What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Suspicious.Mystic.

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello.

A day ago I restarted my computer, and when it rebooted, the only thing there was my background and cursor, no toolbar or icons(I was still able to use the task manager, though.) I found Norton had found and quarantined a virus called suspicious.mystic, which was my explorer.exe file. I was able to see my toolbar after bringing in another explorer.exe through a flashdrive, but as soon as a copied it into my C:\WINDOWS folder, Norton deleted it again.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:30:46 PM, on 8/20/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Norton Internet Security\Engine\17.7.0.12\MCUI32.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
G:\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-tyc8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-tyc8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\IPSBHO.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\coIEPlg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [BCU] "C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: NETGEAR WG111v2 Smart Wizard.lnk = ?
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} (SysInfo Class) - http://content.systemrequirementslab.com.s…ri_4.1.71.0.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…sreqlab_nvd.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} (System Requirements Lab Class) - http://srtest-cdn.systemrequirementslab.co…eqlabdetect.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Browser Configuration Utility Service (BCUService) - DeviceVM, Inc. - C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ES lite Service for program management. (ES lite Service) - Unknown owner - C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 11683 bytes
Post #2
Hi

Please do the following:



Please download MBRCheck.exe to your desktop.
  • Be sure to disable your security programs
  • Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt)
  • A window will open on your desktop
  • if an unknown bootcode is found you will have further options available to you, at this time press N then press Enter twice.
  • If nothing unusual is found just press Enter
  • A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop.
  • Please post the contents of that file.



NEXT


Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.



NEXT


Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
Thank you for the reply. MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Professional Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x0000007d Kernel Drivers (total 143): 0x804D7000 \WINDOWS\system32\ntkrnlpa.exe 0x806E4000 \WINDOWS\system32\hal.dll 0xB85A8000 \WINDOWS\system32\KDCOM.DLL 0xB84B8000 \WINDOWS\system32\BOOTVID.dll 0xB7EAE000 spzt.sys 0xB85AA000 \WINDOWS\System32\Drivers\WMILIB.SYS 0xB7E96000 \WINDOWS\System32\Drivers\SCSIPORT.SYS 0xB7E68000 ACPI.sys 0xB7E57000 pci.sys 0xB80A8000 ohci1394.sys 0xB80B8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS 0xB80C8000 isapnp.sys 0xB8670000 pciide.sys 0xB8328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS 0xB80D8000 MountMgr.sys 0xB7E38000 ftdisk.sys 0xB85AC000 dmload.sys 0xB7E12000 dmio.sys 0xB8330000 PartMgr.sys 0xB80E8000 VolSnap.sys 0xB7DFA000 atapi.sys 0xB80F8000 disk.sys 0xB8108000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xB7DDA000 fltmgr.sys 0xB7D84000 SYMDS.SYS 0xB7D72000 sr.sys 0xB7D45000 SYMEFA.SYS 0xB8118000 PxHelp20.sys 0xB7D2E000 KSecDD.sys 0xB7CA1000 Ntfs.sys 0xB7C74000 NDIS.sys 0xB7C5A000 Mup.sys 0xB8308000 \SystemRoot\system32\DRIVERS\AmdPPM.sys 0xB859C000 \SystemRoot\system32\DRIVERS\wmiacpi.sys 0xB2A62000 \SystemRoot\system32\DRIVERS\nv4_mini.sys 0xB2A4E000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xB2A1A000 \SystemRoot\system32\DRIVERS\Rtenicxp.sys 0xB8318000 \SystemRoot\system32\DRIVERS\imapi.sys 0xB8148000 \SystemRoot\system32\DRIVERS\cdrom.sys 0xB8158000 \SystemRoot\system32\DRIVERS\redbook.sys 0xB29F7000 \SystemRoot\system32\DRIVERS\ks.sys 0xB8418000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys 0xB8420000 \SystemRoot\system32\DRIVERS\usbohci.sys 0xB29D3000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xB8428000 \SystemRoot\system32\DRIVERS\usbehci.sys 0xB29AB000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0xB34FE000 \SystemRoot\system32\DRIVERS\nic1394.sys 0xB2972000 \SystemRoot\System32\Drivers\acwp5j0a.SYS 0xB8490000 \SystemRoot\system32\DRIVERS\fdc.sys 0xB34EE000 \SystemRoot\system32\DRIVERS\serial.sys 0xB7C2E000 \SystemRoot\system32\DRIVERS\serenum.sys 0xB295E000 \SystemRoot\system32\DRIVERS\parport.sys 0xB871B000 \SystemRoot\system32\DRIVERS\audstub.sys 0xB85E6000 \SystemRoot\System32\Drivers\RootMdm.sys 0xB8498000 \SystemRoot\System32\Drivers\Modem.SYS 0xB34DE000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xB7C2A000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xB2947000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xB34CE000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xB34BE000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xB84A0000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xB2936000 \SystemRoot\system32\DRIVERS\psched.sys 0xB34AE000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xB84A8000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xB84B0000 \SystemRoot\system32\DRIVERS\raspti.sys 0xB8350000 \SystemRoot\system32\DRIVERS\RimSerial.sys 0xB2906000 \SystemRoot\system32\DRIVERS\rdpdr.sys 0xB349E000 \SystemRoot\system32\DRIVERS\termdd.sys 0xB8358000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xB8388000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xB85E8000 \SystemRoot\system32\DRIVERS\swenum.sys 0xB2880000 \SystemRoot\system32\DRIVERS\update.sys 0xB3C0E000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xB83A8000 \SystemRoot\system32\DRIVERS\flpydisk.sys 0xB346E000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xB81A8000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xB85F2000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xAEFCD000 \SystemRoot\system32\drivers\RtkHDAud.sys 0xAEFA9000 \SystemRoot\system32\drivers\portcls.sys 0xB81B8000 \SystemRoot\system32\drivers\drmk.sys 0xAEF02000 \SystemRoot\System32\Drivers\NIS\1107000.00C\SRTSP.SYS 0xAEEE3000 \SystemRoot\system32\drivers\NIS\1107000.00C\Ironx86.SYS 0xB83A0000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0xB81F8000 \SystemRoot\system32\drivers\NIS\1107000.00C\SRTSPX.SYS 0xAED72000 \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS 0xAED1B000 \SystemRoot\system32\DRIVERS\wg111v2.sys 0xB2878000 \SystemRoot\system32\DRIVERS\hidusb.sys 0xB8208000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0xB83B0000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0xB85CA000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xB86F1000 \SystemRoot\System32\Drivers\Null.SYS 0xB85CC000 \SystemRoot\System32\Drivers\Beep.SYS 0xB8430000 \SystemRoot\System32\drivers\vga.sys 0xB85CE000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xB85D0000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xB8438000 \SystemRoot\System32\Drivers\Msfs.SYS 0xB8440000 \SystemRoot\System32\Drivers\Npfs.SYS 0xB28E6000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xAECE8000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xAEC8F000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xAEC10000 \SystemRoot\System32\Drivers\NIS\1107000.00C\SYMTDI.SYS 0xAEBEA000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xB8298000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xB82A8000 \SystemRoot\system32\DRIVERS\arp1394.sys 0xAEB95000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20100818.002\IDSxpx86.sys 0xAEB6D000 \SystemRoot\system32\DRIVERS\netbt.sys 0xAEB4B000 \SystemRoot\System32\drivers\afd.sys 0xB82B8000 \SystemRoot\system32\DRIVERS\netbios.sys 0xAEA80000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xAEA10000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xB82D8000 \SystemRoot\System32\Drivers\Fips.SYS 0xAE9B2000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys 0xAE995000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys 0xAE916000 \SystemRoot\system32\drivers\NIS\1107000.00C\ccHPx86.sys 0xAE86A000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100810.004\BHDrvx86.sys 0xAEF99000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0xAEF95000 \SystemRoot\system32\DRIVERS\mouhid.sys 0xB82F8000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xAE82A000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xB85D2000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xAEF81000 \SystemRoot\System32\drivers\Dxapi.sys 0xB8470000 \SystemRoot\System32\watchdog.sys 0xBD000000 \SystemRoot\System32\drivers\dxg.sys 0xB87DD000 \SystemRoot\System32\drivers\dxgthk.sys 0xBD012000 \SystemRoot\System32\nv4_disp.dll 0xBFFA0000 \SystemRoot\System32\ATMFD.DLL 0xB83B8000 \SystemRoot\system32\DRIVERS\AegisP.sys 0xAE3E9000 \SystemRoot\system32\DRIVERS\EAPPkt.sys 0xAE4F2000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xAE244000 \SystemRoot\system32\drivers\wdmaud.sys 0xAE339000 \SystemRoot\system32\drivers\sysaudio.sys 0xADF41000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0xB85C2000 \SystemRoot\System32\Drivers\ParVdm.SYS 0xADDD2000 \SystemRoot\system32\DRIVERS\srv.sys 0xADCF6000 \??\C:\WINDOWS\gdrv.sys 0xAD32F000 \SystemRoot\system32\drivers\kmixer.sys 0xAC7AD000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100819.019\NAVEX15.SYS 0xAC799000 \??\C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20100819.019\NAVENG.SYS 0xB8410000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS 0xAC775000 \SystemRoot\System32\Drivers\Fastfat.SYS 0x7C900000 \WINDOWS\system32\ntdll.dll 0x10000000 \Program Files\DAEMON Tools Lite\Engine.dll Processes (total 40): 0 System Idle Process 4 System 720 C:\WINDOWS\system32\smss.exe 920 csrss.exe 948 C:\WINDOWS\system32\winlogon.exe 996 C:\WINDOWS\system32\services.exe 1008 C:\WINDOWS\system32\lsass.exe 1188 C:\WINDOWS\system32\nvsvc32.exe 1220 C:\WINDOWS\system32\svchost.exe 1316 svchost.exe 1460 C:\WINDOWS\system32\svchost.exe 1736 svchost.exe 1828 svchost.exe 2024 C:\WINDOWS\system32\spoolsv.exe 792 svchost.exe 828 C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe 840 C:\WINDOWS\system32\svchost.exe 852 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe 880 C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe 904 C:\Program Files\Bonjour\mDNSResponder.exe 1168 C:\Program Files\Gigabyte\EasySaver\essvr.exe 1544 C:\Program Files\Java\jre6\bin\jqs.exe 1616 C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccsvchst.exe 1624 C:\WINDOWS\system32\PnkBstrA.exe 1812 C:\WINDOWS\system32\PnkBstrB.exe 2080 C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccsvchst.exe 3036 C:\WINDOWS\system32\svchost.exe 3064 wdfmgr.exe 3124 C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe 3208 C:\WINDOWS\system32\wuauclt.exe 3608 alg.exe 1428 C:\WINDOWS\system32\taskmgr.exe 2212 C:\Program Files\Internet Explorer\iexplore.exe 2424 C:\Program Files\Internet Explorer\iexplore.exe 2788 C:\WINDOWS\system32\ctfmon.exe 3376 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 588 wmiprvse.exe 3496 C:\Program Files\Internet Explorer\iexplore.exe 1644 C:\WINDOWS\system32\wscntfy.exe 512 C:\Documents and Settings\Administrator\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) PhysicalDrive0 Model Number: ST380815AS, Rev: 4.AAB Size Device Name MBR Status ——————————————– 74 GB \\.\PhysicalDrive0 Windows XP MBR code detected SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A Done! DDS (Ver_10-03-17.01) - NTFSx86 Run by [removed] at 23:54:25.06 on Wed 08/18/2010 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2534 [GMT -7:00] AV: Norton Internet Security *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} ============== Running Processes =============== C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe C:\WINDOWS\System32\svchost.exe -k Akamai C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe C:\WINDOWS\system32\taskmgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\WinRAR\WinRAR.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\COCW58C1\dds[1].scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.youtube.com/ mDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-tyc8 mStart Page = hxxp://www.yahoo.com/?fr=fp-tyc8 uInternet Settings,ProxyOverride = *.local uURLSearchHooks: SearchHook Class: {bc86e1ab-eda5-4059-938f-ce307b0c6f0a} - c:\program files\devicevm\browser configuration utility\AddressBarSearch.dll BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\engine\17.7.0.12\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\engine\17.7.0.12\IPSBHO.DLL BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.5126.1836\swg.dll BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\engine\17.7.0.12\coIEPlg.dll TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Steam] "c:\program files\steam\steam.exe" -silent uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background uRun: [Search Protection] c:\program files\yahoo!\search protection\SearchProtection.exe uRun: [YSearchProtection] c:\program files\yahoo!\search protection\SearchProtection.exe uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe" uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe mRun: [YSearchProtection] "c:\program files\yahoo!\search protection\SearchProtection.exe" mRun: [BCU] "c:\program files\devicevm\browser configuration utility\BCU.exe" mRun: [RTHDCPL] RTHDCPL.EXE mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe" mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wg111v2\WG111v2.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wg111v~1.lnk - c:\program files\netgear\wg111v2 configuration utility\RtlWake.exe mPolicies-system: EnableLUA = 0 (0x0) mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0) IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.1.71.0.cab DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.10.115.cab DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\s1b2wwe3.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.youtube.com/ FF - prefs.js: network.proxy.type - 0 FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.1.0.19\coffplgn\components\coFFPlgn.dll FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.1.0.19\ipsffplgn\components\IPSFFPl.dll FF - plugin: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\s1b2wwe3.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nis\1107000.00c\symds.sys [2010-5-20 328752] R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1107000.00c\symefa.sys [2010-5-20 173104] R1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.1.0.19\definitions\bashdefs\20100810.004\BHDrvx86.sys [2010-8-9 692272] R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nis\1107000.00c\cchpx86.sys [2010-5-20 501888] R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nis\1107000.00c\ironx86.sys [2010-5-20 116784] R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2004-8-4 14336] R2 BCUService;Browser Configuration Utility Service;c:\program files\devicevm\browser configuration utility\BCUService.exe [2010-1-8 219360] R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [2009-12-24 66048] R2 ES lite Service;ES lite Service for program management.;c:\program files\gigabyte\easysaver\essvr.exe [2010-1-8 68136] R2 NIS;Norton Internet Security;c:\program files\norton internet security\engine\17.7.0.12\ccsvchst.exe [2010-5-20 126392] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-5-27 102448] R3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.1.0.19\definitions\ipsdefs\20100816.001\IDSXpx86.sys [2010-8-18 331640] R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.1.0.19\definitions\virusdefs\20100818.033\NAVENG.SYS [2010-8-18 85424] R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_17.1.0.19\definitions\virusdefs\20100818.033\NAVEX15.SYS [2010-8-18 1362608] R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [2009-12-24 272128] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-5-11 135664] S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-12-24 1684736] S3 cpuz132;cpuz132;\??\c:\docume~1\admini~1\locals~1\temp\cpuz132\cpuz132_x32.sys –> c:\docume~1\admini~1\locals~1\temp\cpuz132\cpuz132_x32.sys [?] S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [2010-6-25 23456] S3 pohci13F;pohci13F;c:\docume~1\admini~1\locals~1\temp\pohci13F.sys [2004-11-28 31744] =============== Created Last 30 ================ 2010-08-19 04:32:10 0 d–h–w- c:\windows\system32\GroupPolicy 2010-08-18 03:19:51 74072 —-a-w- c:\windows\system32\XAPOFX1_5.dll 2010-08-18 03:19:51 527192 —-a-w- c:\windows\system32\XAudio2_7.dll 2010-08-18 03:19:50 2106216 —-a-w- c:\windows\system32\D3DCompiler_43.dll 2010-08-18 03:19:49 1868128 —-a-w- c:\windows\system32\d3dcsx_43.dll 2010-08-18 03:19:48 248672 —-a-w- c:\windows\system32\d3dx11_43.dll 2010-08-18 03:19:47 470880 —-a-w- c:\windows\system32\d3dx10_43.dll 2010-08-18 03:19:45 1998168 —-a-w- c:\windows\system32\D3DX9_43.dll 2010-08-18 03:14:05 0 d—–w- c:\program files\Machinima Studio 2010-08-16 23:14:50 0 d—–w- C:\Autodesk 2010-08-16 09:01:55 0 d—–w- c:\docume~1\admini~1\applic~1\MilkShape 3D 1.x.x 2010-08-16 09:01:26 0 d—–w- c:\program files\MilkShape 3D 1.8.5 2010-08-16 08:17:05 0 d—–w- c:\docume~1\admini~1\applic~1\D177BC97C0D67C60CB5B5B0B2D0C9720 2010-08-12 01:41:28 0 d—–w- c:\program files\Pixologic 2010-08-08 09:46:44 0 d—–w- c:\program files\common files\Alias Shared 2010-08-08 09:34:30 0 d—–w- c:\program files\common files\Macrovision Shared 2010-08-08 09:34:26 0 d—–w- c:\program files\common files\ja-JP 2010-08-08 09:34:26 0 d—–w- c:\program files\common files\en-US 2010-08-08 09:34:20 0 d—–w- c:\program files\common files\Autodesk Shared 2010-08-08 09:29:28 0 d—–w- c:\program files\Autodesk 2010-08-08 09:24:21 0 d—–w- c:\docume~1\admini~1\applic~1\Autodesk 2010-08-06 20:43:59 0 d—–w- c:\program files\iPod 2010-08-06 20:43:52 0 d—–w- c:\program files\iTunes 2010-08-06 20:43:52 0 d—–w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521} 2010-08-06 20:36:54 0 d—–w- c:\program files\Bonjour 2010-07-28 17:02:30 0 d—–w- c:\program files\RegWork 2010-07-22 06:44:06 0 d—–w- c:\docume~1\alluse~1\applic~1\Firefly Studios 2010-07-22 06:17:09 0 d—–w- c:\program files\Firefly Studios ==================== Find3M ==================== 2010-08-19 06:37:32 17488 —-a-w- c:\windows\gdrv.sys 2010-08-05 19:33:57 23716 —ha-w- c:\windows\system32\mlfcache.dat 2010-07-22 06:22:04 98304 —-a-w- c:\windows\system32\CmdLineExt.dll 2010-07-22 01:28:12 189480 —-a-w- c:\windows\system32\PnkBstrB.exe 2010-07-22 00:40:29 137544 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys 2010-07-17 22:16:54 139152 —-a-w- c:\docume~1\admini~1\applic~1\PnkBstrK.sys 2010-07-17 22:16:14 794408 —-a-w- c:\windows\system32\pbsvc.exe 2010-07-15 01:39:19 21035 —-a-w- c:\windows\system32\drivers\AegisP.sys 2010-06-30 12:31:35 149504 —-a-w- c:\windows\system32\schannel.dll 2010-06-26 00:31:03 217180 —-a-w- c:\windows\system32\nvdrsdb0.bin 2010-06-26 00:31:00 217180 —-a-w- c:\windows\system32\nvdrsdb1.bin 2010-06-26 00:19:22 23456 —-a-w- c:\windows\system32\drivers\DrvAgent32.sys 2010-06-24 12:22:03 916480 —-a-w- c:\windows\system32\wininet.dll 2010-06-23 13:44:04 1851904 —-a-w- c:\windows\system32\win32k.sys 2010-06-21 15:27:11 354304 —-a-w- c:\windows\system32\drivers\srv.sys 2010-06-17 14:03:00 80384 —-a-w- c:\windows\system32\iccvid.dll 2010-06-15 07:02:48 9164 —-a-w- c:\program files\unins000.dat 2010-06-15 07:02:40 704282 —-a-w- c:\program files\unins000.exe 2010-06-14 07:41:45 1172480 —-a-w- c:\windows\system32\msxml3.dll 2010-06-08 00:34:52 81920 —-a-w- c:\windows\system32\nvwddi.dll 2010-06-08 00:34:42 277608 —-a-w- c:\windows\system32\nvmccs.dll 2010-06-08 00:34:42 13902440 —-a-w- c:\windows\system32\nvcpl.dll 2010-06-08 00:34:42 110696 —-a-w- c:\windows\system32\nvmctray.dll 2010-06-08 00:34:40 154728 —-a-w- c:\windows\system32\nvsvc32.exe 2010-06-08 00:34:40 145000 —-a-w- c:\windows\system32\nvcolor.exe 2010-06-07 23:57:00 6300544 —-a-w- c:\windows\system32\nv4_disp.dll 2010-06-07 23:57:00 61440 —-a-w- c:\windows\system32\OpenCL.dll 2010-06-07 23:57:00 4554752 —-a-w- c:\windows\system32\nvcuda.dll 2010-06-07 23:57:00 2632296 —-a-w- c:\windows\system32\nvcuvenc.dll 2010-06-07 23:57:00 232040 —-a-w- c:\windows\system32\nvcodins.dll 2010-06-07 23:57:00 232040 —-a-w- c:\windows\system32\nvcod.dll 2010-06-07 23:57:00 2186342 —-a-w- c:\windows\system32\nvdata.bin 2010-06-07 23:57:00 2165352 —-a-w- c:\windows\system32\nvcuvid.dll 2010-06-07 23:57:00 15192064 —-a-w- c:\windows\system32\nvoglnt.dll 2010-06-07 23:57:00 1359872 —-a-w- c:\windows\system32\nvapi.dll 2010-06-07 23:57:00 10256384 —-a-w- c:\windows\system32\nvcompiler.dll 2009-11-20 04:08:02 3749224 —-a-w- c:\program files\common files\adlmint_libFNP.dll 2009-11-20 04:08:02 2941288 —-a-w- c:\program files\common files\adlmint.dll ============= FINISH: 23:54:51.81 ===============

Attachments:

Post #4
Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #5
ComboFix 10-08-22.07 - Administrator 08/23/2010 12:35:59.2.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2873 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
c:\documents and settings\Administrator\Application Data\7za.exe
c:\documents and settings\Administrator\Application Data\D69E15FE6B4658649ED6DC28A979C6E0
c:\documents and settings\Administrator\Application Data\D69E15FE6B4658649ED6DC28A979C6E0\enemies-names.txt
c:\documents and settings\Administrator\Application Data\D69E15FE6B4658649ED6DC28A979C6E0\local.ini
c:\documents and settings\Administrator\Favorites\Daniel Tosh tickets E.J. Thomas Hall Akron, OH, Directions, seating chart. Official Ticketmaster site..url
c:\documents and settings\Administrator\Local Settings\Application Data\Windows Server
c:\documents and settings\Administrator\Local Settings\Application Data\Windows Server\admin.txt
c:\documents and settings\Administrator\Local Settings\Application Data\Windows Server\flags.ini
c:\documents and settings\Administrator\Local Settings\Application Data\Windows Server\server.dat
c:\documents and settings\Administrator\Local Settings\Application Data\Windows Server\uses32.dat
c:\documents and settings\Administrator\Start Menu\Programs\Antimalware Doctor
C:\install.exe

– Previous Run –

Infected copy of c:\windows\system32\winlogon.exe was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\winlogon.exe

——–

.
((((((((((((((((((((((((( Files Created from 2010-07-23 to 2010-08-23 )))))))))))))))))))))))))))))))
.

2010-08-23 19:35 . 2010-08-23 19:35 ——– d—–r- C:\32788R22FWJFW
2010-08-23 19:23 . 2010-08-23 19:23 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2010-08-19 04:32 . 2010-08-19 04:32 ——– d–h–w- c:\windows\system32\GroupPolicy
2010-08-18 03:19 . 2010-06-02 11:55 74072 —-a-w- c:\windows\system32\XAPOFX1_5.dll
2010-08-18 03:19 . 2010-06-02 11:55 527192 —-a-w- c:\windows\system32\XAudio2_7.dll
2010-08-18 03:19 . 2010-05-26 18:41 2106216 —-a-w- c:\windows\system32\D3DCompiler_43.dll
2010-08-18 03:19 . 2010-05-26 18:41 1868128 —-a-w- c:\windows\system32\d3dcsx_43.dll
2010-08-18 03:19 . 2010-05-26 18:41 248672 —-a-w- c:\windows\system32\d3dx11_43.dll
2010-08-18 03:19 . 2010-05-26 18:41 470880 —-a-w- c:\windows\system32\d3dx10_43.dll
2010-08-18 03:19 . 2010-05-26 18:41 1998168 —-a-w- c:\windows\system32\D3DX9_43.dll
2010-08-18 03:16 . 2010-08-18 03:16 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Playata
2010-08-18 03:14 . 2010-08-18 03:38 ——– d—–w- c:\program files\Machinima Studio
2010-08-16 23:14 . 2010-08-16 23:14 ——– d—–w- C:\Autodesk
2010-08-16 09:01 . 2010-08-16 09:22 ——– d—–w- c:\documents and settings\Administrator\Application Data\MilkShape 3D 1.x.x
2010-08-16 09:01 . 2010-08-16 09:01 ——– d—–w- c:\program files\MilkShape 3D 1.8.5
2010-08-16 08:17 . 2010-08-16 08:17 ——– d—–w- c:\documents and settings\Administrator\Application Data\D177BC97C0D67C60CB5B5B0B2D0C9720
2010-08-12 01:41 . 2010-08-12 01:41 ——– d—–w- c:\program files\Pixologic
2010-08-12 01:40 . 2010-08-12 01:40 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Downloaded Installations
2010-08-10 07:39 . 2010-08-10 07:39 503808 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-400be27c-n\msvcp71.dll
2010-08-10 07:39 . 2010-08-10 07:39 499712 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-400be27c-n\jmc.dll
2010-08-10 07:39 . 2010-08-10 07:39 348160 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-400be27c-n\msvcr71.dll
2010-08-10 07:39 . 2010-08-10 07:39 61440 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-6a767562-n\decora-sse.dll
2010-08-10 07:39 . 2010-08-10 07:39 12800 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-6a767562-n\decora-d3d.dll
2010-08-08 09:46 . 2010-08-08 09:47 ——– d—–w- c:\program files\Common Files\Alias Shared
2010-08-08 09:34 . 2010-08-08 09:34 ——– d—–w- c:\program files\Common Files\Macrovision Shared
2010-08-08 09:34 . 2010-08-08 09:34 ——– d—–w- c:\program files\Common Files\ja-JP
2010-08-08 09:34 . 2010-08-08 09:34 ——– d—–w- c:\program files\Common Files\en-US
2010-08-08 09:34 . 2010-08-08 09:46 ——– d—–w- c:\program files\Common Files\Autodesk Shared
2010-08-08 09:29 . 2010-08-19 01:27 ——– d—–w- c:\program files\Autodesk
2010-08-08 09:24 . 2010-08-08 10:08 ——– d—–w- c:\documents and settings\Administrator\Application Data\Autodesk
2010-08-08 09:24 . 2010-08-08 10:08 ——– d—–w- c:\documents and settings\All Users\Application Data\Autodesk
2010-08-08 06:34 . 2010-08-08 06:34 2568656 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2010-08-08 06:25 . 2010-08-08 06:25 0 —-a-w- c:\windows\nsreg.dat
2010-08-08 06:25 . 2010-08-08 06:25 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-08-06 20:43 . 2010-08-06 20:43 ——– d—–w- c:\program files\iPod
2010-08-06 20:43 . 2010-08-06 20:44 ——– d—–w- c:\program files\iTunes
2010-08-06 20:43 . 2010-08-06 20:44 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-08-06 20:40 . 2010-08-06 20:41 ——– d—–w- c:\program files\QuickTime
2010-08-06 20:36 . 2010-08-06 20:36 ——– d—–w- c:\program files\Bonjour
2010-08-06 20:29 . 2010-08-06 20:29 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-07-28 17:02 . 2010-07-28 20:19 ——– d—–w- c:\program files\RegWork
2010-07-28 03:35 . 2010-07-28 03:35 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\World in Conflict

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-23 19:27 . 2010-03-22 04:03 ——– d—–w- c:\program files\Common Files\Akamai
2010-08-23 19:26 . 2010-01-08 19:05 17488 —-a-w- c:\windows\gdrv.sys
2010-08-23 19:26 . 2009-12-27 15:14 720 —-a-w- c:\documents and settings\All Users\Application Data\ArcSoft\kodak-printcreations-22-080812-oem\acforall.dll
2010-08-20 07:37 . 2009-12-25 14:57 ——– d—–w- c:\program files\Steam
2010-08-20 07:36 . 2010-04-24 19:26 ——– d—–w- c:\documents and settings\Administrator\Application Data\uTorrent
2010-08-20 05:29 . 2010-02-07 08:29 ——– d—–w- c:\program files\RegEditX
2010-08-16 22:06 . 2010-03-27 23:10 ——– d—–w- c:\program files\World of Warcraft Model Viewer
2010-08-12 01:42 . 2009-12-24 21:27 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-08-08 10:02 . 2010-03-22 04:51 ——– d—–w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-08-08 09:51 . 2010-05-12 04:17 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-08-08 06:31 . 2010-05-24 05:46 ——– d—–w- c:\documents and settings\All Users\Application Data\PMB Files
2010-08-06 20:43 . 2010-01-09 12:59 ——– d—–w- c:\program files\Common Files\Apple
2010-08-05 19:33 . 2010-01-10 15:15 23716 —ha-w- c:\windows\system32\mlfcache.dat
2010-08-01 21:50 . 2010-07-11 19:18 ——– d—–w- c:\program files\Electronic Arts
2010-07-28 22:38 . 2010-05-12 04:19 ——– d—–w- c:\program files\Google
2010-07-22 06:44 . 2010-07-22 06:44 ——– d—–w- c:\documents and settings\All Users\Application Data\Firefly Studios
2010-07-22 06:22 . 2009-12-27 05:40 98304 —-a-w- c:\windows\system32\CmdLineExt.dll
2010-07-22 06:17 . 2010-07-22 06:17 ——– d—–w- c:\program files\Firefly Studios
2010-07-22 01:28 . 2010-01-17 11:19 189480 —-a-w- c:\windows\system32\PnkBstrB.exe
2010-07-22 00:40 . 2010-01-17 11:19 137544 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-07-17 22:16 . 2010-01-17 11:19 139152 —-a-w- c:\documents and settings\Administrator\Application Data\PnkBstrK.sys
2010-07-17 22:16 . 2010-01-17 11:19 139152 —-a-w- c:\documents and settings\Administrator\Application Data\PnkBstrK.sys
2010-07-17 22:16 . 2010-01-17 11:19 794408 —-a-w- c:\windows\system32\pbsvc.exe
2010-07-15 01:39 . 2010-07-15 01:39 21035 —-a-w- c:\windows\system32\drivers\AegisP.sys
2010-07-15 01:38 . 2009-12-24 21:27 ——– d—–w- c:\program files\NETGEAR
2010-07-12 23:56 . 2010-07-12 23:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Electronic Arts
2010-07-11 19:28 . 2010-07-11 19:28 10134 —-a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2010-07-11 19:28 . 2010-07-11 19:28 ——– d—–w- c:\program files\Microsoft WSE
2010-07-11 13:49 . 2010-07-11 13:49 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-07-11 13:49 . 2010-07-11 13:49 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-07-11 13:49 . 2010-07-11 13:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-11 01:42 . 2009-12-24 20:06 ——– d—–w- c:\program files\EA GAMES
2010-07-06 08:07 . 2009-12-24 21:59 ——– d—–w- c:\program files\Realtek
2010-07-05 23:10 . 2010-07-05 23:02 ——– d—–w- c:\program files\Mount&Blade; Warband
2010-07-05 22:28 . 2010-06-30 02:16 ——– d—–w- c:\program files\Paradox Interactive
2010-07-02 19:15 . 2010-06-07 06:57 ——– d—–w- c:\documents and settings\All Users\Application Data\BioWare
2010-07-02 19:15 . 2010-06-07 06:24 ——– d—–w- c:\program files\Common Files\BioWare
2010-06-30 12:31 . 2004-08-04 12:00 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-26 06:52 . 2010-06-26 06:52 ——– d—–w- c:\documents and settings\Administrator\Application Data\NVIDIA
2010-06-26 00:42 . 2010-06-26 00:42 ——– d—–w- c:\documents and settings\Administrator\Application Data\Carambis
2010-06-26 00:33 . 2009-12-24 19:38 ——– d—–w- c:\program files\NVIDIA Corporation
2010-06-26 00:31 . 2009-12-24 19:39 ——– d—–w- c:\program files\AGEIA Technologies
2010-06-26 00:31 . 2009-12-24 19:39 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-06-26 00:31 . 2010-06-26 00:31 217180 —-a-w- c:\windows\system32\nvdrsdb0.bin
2010-06-26 00:31 . 2010-06-26 00:31 1 —-a-w- c:\windows\system32\nvdrssel.bin
2010-06-26 00:31 . 2010-06-26 00:31 217180 —-a-w- c:\windows\system32\nvdrsdb1.bin
2010-06-26 00:19 . 2010-06-26 00:19 23456 —-a-w- c:\windows\system32\drivers\DrvAgent32.sys
2010-06-26 00:15 . 2010-06-26 00:15 ——– d—–w- c:\program files\Driver-Soft
2010-06-26 00:12 . 2010-06-05 06:15 ——– d—–w- c:\documents and settings\Administrator\Application Data\IGN_DLM
2010-06-25 23:53 . 2010-06-25 23:53 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2010-06-25 09:32 . 2010-06-05 20:17 ——– d—–w- c:\program files\7-Zip
2010-06-24 12:22 . 2004-08-04 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-06-23 16:39 . 2010-06-23 16:39 501936 —-a-w- c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb285.tmp.exe
2010-06-23 13:44 . 2004-08-04 12:00 1851904 —-a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-04 12:00 354304 —-a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-04 12:00 80384 —-a-w- c:\windows\system32\iccvid.dll
2010-06-15 07:02 . 2010-06-15 07:02 9164 —-a-w- c:\program files\unins000.dat
2010-06-15 07:02 . 2010-06-15 07:02 704282 —-a-w- c:\program files\unins000.exe
2010-06-14 14:31 . 2009-12-23 05:33 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-08-04 12:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2010-06-08 07:39 . 2010-06-08 07:39 503808 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-182aac27-n\msvcp71.dll
2010-06-08 07:39 . 2010-06-08 07:39 499712 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-182aac27-n\jmc.dll
2010-06-08 07:39 . 2010-06-08 07:39 348160 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-182aac27-n\msvcr71.dll
2010-06-08 07:39 . 2010-06-08 07:39 61440 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-27e188e3-n\decora-sse.dll
2010-06-08 07:39 . 2010-06-08 07:39 12800 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-27e188e3-n\decora-d3d.dll
2010-06-08 00:34 . 2010-06-08 00:34 81920 —-a-w- c:\windows\system32\nvwddi.dll
2010-06-08 00:34 . 2010-06-08 00:34 277608 —-a-w- c:\windows\system32\nvmccs.dll
2010-06-08 00:34 . 2010-06-08 00:34 13902440 —-a-w- c:\windows\system32\nvcpl.dll
2010-06-08 00:34 . 2010-06-08 00:34 110696 —-a-w- c:\windows\system32\nvmctray.dll
2010-06-08 00:34 . 2010-06-08 00:34 154728 —-a-w- c:\windows\system32\nvsvc32.exe
2010-06-08 00:34 . 2010-06-08 00:34 145000 —-a-w- c:\windows\system32\nvcolor.exe
2010-06-07 23:57 . 2009-12-24 19:37 61440 —-a-w- c:\windows\system32\OpenCL.dll
2010-06-07 23:57 . 2009-12-24 19:37 4554752 —-a-w- c:\windows\system32\nvcuda.dll
2010-06-07 23:57 . 2009-12-24 19:37 2632296 —-a-w- c:\windows\system32\nvcuvenc.dll
2010-06-07 23:57 . 2009-12-24 19:37 2165352 —-a-w- c:\windows\system32\nvcuvid.dll
2010-06-07 23:57 . 2009-12-24 19:37 15192064 —-a-w- c:\windows\system32\nvoglnt.dll
2010-06-07 23:57 . 2009-12-24 19:37 232040 —-a-w- c:\windows\system32\nvcodins.dll
2010-06-07 23:57 . 2009-12-24 19:37 232040 —-a-w- c:\windows\system32\nvcod.dll
2010-06-07 23:57 . 2009-12-24 19:37 2186342 —-a-w- c:\windows\system32\nvdata.bin
2010-06-07 23:57 . 2009-12-24 19:37 1359872 —-a-w- c:\windows\system32\nvapi.dll
2010-06-07 23:57 . 2009-12-24 19:37 10256384 —-a-w- c:\windows\system32\nvcompiler.dll
2010-06-07 23:57 . 2009-12-24 18:58 10531200 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-06-07 23:57 . 2008-04-14 00:12 6300544 —-a-w- c:\windows\system32\nv4_disp.dll
2009-11-20 04:08 . 2009-11-20 04:08 3749224 —-a-w- c:\program files\Common Files\adlmint_libFNP.dll
2009-11-20 04:08 . 2009-11-20 04:08 2941288 —-a-w- c:\program files\Common Files\adlmint.dll
.

——- Sigcheck ——-

[7] 2008-04-14 . 12896823FB95BFB3DC9B46BCAEDC9923 . 1033728 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\explorer.exe
[7] 2004-08-04 . A0732187050030AE399B241436565E64 . 1032192 . . [6.00.2900.2180] . . c:\windows\$NtServicePackUninstall$\explorer.exe

c:\windows\explorer.exe … is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-02-05 00:50 1197448 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-05 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-05 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2010-05-08 1238352]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-05-27 322352]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-12 39408]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"BCU"="c:\program files\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-08-05 346320]
"RTHDCPL"="RTHDCPL.EXE" [2009-08-14 18702336]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-03-07 236016]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-06-03 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-06-08 13902440]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-06-08 110696]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-19 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-10-30 282624]
NETGEAR WG111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v2\WG111v2.exe [2010-7-14 1268192]
WG111v2 Smart Wizard Wireless Setting.lnk - c:\program files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2009-12-24 745472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Mount&Blade; Warband\\mb_warband.exe"=
"c:\\Program Files\\Aspyr\\Men of War\\mow.exe"=
"c:\\Program Files\\Firefly Studios\\Stronghold 2\\Stronghold2.exe"=
"c:\\Program Files\\Steam\\steamapps\\lunthegun\\team fortress 2 meet the sniper\\smp.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"c:\\Program Files\\Autodesk\\Maya2011\\bin\\maya.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57354:TCP"= 57354:TCP:Pando Media Booster
"57354:UDP"= 57354:UDP:Pando Media Booster
"1033:TCP"= 1033:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1107000.00C\symds.sys [5/20/2010 9:34 PM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1107000.00C\symefa.sys [5/20/2010 9:34 PM 173104]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100810.004\BHDrvx86.sys [8/9/2010 6:11 PM 692272]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1107000.00C\cchpx86.sys [5/20/2010 9:34 PM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1107000.00C\ironx86.sys [5/20/2010 9:34 PM 116784]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [8/4/2004 5:00 AM 14336]
R2 BCUService;Browser Configuration Utility Service;c:\program files\DeviceVM\Browser Configuration Utility\BCUService.exe [1/8/2010 11:57 AM 219360]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [12/24/2009 2:27 PM 66048]
R2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [1/8/2010 11:57 AM 68136]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.7.0.12\ccsvchst.exe [5/20/2010 9:34 PM 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/27/2010 4:22 PM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20100820.001\IDSXpx86.sys [8/22/2010 7:30 PM 331640]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [12/24/2009 2:27 PM 272128]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5/11/2010 10:03 PM 135664]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [12/24/2009 2:59 PM 1684736]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [6/25/2010 5:19 PM 23456]
S3 pohci13F;pohci13F;\??\c:\docume~1\ADMINI~1\LOCALS~1\Temp\pohci13F.sys –> c:\docume~1\ADMINI~1\LOCALS~1\Temp\pohci13F.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [5/8/2010 11:05 AM 697328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder

2010-08-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]

2010-08-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-12 05:03]

2010-08-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-12 05:03]

2010-08-20 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-02-05 00:50]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.youtube.com/
mStart Page = hxxp://www.yahoo.com/?fr=fp-tyc8
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.1.71.0.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\s1b2wwe3.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.youtube.com/
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-23 12:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.7.0.12\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-583907252-926492609-839522115-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,42,4e,80,00,8e,9e,53,4e,9a,08,99,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,42,9f,99,a9,64,4b,fc,46,b3,ef,8d,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,42,4e,80,00,8e,9e,53,4e,9a,08,99,\
.
Completion time: 2010-08-23 12:46:05
ComboFix-quarantined-files.txt 2010-08-23 19:46

Pre-Run: 21,288,914,944 bytes free
Post-Run: 21,252,603,904 bytes free

- - End Of File - - 5BD18E7BF84F9CDFEA4ABA67D61932A3
Post #6 last edited
please do the following:

  • Go to Start->Run and type in notepad and hit OK.
  • Then copy and paste the content of the following codebox into Notepad:

    @echo off
copy /y c:\windows\ServicePackFiles\i386\explorer.exe c:\
copy /y c:\windows\ServicePackFiles\i386\winlogon.exe c:\
del %0
  • Save the file to your DESKTOP as "fix.bat". Make sure to save it with the quotes.
  • Once saved, the icon to click should look like this on your desktop:

    [external image: Posted Image]
  • Double click fix.bat. to run it. A small black box should open and close - this is normal.

This batch will copy the files located in the Service pack Files to the C:\ drive

Now we need to use the Recovery Console to copy over the infected files


Print out these instructions to use while in the Recovery Console:

  • Restart your computer.
  • Before Windows loads, you will be prompted to choose which Operating System to start.
  • Use the up and down arrow key to select Microsoft Windows Recovery Console (be fast - you only have a couple of seconds)
  • You must enter which Windows installation to log onto. Type 1 and press 'Enter'.
  • At the C:\Windows prompt, type the following bolded entries, and press 'Enter' (note the spaces) after each line:

    cd c:\windows\system32
    ren winlogon.exe winlogon.old
    copy c:\winlogon.exe c:\windows\system32

    you should see the message "1 file(s) copied"

    now type:

    cd C:\windows
    copy c:\explorer.exe c:\windows

    again you should see "1 file(s) copied"
    exit

    You should see a message '1 file copied'. If you did not see that message, try again and ensure there is a space after the word copy and another space between the file paths.
    (if you do not see 1 file copied on the screen, even after ensuring the commands are correct, rename the file back to it's original name by typing the following command then hitting Enter.
    ren winlogon.old winlogon.exe
    you should NOT be prompted to overwrite an existing file, but if you are, select No then type exit to restart and notify me of your results)
  • Type exit and press 'Enter'. Your computer should reboot.

let me know how that goes, also please advise how your computer is running and if there are any outstanding issues.
Post #8 last edited
OK, rename winlogon.old back to winlogon.exe

and then we will need to manually make a copy of the file and copy it to the c:\ drive so we can replace it in the Recovery Console

(it has to be replaced outside of the Windows environment)


when you have renamed winlogon boot back into normal mode,

please navigate to c:\windows\system32\winlogon.exe > right click winlogon.exe > copy

now navigate back to C:\ > right click in an empty space and > paste

now navigate to c:\windows\ServicePackFiles\i386\explorer.exe > rightclick explorer.exe > copy

now navigate back to C:\ > right click in an empty space and > paste


please re-try the file copy procedure in the Recovery Console
Post #10
excellent

please delete the copy of ComboFix from your desktop and download a fresh copy from the link below, we need to make sure that worked and the files aren't reinfected

(this is a new infection and it is proving difficult to remove, our expert tool developers are working hard on it)

Link 1
Post #13
ComboFix 10-08-23.01 - Administrator 08/23/2010 19:58:00.3.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2537 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\explorer.exe
C:\winlogon.exe

.
((((((((((((((((((((((((( Files Created from 2010-07-24 to 2010-08-24 )))))))))))))))))))))))))))))))
.

2010-08-24 02:45 . 2010-08-24 02:45 862872 —-a-w- c:\documents and settings\Administrator\Application Data\Yahoo!\SearchProtection\fudogs_2.0.1.13_msgr_bts_setup.2010.04.01.01.exe
2010-08-24 02:08 . 2008-04-14 00:12 507904 —-a-w- c:\windows\system32\winlogon.exe
2010-08-23 21:25 . 2008-04-14 00:12 1033728 —-a-w- c:\windows\explorer.exe
2010-08-23 19:23 . 2010-08-23 19:23 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2010-08-19 04:32 . 2010-08-19 04:32 ——– d–h–w- c:\windows\system32\GroupPolicy
2010-08-18 03:19 . 2010-06-02 11:55 74072 —-a-w- c:\windows\system32\XAPOFX1_5.dll
2010-08-18 03:19 . 2010-06-02 11:55 527192 —-a-w- c:\windows\system32\XAudio2_7.dll
2010-08-18 03:19 . 2010-05-26 18:41 2106216 —-a-w- c:\windows\system32\D3DCompiler_43.dll
2010-08-18 03:19 . 2010-05-26 18:41 1868128 —-a-w- c:\windows\system32\d3dcsx_43.dll
2010-08-18 03:19 . 2010-05-26 18:41 248672 —-a-w- c:\windows\system32\d3dx11_43.dll
2010-08-18 03:19 . 2010-05-26 18:41 470880 —-a-w- c:\windows\system32\d3dx10_43.dll
2010-08-18 03:19 . 2010-05-26 18:41 1998168 —-a-w- c:\windows\system32\D3DX9_43.dll
2010-08-18 03:16 . 2010-08-18 03:16 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Playata
2010-08-18 03:14 . 2010-08-18 03:38 ——– d—–w- c:\program files\Machinima Studio
2010-08-16 23:14 . 2010-08-16 23:14 ——– d—–w- C:\Autodesk
2010-08-16 09:01 . 2010-08-16 09:22 ——– d—–w- c:\documents and settings\Administrator\Application Data\MilkShape 3D 1.x.x
2010-08-16 09:01 . 2010-08-16 09:01 ——– d—–w- c:\program files\MilkShape 3D 1.8.5
2010-08-16 08:17 . 2010-08-16 08:17 ——– d—–w- c:\documents and settings\Administrator\Application Data\D177BC97C0D67C60CB5B5B0B2D0C9720
2010-08-12 01:41 . 2010-08-12 01:41 ——– d—–w- c:\program files\Pixologic
2010-08-12 01:40 . 2010-08-12 01:40 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Downloaded Installations
2010-08-10 07:39 . 2010-08-10 07:39 503808 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-400be27c-n\msvcp71.dll
2010-08-10 07:39 . 2010-08-10 07:39 499712 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-400be27c-n\jmc.dll
2010-08-10 07:39 . 2010-08-10 07:39 348160 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-400be27c-n\msvcr71.dll
2010-08-10 07:39 . 2010-08-10 07:39 61440 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-6a767562-n\decora-sse.dll
2010-08-10 07:39 . 2010-08-10 07:39 12800 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-6a767562-n\decora-d3d.dll
2010-08-08 09:46 . 2010-08-08 09:47 ——– d—–w- c:\program files\Common Files\Alias Shared
2010-08-08 09:34 . 2010-08-08 09:34 ——– d—–w- c:\program files\Common Files\Macrovision Shared
2010-08-08 09:34 . 2010-08-08 09:34 ——– d—–w- c:\program files\Common Files\ja-JP
2010-08-08 09:34 . 2010-08-08 09:34 ——– d—–w- c:\program files\Common Files\en-US
2010-08-08 09:34 . 2010-08-08 09:46 ——– d—–w- c:\program files\Common Files\Autodesk Shared
2010-08-08 09:29 . 2010-08-19 01:27 ——– d—–w- c:\program files\Autodesk
2010-08-08 09:24 . 2010-08-08 10:08 ——– d—–w- c:\documents and settings\Administrator\Application Data\Autodesk
2010-08-08 09:24 . 2010-08-08 10:08 ——– d—–w- c:\documents and settings\All Users\Application Data\Autodesk
2010-08-08 06:34 . 2010-08-08 06:34 2568656 —-a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2010-08-08 06:25 . 2010-08-08 06:25 0 —-a-w- c:\windows\nsreg.dat
2010-08-08 06:25 . 2010-08-08 06:25 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-08-06 20:43 . 2010-08-06 20:43 ——– d—–w- c:\program files\iPod
2010-08-06 20:43 . 2010-08-06 20:44 ——– d—–w- c:\program files\iTunes
2010-08-06 20:43 . 2010-08-06 20:44 ——– d—–w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-08-06 20:40 . 2010-08-06 20:41 ——– d—–w- c:\program files\QuickTime
2010-08-06 20:36 . 2010-08-06 20:36 ——– d—–w- c:\program files\Bonjour
2010-08-06 20:29 . 2010-08-06 20:29 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.2.1.5\SetupAdmin.exe
2010-07-28 17:02 . 2010-07-28 20:19 ——– d—–w- c:\program files\RegWork
2010-07-28 03:35 . 2010-07-28 03:35 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\World in Conflict

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-24 02:16 . 2010-04-24 19:26 ——– d—–w- c:\documents and settings\Administrator\Application Data\uTorrent
2010-08-24 02:16 . 2009-12-25 14:57 ——– d—–w- c:\program files\Steam
2010-08-24 02:15 . 2010-03-22 04:03 ——– d—–w- c:\program files\Common Files\Akamai
2010-08-24 02:14 . 2010-01-08 19:05 17488 —-a-w- c:\windows\gdrv.sys
2010-08-20 05:29 . 2010-02-07 08:29 ——– d—–w- c:\program files\RegEditX
2010-08-16 22:06 . 2010-03-27 23:10 ——– d—–w- c:\program files\World of Warcraft Model Viewer
2010-08-12 01:42 . 2009-12-24 21:27 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-08-08 10:02 . 2010-03-22 04:51 ——– d—–w- c:\documents and settings\All Users\Application Data\FLEXnet
2010-08-08 09:51 . 2010-05-12 04:17 ——– d—–w- c:\documents and settings\All Users\Application Data\NOS
2010-08-08 06:31 . 2010-05-24 05:46 ——– d—–w- c:\documents and settings\All Users\Application Data\PMB Files
2010-08-06 20:43 . 2010-01-09 12:59 ——– d—–w- c:\program files\Common Files\Apple
2010-08-05 19:33 . 2010-01-10 15:15 23716 —ha-w- c:\windows\system32\mlfcache.dat
2010-08-01 21:50 . 2010-07-11 19:18 ——– d—–w- c:\program files\Electronic Arts
2010-07-28 22:38 . 2010-05-12 04:19 ——– d—–w- c:\program files\Google
2010-07-22 06:44 . 2010-07-22 06:44 ——– d—–w- c:\documents and settings\All Users\Application Data\Firefly Studios
2010-07-22 06:22 . 2009-12-27 05:40 98304 —-a-w- c:\windows\system32\CmdLineExt.dll
2010-07-22 06:17 . 2010-07-22 06:17 ——– d—–w- c:\program files\Firefly Studios
2010-07-22 01:28 . 2010-01-17 11:19 189480 —-a-w- c:\windows\system32\PnkBstrB.exe
2010-07-22 00:40 . 2010-01-17 11:19 137544 —-a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-07-17 22:16 . 2010-01-17 11:19 139152 —-a-w- c:\documents and settings\Administrator\Application Data\PnkBstrK.sys
2010-07-17 22:16 . 2010-01-17 11:19 139152 —-a-w- c:\documents and settings\Administrator\Application Data\PnkBstrK.sys
2010-07-17 22:16 . 2010-01-17 11:19 794408 —-a-w- c:\windows\system32\pbsvc.exe
2010-07-15 01:39 . 2010-07-15 01:39 21035 —-a-w- c:\windows\system32\drivers\AegisP.sys
2010-07-15 01:38 . 2009-12-24 21:27 ——– d—–w- c:\program files\NETGEAR
2010-07-12 23:56 . 2010-07-12 23:56 ——– d—–w- c:\documents and settings\All Users\Application Data\Electronic Arts
2010-07-11 19:28 . 2010-07-11 19:28 10134 —-a-r- c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2010-07-11 19:28 . 2010-07-11 19:28 ——– d—–w- c:\program files\Microsoft WSE
2010-07-11 13:49 . 2010-07-11 13:49 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-07-11 13:49 . 2010-07-11 13:49 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-07-11 13:49 . 2010-07-11 13:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-07-11 01:42 . 2009-12-24 20:06 ——– d—–w- c:\program files\EA GAMES
2010-07-06 08:07 . 2009-12-24 21:59 ——– d—–w- c:\program files\Realtek
2010-07-05 23:10 . 2010-07-05 23:02 ——– d—–w- c:\program files\Mount&Blade; Warband
2010-07-05 22:28 . 2010-06-30 02:16 ——– d—–w- c:\program files\Paradox Interactive
2010-07-02 19:15 . 2010-06-07 06:57 ——– d—–w- c:\documents and settings\All Users\Application Data\BioWare
2010-07-02 19:15 . 2010-06-07 06:24 ——– d—–w- c:\program files\Common Files\BioWare
2010-06-30 12:31 . 2004-08-04 12:00 149504 —-a-w- c:\windows\system32\schannel.dll
2010-06-26 06:52 . 2010-06-26 06:52 ——– d—–w- c:\documents and settings\Administrator\Application Data\NVIDIA
2010-06-26 00:42 . 2010-06-26 00:42 ——– d—–w- c:\documents and settings\Administrator\Application Data\Carambis
2010-06-26 00:33 . 2009-12-24 19:38 ——– d—–w- c:\program files\NVIDIA Corporation
2010-06-26 00:31 . 2009-12-24 19:39 ——– d—–w- c:\program files\AGEIA Technologies
2010-06-26 00:31 . 2009-12-24 19:39 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-06-26 00:31 . 2010-06-26 00:31 217180 —-a-w- c:\windows\system32\nvdrsdb0.bin
2010-06-26 00:31 . 2010-06-26 00:31 1 —-a-w- c:\windows\system32\nvdrssel.bin
2010-06-26 00:31 . 2010-06-26 00:31 217180 —-a-w- c:\windows\system32\nvdrsdb1.bin
2010-06-26 00:19 . 2010-06-26 00:19 23456 —-a-w- c:\windows\system32\drivers\DrvAgent32.sys
2010-06-26 00:15 . 2010-06-26 00:15 ——– d—–w- c:\program files\Driver-Soft
2010-06-26 00:12 . 2010-06-05 06:15 ——– d—–w- c:\documents and settings\Administrator\Application Data\IGN_DLM
2010-06-25 23:53 . 2010-06-25 23:53 ——– d—–w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2010-06-25 09:32 . 2010-06-05 20:17 ——– d—–w- c:\program files\7-Zip
2010-06-24 12:22 . 2004-08-04 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-06-23 16:39 . 2010-06-23 16:39 501936 —-a-w- c:\documents and settings\All Users\Application Data\Google\Google Toolbar\Update\gtb285.tmp.exe
2010-06-23 13:44 . 2004-08-04 12:00 1851904 —-a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2004-08-04 12:00 354304 —-a-w- c:\windows\system32\drivers\srv.sys
2010-06-17 14:03 . 2004-08-04 12:00 80384 —-a-w- c:\windows\system32\iccvid.dll
2010-06-15 07:02 . 2010-06-15 07:02 9164 —-a-w- c:\program files\unins000.dat
2010-06-15 07:02 . 2010-06-15 07:02 704282 —-a-w- c:\program files\unins000.exe
2010-06-14 14:31 . 2009-12-23 05:33 744448 —-a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
2010-06-14 07:41 . 2004-08-04 12:00 1172480 —-a-w- c:\windows\system32\msxml3.dll
2010-06-08 07:39 . 2010-06-08 07:39 503808 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-182aac27-n\msvcp71.dll
2010-06-08 07:39 . 2010-06-08 07:39 499712 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-182aac27-n\jmc.dll
2010-06-08 07:39 . 2010-06-08 07:39 348160 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-182aac27-n\msvcr71.dll
2010-06-08 07:39 . 2010-06-08 07:39 61440 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-27e188e3-n\decora-sse.dll
2010-06-08 07:39 . 2010-06-08 07:39 12800 —-a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-27e188e3-n\decora-d3d.dll
2010-06-08 00:34 . 2010-06-08 00:34 81920 —-a-w- c:\windows\system32\nvwddi.dll
2010-06-08 00:34 . 2010-06-08 00:34 277608 —-a-w- c:\windows\system32\nvmccs.dll
2010-06-08 00:34 . 2010-06-08 00:34 13902440 —-a-w- c:\windows\system32\nvcpl.dll
2010-06-08 00:34 . 2010-06-08 00:34 110696 —-a-w- c:\windows\system32\nvmctray.dll
2010-06-08 00:34 . 2010-06-08 00:34 154728 —-a-w- c:\windows\system32\nvsvc32.exe
2010-06-08 00:34 . 2010-06-08 00:34 145000 —-a-w- c:\windows\system32\nvcolor.exe
2010-06-07 23:57 . 2009-12-24 19:37 61440 —-a-w- c:\windows\system32\OpenCL.dll
2010-06-07 23:57 . 2009-12-24 19:37 4554752 —-a-w- c:\windows\system32\nvcuda.dll
2010-06-07 23:57 . 2009-12-24 19:37 2632296 —-a-w- c:\windows\system32\nvcuvenc.dll
2010-06-07 23:57 . 2009-12-24 19:37 2165352 —-a-w- c:\windows\system32\nvcuvid.dll
2010-06-07 23:57 . 2009-12-24 19:37 15192064 —-a-w- c:\windows\system32\nvoglnt.dll
2010-06-07 23:57 . 2009-12-24 19:37 232040 —-a-w- c:\windows\system32\nvcodins.dll
2010-06-07 23:57 . 2009-12-24 19:37 232040 —-a-w- c:\windows\system32\nvcod.dll
2010-06-07 23:57 . 2009-12-24 19:37 2186342 —-a-w- c:\windows\system32\nvdata.bin
2010-06-07 23:57 . 2009-12-24 19:37 1359872 —-a-w- c:\windows\system32\nvapi.dll
2010-06-07 23:57 . 2009-12-24 19:37 10256384 —-a-w- c:\windows\system32\nvcompiler.dll
2010-06-07 23:57 . 2009-12-24 18:58 10531200 —-a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-06-07 23:57 . 2008-04-14 00:12 6300544 —-a-w- c:\windows\system32\nv4_disp.dll
2009-11-20 04:08 . 2009-11-20 04:08 3749224 —-a-w- c:\program files\Common Files\adlmint_libFNP.dll
2009-11-20 04:08 . 2009-11-20 04:08 2941288 —-a-w- c:\program files\Common Files\adlmint.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-08-23_19.44.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-08-24 02:14 . 2010-08-24 02:14 16384 c:\windows\temp\Perflib_Perfdata_ac.dat
- 2010-08-23 19:28 . 2010-08-23 19:28 16384 c:\windows\temp\Perflib_Perfdata_ac.dat
+ 2010-08-24 02:15 . 2010-08-24 02:15 16384 c:\windows\temp\Perflib_Perfdata_300.dat
+ 2010-08-24 02:14 . 2010-08-24 02:14 16384 c:\windows\temp\Perflib_Perfdata_2a8.dat
+ 2010-08-24 02:15 . 2010-08-24 02:15 16384 c:\windows\temp\Perflib_Perfdata_1ec.dat
+ 2004-08-04 12:00 . 2010-08-24 02:19 71206 c:\windows\system32\perfc009.dat
- 2004-08-04 12:00 . 2010-08-23 19:31 71206 c:\windows\system32\perfc009.dat
- 2004-08-04 12:00 . 2010-08-23 19:31 441014 c:\windows\system32\perfh009.dat
+ 2004-08-04 12:00 . 2010-08-24 02:19 441014 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-02-05 00:50 1197448 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-05 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-02-05 1197448]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\steam\steam.exe" [2010-08-24 1242448]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2007-08-30 205480]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-05-27 322352]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-05-12 39408]
"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2009-03-28 3325952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-03-18 207360]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2009-02-03 111856]
"BCU"="c:\program files\DeviceVM\Browser Configuration Utility\BCU.exe" [2009-08-05 346320]
"RTHDCPL"="RTHDCPL.EXE" [2009-08-14 18702336]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-03-07 236016]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-06-03 1753192]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-06-08 13902440]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-06-08 110696]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-19 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-10-30 282624]
NETGEAR WG111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WG111v2\WG111v2.exe [2010-7-14 1268192]
WG111v2 Smart Wizard Wireless Setting.lnk - c:\program files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2009-12-24 745472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Mount&Blade; Warband\\mb_warband.exe"=
"c:\\Program Files\\Aspyr\\Men of War\\mow.exe"=
"c:\\Program Files\\Firefly Studios\\Stronghold 2\\Stronghold2.exe"=
"c:\\Program Files\\Steam\\steamapps\\lunthegun\\team fortress 2 meet the sniper\\smp.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"c:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"c:\\Program Files\\Autodesk\\Maya2011\\bin\\maya.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57354:TCP"= 57354:TCP:Pando Media Booster
"57354:UDP"= 57354:UDP:Pando Media Booster
"1033:TCP"= 1033:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1107000.00C\symds.sys [5/20/2010 9:34 PM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1107000.00C\symefa.sys [5/20/2010 9:34 PM 173104]
R1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20100810.004\BHDrvx86.sys [8/9/2010 6:11 PM 692272]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1107000.00C\cchpx86.sys [5/20/2010 9:34 PM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1107000.00C\ironx86.sys [5/20/2010 9:34 PM 116784]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [8/4/2004 5:00 AM 14336]
R2 BCUService;Browser Configuration Utility Service;c:\program files\DeviceVM\Browser Configuration Utility\BCUService.exe [1/8/2010 11:57 AM 219360]
R2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\drivers\EAPPkt.sys [12/24/2009 2:27 PM 66048]
R2 ES lite Service;ES lite Service for program management.;c:\program files\Gigabyte\EasySaver\essvr.exe [1/8/2010 11:57 AM 68136]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.7.0.12\ccsvchst.exe [5/20/2010 9:34 PM 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [5/27/2010 4:22 PM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20100820.001\IDSXpx86.sys [8/22/2010 7:30 PM 331640]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\drivers\wg111v2.sys [12/24/2009 2:27 PM 272128]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5/11/2010 10:03 PM 135664]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [12/24/2009 2:59 PM 1684736]
S3 DrvAgent32;DrvAgent32;c:\windows\system32\drivers\DrvAgent32.sys [6/25/2010 5:19 PM 23456]
S3 pohci13F;pohci13F;\??\c:\docume~1\ADMINI~1\LOCALS~1\Temp\pohci13F.sys –> c:\docume~1\ADMINI~1\LOCALS~1\Temp\pohci13F.sys [?]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [5/8/2010 11:05 AM 697328]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Contents of the 'Scheduled Tasks' folder

2010-08-18 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34]

2010-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-12 05:03]

2010-08-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-12 05:03]

2010-08-23 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2010-02-05 00:50]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.youtube.com/
mStart Page = hxxp://www.yahoo.com/?fr=fp-tyc8
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.1.71.0.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\s1b2wwe3.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.youtube.com/
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\IPSFFPlgn\components\IPSFFPl.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-08-23 20:03
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.7.0.12\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.7.0.12\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-583907252-926492609-839522115-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,42,4e,80,00,8e,9e,53,4e,9a,08,99,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,42,9f,99,a9,64,4b,fc,46,b3,ef,8d,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,42,4e,80,00,8e,9e,53,4e,9a,08,99,\
.
Completion time: 2010-08-23 20:05:42
ComboFix-quarantined-files.txt 2010-08-24 03:05
ComboFix2.txt 2010-08-23 19:46

Pre-Run: 21,186,703,360 bytes free
Post-Run: 21,185,495,040 bytes free

- - End Of File - - BCC48823B45962D4649EF32EF1880472
Post #14
good, that appears to have fixed it

please do the following:

  • Please open your MalwareBytes AntiMalware Program
  • Click the Update Tab and search for updates
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish, so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected. <– very important
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT

**Vista/Win7 users - right click on the IE icon and run as administrator

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
Post #15
Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4468 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 8/23/2010 8:29:02 PM mbam-log-2010-08-23 (20-29-02).txt Scan type: Quick scan Objects scanned: 129073 Time elapsed: 6 minute(s), 5 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Tuesday, August 24, 2010 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Monday, August 23, 2010 14:43:11 Records in database: 4138022 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: A:\ C:\ D:\ Scan statistics: Objects scanned: 159987 Threats found: 2 Infected objects found: 13 Suspicious objects found: 0 Scan duration: 05:24:55 File name / Threat / Threats count C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\0\3a9c5000-1b832c08 Infected: Exploit.Java.Agent.bu 1 C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\10\653a8b4a-3d7a44eb Infected: Exploit.Java.Agent.bu 1 C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\23\160ba957-2598d8f2 Infected: Exploit.Java.Agent.bu 2 C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\31\743fee9f-4b50e48a Infected: Exploit.Java.Agent.bu 2 C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\34\187b0ca2-6b0f1c3b Infected: Exploit.Java.Agent.bu 1 C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\35\41e8aee3-288f4c29 Infected: Exploit.Java.Agent.bu 1 C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\37\170f8765-43a86cc9 Infected: Exploit.Java.Agent.bu 1 C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\43\752509ab-1960cc25 Infected: Exploit.Java.Agent.bu 1 C:\Documents and Settings\Administrator\Application Data\Sun\Java\Deployment\cache\6.0\48\4084a7b0-3f4abc69 Infected: Exploit.Java.Agent.bu 2 C:\Program Files\World of Warcraft Model Viewer\wowmodelview.exe Infected: not-a-virus:AdWare.Win32.AdMedia.iq 1 Selected area has been scanned.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI