 | 000,000,021 | —- | C] () – C:\WINDOWS\S.dirmngr
[2010/08/19 13:50:11 | 000,293,376 | —- | C] () – C:\Documents and Settings\Robearz\Desktop\6o9f7ysl.exe
[2010/08/19 13:50:11 | 000,080,384 | —- | C] () – C:\Documents and Settings\Robearz\Desktop\MBRCheck.exe
[2010/08/18 00:30:17 | 000,294,400 | —- | C] () – C:\Documents and Settings\Robearz\Desktop\exeHelper.com
[2010/08/17 23:59:48 | 000,359,929 | —- | C] () – C:\Documents and Settings\Robearz\Desktop\dds.scr
[2010/08/17 23:53:47 | 000,001,620 | —- | C] () – C:\Documents and Settings\Robearz\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2010/08/17 17:56:13 | 000,000,923 | —- | C] () – C:\Documents and Settings\Robearz\Desktop\Shortcut to gmer.exe.lnk
[2010/08/13 20:20:23 | 000,001,604 | —- | C] () – C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010/08/13 17:13:17 | 000,000,696 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/08/13 15:57:35 | 000,210,752 | —- | C] () – C:\Documents and Settings\Robearz\My Documents\System Guard 2009 removal using Malwarebytes.docx
[2010/08/07 15:19:49 | 000,001,479 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Wireshark.lnk
[2010/08/07 10:11:44 | 000,000,719 | —- | C] () – C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
[2010/08/05 13:35:01 | 000,000,815 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Perfection V500P User's Guide.lnk
[2010/08/05 13:30:31 | 000,000,665 | —- | C] () – C:\Documents and Settings\All Users\Desktop\EPSON Scan.lnk
[2010/08/05 13:30:28 | 000,065,793 | —- | C] () – C:\WINDOWS\System32\esfw7c.bin
[2010/08/05 13:29:31 | 000,000,044 | —- | C] () – C:\WINDOWS\PERFV500P.ini
[2010/08/04 17:47:34 | 000,000,766 | —- | C] () – C:\Documents and Settings\Robearz\Desktop\Sandboxed Web Browser.lnk
[2010/08/04 17:47:34 | 000,000,766 | —- | C] () – C:\Documents and Settings\Robearz\Application Data\Microsoft\Internet Explorer\Quick Launch\Sandboxed Web Browser.lnk
[2010/08/03 19:24:34 | 000,000,190 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Epson CreativeZone.url
[2010/08/03 19:18:50 | 000,000,083 | —- | C] () – C:\WINDOWS\EPSP1400.ini
[2010/08/03 19:18:06 | 000,000,782 | —- | C] () – C:\Documents and Settings\Robearz\Desktop\Windows Media Player.lnk
[2010/08/03 19:16:15 | 000,003,584 | —- | C] () – C:\Documents and Settings\Robearz\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/07/29 17:14:11 | 000,001,487 | —- | C] () – C:\Documents and Settings\Robearz\Start Menu\Programs\Startup\Windows Explorer.lnk
[2010/07/29 17:14:11 | 000,000,720 | —- | C] () – C:\Documents and Settings\Robearz\Start Menu\Programs\Startup\Secunia PSI.lnk
[2010/07/29 17:06:00 | 000,000,815 | —- | C] () – C:\Documents and Settings\Robearz\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2010/07/29 17:05:59 | 000,000,079 | —- | C] () – C:\Documents and Settings\Robearz\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2010/07/29 17:05:37 | 000,000,178 | -HS- | C] () – C:\Documents and Settings\Robearz\ntuser.ini
[2010/07/29 17:05:34 | 006,029,312 | -H– | C] () – C:\Documents and Settings\Robearz\NTUSER.DAT
[2010/07/29 17:05:34 | 000,409,600 | -H– | C] () – C:\Documents and Settings\Robearz\NTUSER.DAT.LOG
[2010/07/29 16:30:42 | 000,002,341 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010/06/28 18:21:12 | 000,845,688 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/06/25 10:03:12 | 000,053,299 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2010/06/10 22:12:03 | 000,001,878 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2010/03/01 22:49:42 | 000,004,844 | —- | C] () – C:\WINDOWS\Sandboxie.ini
[2009/12/11 11:28:38 | 002,319,536 | —- | C] () – C:\WINDOWS\System32\Incinerator.dll
[2009/08/03 16:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/01/06 07:59:53 | 000,106,496 | R— | C] () – C:\WINDOWS\System32\vshp1020.dll
[2008/12/25 12:29:51 | 000,000,097 | —- | C] () – C:\WINDOWS\System32\PICSDK.ini
[2008/09/02 18:03:57 | 000,019,256 | —- | C] () – C:\WINDOWS\MSUMLT_S.ini
[2008/08/22 06:01:02 | 000,000,035 | —- | C] () – C:\WINDOWS\A4W.INI
[2008/08/03 21:34:42 | 000,000,162 | —- | C] () – C:\WINDOWS\ODBC.INI
[2008/08/03 19:29:44 | 000,028,672 | —- | C] () – C:\WINDOWS\System32\JAWTAccessBridge.dll
[2008/08/02 07:41:54 | 000,074,703 | —- | C] () – C:\WINDOWS\System32\mfc45.dll
[2008/07/22 17:19:11 | 000,015,190 | —- | C] () – C:\WINDOWS\M2000Twn.ini
[2007/08/15 05:27:18 | 000,009,600 | —- | C] () – C:\WINDOWS\System32\drivers\n558.sys
[2006/07/20 05:58:00 | 001,662,976 | —- | C] () – C:\WINDOWS\System32\nvwdmcpl.dll
[2006/07/20 05:58:00 | 001,019,904 | —- | C] () – C:\WINDOWS\System32\nvwimg.dll
[2006/07/20 05:58:00 | 000,466,944 | —- | C] () – C:\WINDOWS\System32\nvshell.dll
[2006/07/20 05:58:00 | 000,098,304 | —- | C] () – C:\WINDOWS\System32\nvapi.dll
[2004/09/29 17:58:00 | 000,019,116 | —- | C] () – C:\WINDOWS\MSTMON_S.INI
[1997/05/11 07:20:50 | 000,062,464 | —- | C] () – C:\WINDOWS\System32\hs_regex.dll

========== LOP Check ==========

[2009/12/10 23:22:49 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Electronic Arts
[2010/08/03 19:20:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\EPSON
[2008/08/24 14:43:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\FileOpen
[2010/06/05 11:21:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\GNU
[2010/07/11 21:27:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iolo
[2010/06/04 22:15:12 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PKWARE
[2010/08/02 14:37:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Qwest
[2010/02/17 11:16:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SupportSoft
[2009/12/10 21:52:05 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/07/22 23:08:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TestOut
[2009/03/21 09:56:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
[2010/04/03 21:17:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/12/11 12:43:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/04/22 00:10:44 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2010/08/05 14:04:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Robearz\Application Data\EPSON
[2010/08/03 21:26:59 | 000,000,000 | —D | M] – C:\Documents and Settings\Robearz\Application Data\Helios
[2010/08/13 15:56:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Robearz\Application Data\iolo
[2010/08/03 19:29:12 | 000,000,000 | —D | M] – C:\Documents and Settings\Robearz\Application Data\Leadertech
[2010/08/02 14:04:53 | 000,000,000 | —D | M] – C:\Documents and Settings\Robearz\Application Data\Opera
[2010/08/13 20:06:39 | 000,000,000 | —D | M] – C:\Documents and Settings\Robearz\Application Data\Wireshark

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/04/15 22:52:22 | 000,001,024 | —- | M] () – C:\.rnd
[2008/07/22 16:16:41 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2008/08/13 16:27:50 | 000,000,640 | —- | M] () – C:\bar.emf
[2009/12/11 11:20:38 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2008/07/22 16:16:41 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2010/01/18 13:10:44 | 000,000,055 | —- | M] () – C:\DVDPATH.TXT
[2010/08/05 10:47:03 | 000,000,840 | —- | M] () – C:\EventLOG.txt
[2010/08/02 14:44:04 | 000,000,216 | —- | M] () – C:\Facilitator.log
[2008/07/22 16:16:41 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2008/07/22 16:16:41 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2004/08/03 19:38:34 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/07/22 19:06:21 | 000,250,048 | RHS- | M] () – C:\ntldr
[2010/08/19 23:14:36 | 2145,386,496 | -HS- | M] () – C:\pagefile.sys
[2008/12/25 12:33:52 | 000,000,026 | —- | M] () – C:\UpdaterforApp.ini

< %systemroot%\system32\*.wt >

< %systemroot%\system32\*.ruy >

< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2008/07/22 16:16:19 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 05:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2006/01/30 02:00:00 | 000,049,152 | R— | M] (Zenographics, Inc.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\IMFPRINT.DLL
[2006/10/26 17:58:12 | 000,030,512 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2004/09/29 18:04:44 | 000,010,752 | —- | M] (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.) – C:\WINDOWS\system32\spool\prtprocs\w32x86\MIMFPR_S.DLL
[2006/10/26 20:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
[2008/07/06 03:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2008/04/04 16:55:52 | 000,048,000 | —- | M] (Symantec Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\FwsVpn.dll
[2008/04/04 16:58:40 | 000,107,904 | —- | M] (Symantec Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\SymVPN.dll
[2008/04/04 16:58:44 | 000,357,760 | —- | M] (Symantec Corporation) Unable to obtain MD5 – C:\WINDOWS\system32\sysfer.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2008/07/22 10:59:29 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2008/07/22 10:59:29 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2008/07/22 10:59:29 | 000,892,928 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\user32.dll /md5 >
[2008/04/13 17:12:08 | 000,578,560 | —- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B – C:\WINDOWS\system32\user32.dll

< %systemroot%\system32\ws2_32.dll /md5 >
[2008/04/13 17:12:10 | 000,082,432 | —- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A – C:\WINDOWS\system32\ws2_32.dll

< %systemroot%\system32\ws2help.dll /md5 >
[2008/04/13 17:12:10 | 000,019,968 | —- | M] (Microsoft Corporation) MD5=9789E95E1D88EEB4B922BF3EA7779C28 – C:\WINDOWS\system32\ws2help.dll

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-08-12 07:00:09

========== Alternate Data Streams ==========

@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Robearz\Desktop\dds.scr:SummaryInformation
@Alternate Data Stream - 115 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:1CA73D29
< End of report >
Post #8
Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #9
Hi, Thanks for taking the time to provide the instructions. I am currently using two computers: A laptop that is suspected to be infected. A desktop that is thought to be clean and remains connected to the internet while I scan the laptop. I am writing this post on the desktop. I did the following: - connected to the internet with the laptop and downloaded CF to the desktop. - disconnected laptop from the internet. - disabled laptop Symantec Endpoint Protection. - ran ComboFix Something you might want to be aware of: On the laptop, with the CF scan, I got a 'warning' from Combofix, that may be a false positive re: ZoneAlarm. First the warning, then an explanation of the suspected false positive: Warning !! antivirus: ZoneAlarm Security Suite Antivirus Anitvirus and intrusion prevention programs are known to interfere with ComboFix's running. This may lead to unpredictable results or possible machine damage. Please disable these scanners before clicking 'OK'. Why it is possibly a false positive: ZoneAlarm was installed on the laptop a few years ago. I did not uninstall it, but the person who did uninstall it replaced it with Symantec Endpoint Protection. My copy of Iolo System Mechanic continues to detect ZoneAlarm for both Antivirus and Firewall, although neither is installed. Apparently, there are registry settings that remain in place - even though the registry has been scanned many times since the Symantec product was installed. In addition, there are no ZoneAlarm processes running on the laptop. On the desktop computer where this is being typed, ZoneAlarm is installed and running and the following process is running: zlclient.exe Do I continue with the ComboFix scan on the laptop or should certain registry settings on the laptop be modified first? Thank you for your patience with this. Bob
Post #10
yes, continue with it, leave it connected to the internet while combofix runs, then disconnect it (it needs to download the recovery console) I can remove the leftover zonealarm entries with ComboFix
Post #11 last edited
fyi: I tried to exit out of CF by clicking the red X in the top right corner. It went to the next screen and said "if you click OK, it is at your own risk" I clicked the red X in the top right corner, ( i did NOT click OK). The scan started. I clicked the red X in the top right corner - the scan ran for less than 2 seconds. I immediately shut the laptop down. Should I run CF? Also, to clarify: You want the firewall and anti-virus turned OFF while the laptop is connected to the internet? There is not another safe way to get the recovery console installed? Thanks again.
Post #12
yes, please run ComboFix, connect while the recovery console installs, once it installs and combofix starts to scan, then you can unplug it
Post #13
Note: file 'log.txt' appeared on-screen at end of CF process. It appears to be identical to 'ComboFix.txt' Let me know if you need contents of 'log.txt' posted.


ComboFix.txt

ComboFix 10-08-22.07 - Robearz 08/23/2010 9:52.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1407 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
AV: ZoneAlarm Security Suite Antivirus *On-access scanning enabled* (Outdated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: Symantec Endpoint Protection *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}
FW: ZoneAlarm Security Suite Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\_000005_.tmp.dll

.
((((((((((((((((((((((((( Files Created from 2010-07-23 to 2010-08-23 )))))))))))))))))))))))))))))))
.

2010-08-14 03:20 . 2010-08-14 03:20 ——– d—–w- c:\program files\QuickTime
2010-08-14 03:07 . 2010-08-14 03:07 ——– d—–w- c:\documents and settings\Robearz\Local Settings\Application Data\Adobe
2010-08-14 03:06 . 2010-08-14 03:06 ——– d—–w- c:\documents and settings\Robearz\Application Data\Wireshark
2010-08-14 02:37 . 2010-08-14 02:37 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\Malwarebytes
2010-08-14 00:13 . 2010-08-14 00:13 ——– d—–w- c:\documents and settings\Robearz\Application Data\Malwarebytes
2010-08-14 00:13 . 2010-08-14 00:13 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-14 00:13 . 2010-04-29 22:39 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-14 00:13 . 2010-08-14 00:13 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-08-14 00:13 . 2010-04-29 22:39 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-08-13 22:56 . 2010-08-14 02:44 1927 —-a-w- c:\documents and settings\Robearz\Application Data\iolo\restore.bat
2010-08-13 22:28 . 2010-08-13 22:28 ——– d-sh–w- c:\documents and settings\Robearz\IECompatCache
2010-08-10 16:52 . 2010-08-10 16:52 ——– d-sh–w- c:\documents and settings\AllOfUs\IECompatCache
2010-08-10 16:20 . 2010-08-10 16:20 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\Helios
2010-08-08 04:33 . 2010-08-08 04:34 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\vlc
2010-08-06 00:16 . 2010-08-06 00:16 ——– d-sh–w- c:\documents and settings\AllOfUs\PrivacIE
2010-08-05 21:17 . 2010-08-05 21:17 ——– d—–w- c:\documents and settings\AllOfUs\Local Settings\Application Data\ABBYY
2010-08-05 21:04 . 2010-08-05 21:04 ——– d—–w- c:\documents and settings\Robearz\Local Settings\Application Data\ABBYY
2010-08-05 21:04 . 2010-08-05 21:04 ——– d—–w- c:\documents and settings\Robearz\Application Data\EPSON
2010-08-05 20:59 . 2010-08-17 05:11 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\EPSON
2010-08-05 20:45 . 2010-08-05 20:45 ——– d—–w- C:\EPSONREG
2010-08-05 20:34 . 2010-08-05 21:04 ——– d—–w- c:\program files\ABBYY FineReader 6.0 Sprint
2010-08-05 20:30 . 2006-08-25 00:00 9216 —-a-w- c:\windows\system32\escdev.dll
2010-08-05 20:30 . 2007-11-29 07:00 73216 —-a-w- c:\windows\system32\eswia7c.dll
2010-08-05 20:30 . 2007-10-18 07:00 65793 —-a-w- c:\windows\system32\esfw7c.bin
2010-08-05 20:30 . 2007-10-18 07:00 221184 —-a-w- c:\windows\system32\esint7c.dll
2010-08-05 20:30 . 2006-03-10 07:00 3584 —-a-w- c:\windows\system32\eswiaml.dll
2010-08-05 07:28 . 2010-08-18 21:22 518 —-a-w- c:\documents and settings\Robearz\Application Data\iolo\Registry\Last\restore.bat
2010-08-05 00:36 . 2010-08-05 01:55 ——– d—–w- c:\windows\system32\NtmsData
2010-08-04 04:26 . 2010-08-04 04:26 ——– d—–w- c:\documents and settings\Robearz\Application Data\Helios
2010-08-04 04:26 . 2010-08-04 04:26 ——– d—–w- c:\program files\TextPad 5
2010-08-04 02:29 . 2010-08-04 02:29 ——– d—–w- c:\documents and settings\Robearz\Application Data\Leadertech
2010-08-04 02:20 . 2010-08-04 02:21 ——– d—–w- c:\program files\EPSON Print CD
2010-08-04 02:20 . 2006-04-18 11:00 102400 —-a-w- c:\documents and settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S30RP1.EXE
2010-08-04 02:20 . 2010-08-04 02:20 ——– d—–w- c:\documents and settings\All Users\Application Data\EPSON
2010-08-04 02:19 . 2010-08-05 20:31 ——– d—–w- c:\program files\EPSON
2010-08-02 21:04 . 2010-08-02 21:04 ——– d—–w- c:\documents and settings\Robearz\Local Settings\Application Data\Opera
2010-08-02 21:02 . 2010-08-02 21:02 ——– d—–w- c:\documents and settings\Robearz\Local Settings\Application Data\Mozilla
2010-08-02 20:42 . 2010-08-02 20:42 ——– d—–w- c:\documents and settings\Robearz\Application Data\InstallShield
2010-08-02 20:23 . 2010-08-02 20:23 70432 —-a-w- c:\documents and settings\Robearz\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-02 20:23 . 2010-08-02 21:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Qwest
2010-08-02 20:23 . 2010-08-02 20:23 ——– d—–w- c:\windows\XSxS
2010-08-02 20:23 . 2010-08-02 20:23 ——– d—–w- c:\program files\Xenocode
2010-08-02 20:23 . 2010-08-02 20:23 ——– d—–w- c:\documents and settings\Robearz\Local Settings\Application Data\Xenocode
2010-07-31 01:43 . 2010-07-31 01:43 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\FileOpen
2010-07-31 01:24 . 2010-07-31 01:45 ——– d—–w- c:\documents and settings\AllOfUs\Local Settings\Application Data\Adobe
2010-07-31 00:47 . 2010-05-24 00:50 73216 —-a-w- c:\documents and settings\AllOfUs\Application Data\Mozilla\Firefox\Profiles\dn2zuyev.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll
2010-07-31 00:47 . 2010-04-18 21:33 307200 —-a-w- c:\documents and settings\AllOfUs\Application Data\Mozilla\Firefox\Profiles\dn2zuyev.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\psftp.exe
2010-07-31 00:47 . 2010-04-18 21:33 172032 —-a-w- c:\documents and settings\AllOfUs\Application Data\Mozilla\Firefox\Profiles\dn2zuyev.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\puttygen.exe
2010-07-31 00:26 . 2010-07-31 00:26 ——– d—–w- c:\documents and settings\AllOfUs\Local Settings\Application Data\Math workpad
2010-07-31 00:15 . 2010-07-31 00:15 ——– d—–w- c:\documents and settings\AllOfUs\Local Settings\Application Data\Spirograph
2010-07-30 06:01 . 2010-07-30 06:01 ——– d-sh–w- c:\documents and settings\Robearz\PrivacIE
2010-07-30 05:01 . 2007-10-23 16:27 110592 —-a-w- c:\documents and settings\AllOfUs\Application Data\U3\temp\cleanup.exe
2010-07-30 04:53 . 2010-07-31 00:26 ——– d—–w- c:\documents and settings\AllOfUs\Local Settings\Application Data\Opera
2010-07-30 04:16 . 2010-07-30 04:16 ——– d—–w- c:\documents and settings\AllOfUs\Local Settings\Application Data\Mozilla
2010-07-30 04:15 . 2008-05-02 17:41 3493888 —ha-w- c:\documents and settings\AllOfUs\Application Data\U3\temp\Launchpad Removal.exe
2010-07-30 04:15 . 2010-08-20 06:01 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\U3
2010-07-30 00:25 . 2010-07-30 00:25 70432 —-a-w- c:\documents and settings\AllOfUs\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-07-30 00:22 . 2010-08-06 22:54 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\Apple Computer
2010-07-30 00:22 . 2010-07-30 00:25 ——– d—–w- c:\documents and settings\AllOfUs\Local Settings\Application Data\Apple Computer
2010-07-30 00:22 . 2010-07-30 00:22 ——– d—–w- c:\documents and settings\AllOfUs\Application Data\iolo
2010-07-30 00:08 . 2007-10-23 16:27 110592 —-a-w- c:\documents and settings\Robearz\Application Data\U3\temp\cleanup.exe
2010-07-30 00:06 . 2008-05-02 17:41 3493888 —ha-w- c:\documents and settings\Robearz\Application Data\U3\temp\Launchpad Removal.exe
2010-07-30 00:06 . 2010-07-30 00:06 ——– d—–w- c:\documents and settings\Robearz\Application Data\Apple Computer
2010-07-30 00:06 . 2010-07-30 00:06 ——– d—–w- c:\documents and settings\Robearz\Local Settings\Application Data\Apple Computer
2010-07-30 00:06 . 2010-08-20 07:10 ——– d—–w- c:\documents and settings\Robearz\Application Data\U3
2010-07-30 00:06 . 2010-08-13 22:56 ——– d—–w- c:\documents and settings\Robearz\Application Data\iolo
2010-07-29 23:29 . 2010-07-29 23:29 ——– d—–w- c:\program files\iPod
2010-07-29 23:14 . 2010-07-29 23:15 3782822 —-a-w- c:\temp\ConvertHelperSetup.exe
2010-07-29 23:14 . 2010-07-29 23:14 ——– d—–w- c:\program files\ConvertHelper
2010-07-29 23:10 . 2010-07-29 23:10 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-23 16:42 . 2010-02-17 08:05 ——– d—–w- c:\documents and settings\NetworkService\Application Data\VMware
2010-08-23 16:42 . 2010-01-15 02:44 ——– d—–w- c:\documents and settings\All Users\Application Data\VMware
2010-08-23 04:45 . 2010-06-29 01:21 845688 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-08-14 03:14 . 2008-07-29 03:01 ——– d—–w- c:\program files\Opera
2010-08-14 03:07 . 2009-04-22 06:35 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-08-12 06:59 . 2008-07-23 03:06 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2010-08-07 22:20 . 2010-04-16 16:08 ——– d—–w- c:\program files\Wireshark
2010-08-07 22:20 . 2010-04-16 16:09 ——– d—–w- c:\program files\WinPcap
2010-08-05 20:33 . 2008-07-23 00:17 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-08-05 20:33 . 2008-07-23 00:15 ——– d—–w- c:\program files\Common Files\InstallShield
2010-08-02 21:09 . 2010-02-17 17:57 ——– d—–w- c:\program files\Qwest
2010-07-29 23:30 . 2010-07-01 05:34 ——– d—–w- c:\program files\iTunes
2010-07-29 23:29 . 2008-08-05 01:19 ——– d—–w- c:\program files\Common Files\Apple
2010-07-23 06:08 . 2010-01-12 23:37 ——– d—–w- c:\documents and settings\All Users\Application Data\TestOut
2010-07-18 04:54 . 2010-07-18 04:54 160272 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2010-07-18 00:14 . 2010-03-07 04:53 ——– d—–w- c:\program files\Sophos
2010-07-15 20:18 . 2010-07-30 00:21 53632 —-a-w- c:\documents and settings\AllOfUs\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-07-15 20:18 . 2010-07-30 00:05 53632 —-a-w- c:\documents and settings\Robearz\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-07-12 04:44 . 2010-03-30 01:28 ——– d—–w- c:\program files\VideoLan
2010-07-12 04:27 . 2008-08-02 14:31 ——– d—–w- c:\documents and settings\All Users\Application Data\iolo
2010-07-06 22:16 . 2009-12-11 18:28 94384 —-a-w- c:\windows\system32\IncContxMenu.dll
2010-07-06 22:16 . 2009-12-11 18:28 2319536 —-a-w- c:\windows\system32\Incinerator.dll
2010-07-01 05:27 . 2010-07-01 05:27 ——– d—–w- c:\program files\Bonjour
2010-06-30 12:31 . 2004-08-04 04:56 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-25 17:07 . 2010-06-25 17:07 281104 —-a-w- c:\windows\system32\wpcap.dll
2010-06-25 17:07 . 2010-06-25 17:07 100880 —-a-w- c:\windows\system32\Packet.dll
2010-06-25 17:07 . 2010-06-25 17:07 35088 —-a-w- c:\windows\system32\drivers\npf.sys
2010-06-25 17:03 . 2010-06-25 17:03 53299 —-a-w- c:\windows\system32\pthreadVC.dll
2010-06-24 12:22 . 2004-08-04 04:56 916480 —-a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2004-08-04 03:17 1851904 —-a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-04 03:14 354304 —-a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-04 04:56 80384 —-a-w- c:\windows\system32\iccvid.dll
2010-06-14 14:31 . 2008-07-22 23:14 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-08-04 04:56 1172480 —-a-w- c:\windows\system32\msxml3.dll
2010-06-03 02:59 . 2007-06-19 22:08 161920 —-a-w- c:\windows\system32\drivers\WpsHelper.sys
2010-05-28 11:04 . 2010-05-28 11:04 14896 —-a-w- c:\windows\system32\drivers\psi_mf.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2010-07-04 398568]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-02-01 115560]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-20 7581696]
"nwiz"="nwiz.exe" [2006-07-20 1519616]
"ScreenPrint32"="c:\program files\ScreenPrint32 v3\ScreenPrint32.exe" [2003-05-16 446464]
"SkyTel"="SkyTel.EXE" [2006-05-17 2879488]
"SystemGuardAlerter"="c:\program files\iolo\System Mechanic\SystemGuardAlerter.exe" [2010-07-06 522928]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"vmware-tray"="c:\program files\VMware\VMware Workstation\vmware-tray.exe" [2010-01-23 129584]
"RTHDCPL"="RTHDCPL.EXE" [2006-12-05 16061440]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
"EEventManager"="c:\program files\EPSON\Creativity Suite\Event Manager\EEventManager.exe" [2006-10-12 102400]

c:\documents and settings\AllOfUs\Start Menu\Programs\Startup\
Windows Explorer.lnk - c:\windows\explorer.exe [2004-8-3 1033728]

c:\documents and settings\Robearz\Start Menu\Programs\Startup\
Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2010-5-28 911920]
Windows Explorer.lnk - c:\windows\explorer.exe [2004-8-3 1033728]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
LaunchU3.exe.lnk - c:\windows\Installer\{D8E363A7-88B7-446D-B2C0-E26CE4DC8E54}\_294823.exe [2010-1-14 22486]
PHOTOfunSTUDIO -viewer-.lnk.disabled [2008-12-25 1736]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\rootrepeal.sys]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"
"ArcSoft Connection Service"=c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
"KONICA MINOLTA magicolor 2400W STD"=c:\windows\system32\MSTMON_S.EXE STARTUP
"quickcare"=c:\program files\Qwest\Quickcare\bin\sprtcmd.exe /P QuickCare

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"=
"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"=
"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Cybered\\Algebra Equation Solver\\AEqSolvr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\TestOut\\Orbis\\Legacy\\LegacyXEng.exe"=
"c:\\Program Files\\VMware\\VMware Workstation\\vmware-authd.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [12/11/2009 11:28 AM 711352]
R2 ioloSystemService;iolo System Service;c:\program files\iolo\Common\Lib\ioloServiceManager.exe [12/11/2009 11:28 AM 711352]
R2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [6/25/2010 10:07 AM 35088]
R2 OrbisClient.Services;LabSim Configuration and Security;c:\program files\TestOut\Orbis\OrbisClient.Services.exe [6/14/2010 2:13 PM 14336]
R2 sprtlisten;SupportSoft Listener Service;c:\program files\Common Files\SupportSoft\bin\sprtlisten.exe [1/8/2008 12:02 PM 1213728]
R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [1/22/2010 10:14 PM 70704]
R2 VMUSBArbService;VMware USB Arbitration Service;c:\program files\Common Files\VMware\USB\vmware-usbarbitrator.exe [1/22/2010 9:00 PM 563760]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/18/2010 9:14 PM 102448]
S2 DirMngr;DirMngr;c:\program files\GNU\GnuPG\dirmngr.exe [5/29/2010 3:11 AM 242176]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [5/29/2007 11:55 AM 23888]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\8.tmp –> c:\windows\system32\8.tmp [?]
S3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\drivers\netr73.sys [7/22/2008 5:14 PM 247808]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [5/28/2010 4:04 AM 14896]
S3 PSSDK42;PSSDK42;c:\windows\system32\drivers\pssdk42.sys [2/16/2010 5:28 PM 38976]

— Other Services/Drivers In Memory —

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2010-08-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 19:34]

2010-08-20 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2008-07-23 22:31]

2010-08-18 c:\windows\Tasks\Spybot - Search & Destroy Updater - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SDUpdate.exe [2008-07-23 22:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.blinkpro.com/
mWindow Title = spybot ie custom title all users ie tweaks
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\program files\VMware\VMware Workstation\vsocklib.dll
FF - ProfilePath - c:\documents and settings\Robearz\Application Data\Mozilla\Firefox\Profiles\3bosuaej.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.blinkpro.com/|http://www.google.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\Mozilla Firefox\defaults\profile\user.js - user_pref("capability.policy.policynames", "allowclipboard");
c:\program files\Mozilla Firefox\defaults\profile\user.js - user_pref("capability.policy.allowclipboard.sites", "http://www.mozilla.org http://www.myway.com http://webmail.myway.com");
c:\program files\Mozilla Firefox\defaults\profile\user.js - user_pref("capability.policy.allowclipboard.Clipboard.cutcopy", "allAccess");
c:\program files\Mozilla Firefox\defaults\profile\user.js - user_pref("capability.policy.allowclipboard.Clipboard.paste", "allAccess");.
.
——- File Associations ——-
.
JSEFile=NOTEPAD.EXE %1
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-Symantec Antvirus



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-23 09:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\8.tmp"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2010-08-23 10:02:25
ComboFix-quarantined-files.txt 2010-08-23 17:02

Pre-Run: 66,765,869,056 bytes free
Post-Run: 66,952,642,560 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 977A1DE6B488629B7C6E3DF1A613A59E
Post #14
Hi

Please do the following;

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

SecCenter::
AV: ZoneAlarm Security Suite Antivirus *On-access scanning enabled* (Outdated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: ZoneAlarm Security Suite Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


NEXT

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT

**Vista/Win7 users - right click on the IE icon and run as administrator

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
Post #15
Double checking: After completing ComboFix, you want me to connect to the internet with my AV and Firewall disabled in order to run MalwareBytes and Kaspersky? Please confirm. Thanks

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI