Spyware / Malware / Virus Removal

script errors and blue screen restarts

2 min read

Looking for the outcome? Ask AI

Mjr woodie460 Topic Starter

Post #1May 16, 2011, 12:33 PM UTC

please help me with this issue . this is a diagnostic laptop use to diagnos our fleet trucks . this laptop has different user and abuse the privilage of having it. i am have a lot of script errors with various web addresses displayed in the error box. i am also having a critical error screen come up with a system memory dump and have to restart . please help me with a setup to stop missuse of laptop. here is the otl and hjt logs .

OTL logfile created on: 5/16/2011 7:15:58 AM - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Tom Nesbitt\My Documents
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 229.00 Mb Available Physical Memory | 22.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.78 Gb Total Space | 95.41 Gb Free Space | 85.36% Space Free | Partition Type: NTFS

Computer Name: BFW-FLEET3300 | User Name: Tom Nesbitt | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Tom Nesbitt\My Documents\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Java\jre6\bin\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Cummins Inc\UpdateManager\UpdateService.exe (Cummins Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
PRC - C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
PRC - C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)
PRC - C:\WINDOWS\system32\RAMAsst.exe (Matsushita Electric Industrial Co., Ltd.)
PRC - C:\NEXIQ\BTConnectUtility\BTIcon.exe (NEXIQ Technologies, Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Tom Nesbitt\My Documents\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (CumminsUpdateService) – C:\Program Files\Cummins Inc\UpdateManager\UpdateService.exe (Cummins Inc.)
SRV - (SavRoam) – C:\Program Files\Symantec AntiVirus\SavRoam.exe (symantec)
SRV - (Symantec AntiVirus) – C:\Program Files\Symantec AntiVirus\Rtvscan.exe (Symantec Corporation)
SRV - (DefWatch) – C:\Program Files\Symantec AntiVirus\DefWatch.exe (Symantec Corporation)
SRV - (LiveUpdate) – C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)
SRV - (SNDSrvc) – C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (Symantec Corporation)
SRV - (SPBBCSvc) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe (Symantec Corporation)
SRV - (ccSetMgr) – C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (Symantec Corporation)
SRV - (ccEvtMgr) – C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (Symantec Corporation)
SRV - (DVD-RAM_Service) – C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.)

========== Driver Services (SafeList) ==========

DRV - (NAVEX15) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20110211.006\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) – C:\Program Files\Common Files\Symantec Shared\VirusDefs\20110211.006\NAVENG.SYS (Symantec Corporation)
DRV - (SymEvent) – C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (WinDriver6) – C:\WINDOWS\system32\drivers\windrvr6.sys (Jungo)
DRV - (SYMTDI) – C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (SYMREDRV) – C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SPBBCDrv) – C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (NETw4x32) Intel® – C:\WINDOWS\system32\drivers\NETw4x32.sys (Intel Corporation)
DRV - (meiudf) – C:\WINDOWS\system32\drivers\meiudf.sys (Matsushita Electric Industrial Co.,Ltd.)
DRV - (SAVRT) – C:\Program Files\Symantec AntiVirus\savrt.sys (Symantec Corporation)
DRV - (SAVRTPEL) – C:\Program Files\Symantec AntiVirus\Savrtpel.sys (Symantec Corporation)
DRV - (Ser2pl) – C:\WINDOWS\system32\drivers\ser2pl.sys (Prolific Technology Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2008/04/13 18:00:00 | 000,000,734 | -H– | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [NEXIQ BTConnectIcon] C:\NEXIQ\BTConnectUtility\BTIcon.exe (NEXIQ Technologies, Inc.)
O4 - HKLM..\Run: [vptray] C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk = C:\WINDOWS\system32\RAMAsst.exe (Matsushita Electric Industrial Co., Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1287177317250 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_10)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 172.18.2.10 [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = beer.bekco.com
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/10/15 13:57:42 | 000,000,000 | -H– | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{1df4bf97-d88f-11df-93cc-a65bcf10934f}\Shell\AutoRun\command - "" = E:\CA_EdgeLitemobile.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2011/05/16 07:03:51 | 000,000,000 | —D | C] – C:\Documents and Settings\Tom Nesbitt\Start Menu\Programs\HiJackThis
[2011/05/16 06:25:59 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Tom Nesbitt\My Documents\OTL.exe
[2011/05/12 10:05:01 | 000,195,424 | —- | C] (Jungo) – C:\WINDOWS\System32\drivers\windrvr6.sys
[2011/05/12 10:05:01 | 000,000,000 | —D | C] – C:\WINDOWS\System32\DRVSTORE
[2011/05/12 10:04:54 | 000,143,360 | —- | C] (Jungo) – C:\WINDOWS\System32\wdapi1010.dll
[2011/05/12 10:04:54 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\NEXIQ
[2011/05/12 10:04:54 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Nexiq
[2011/05/12 10:04:52 | 000,000,000 | —D | C] – C:\Program Files\NEXIQ
[2011/05/12 10:04:51 | 000,143,360 | —- | C] (Snap-on Inc) – C:\WINDOWS\System32\NXULUJ32.DLL
[2011/05/12 10:04:51 | 000,143,360 | —- | C] (Snap-on Inc) – C:\WINDOWS\System32\NXULBJ32.DLL
[2011/05/12 10:04:51 | 000,139,264 | —- | C] (NEXIQ Technologies, Inc.) – C:\WINDOWS\System32\OsAbstraction.dll
[2011/05/12 10:04:51 | 000,131,072 | —- | C] (NEXIQ Technologies, INC.) – C:\WINDOWS\System32\NU253432.dll
[2011/05/12 10:04:51 | 000,131,072 | —- | C] (NEXIQ Technologies, INC.) – C:\WINDOWS\System32\NB253432.dll
[2011/05/12 10:04:51 | 000,094,208 | —- | C] (Snap-on Inc) – C:\WINDOWS\System32\NXULNK32.dll
[2011/05/12 10:04:46 | 000,000,000 | —D | C] – C:\NEXIQ
[2011/05/12 10:01:23 | 000,000,000 | —D | C] – C:\Documents and Settings\Tom Nesbitt\Application Data\Help
[2011/05/12 09:59:47 | 000,000,000 | —D | C] – C:\Documents and Settings\Tom Nesbitt\Application Data\Sun
[2011/05/02 07:06:33 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2011/05/02 07:06:33 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\HijackThis
[2011/04/25 20:34:50 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe
[2011/04/25 20:17:35 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Adobe
[2011/04/25 20:17:34 | 000,000,000 | —D | C] – C:\Program Files\Adobe
[2011/04/25 20:17:32 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Adobe AIR
[2011/04/25 20:15:00 | 000,000,000 | —D | C] – C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2011/04/25 20:10:05 | 000,000,000 | —D | C] – C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
[2011/04/25 20:09:26 | 000,000,000 | —D | C] – C:\Program Files\Google
[2011/04/25 20:09:26 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Google
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/05/16 07:15:00 | 000,000,884 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/05/16 07:03:51 | 000,001,996 | —- | M] () – C:\Documents and Settings\Tom Nesbitt\Desktop\HiJackThis.lnk
[2011/05/16 07:03:38 | 001,402,880 | —- | M] () – C:\Documents and Settings\Tom Nesbitt\My Documents\HiJackThis.msi
[2011/05/16 07:01:00 | 000,000,234 | -H– | M] () – C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job
[2011/05/16 06:36:37 | 000,013,646 | -H– | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/05/16 06:36:36 | 000,000,880 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/05/16 06:26:00 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Tom Nesbitt\My Documents\OTL.exe
[2011/05/16 06:11:22 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/05/12 10:04:54 | 000,000,062 | —- | M] () – C:\WINDOWS\RP121032.ini
[2011/04/25 20:35:29 | 000,001,734 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/05/16 07:03:51 | 000,001,996 | —- | C] () – C:\Documents and Settings\Tom Nesbitt\Desktop\HiJackThis.lnk
[2011/05/16 07:03:03 | 001,402,880 | —- | C] () – C:\Documents and Settings\Tom Nesbitt\My Documents\HiJackThis.msi
[2011/05/12 10:04:48 | 000,016,192 | —- | C] () – C:\WINDOWS\NXULNK32_internal.ini
[2011/05/12 10:04:48 | 000,005,265 | —- | C] () – C:\WINDOWS\usblmap.ini
[2011/05/12 10:04:48 | 000,004,929 | —- | C] () – C:\WINDOWS\NXULNK32.ini
[2011/05/12 10:04:48 | 000,000,276 | —- | C] () – C:\WINDOWS\BTConnectUtility.ini
[2011/04/25 20:35:29 | 000,001,804 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/04/25 20:35:29 | 000,001,734 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/04/25 20:10:02 | 000,000,884 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/04/25 20:10:02 | 000,000,880 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/03/30 11:40:04 | 000,000,863 | —- | C] () – C:\WINDOWS\UDIF32.ini
[2011/03/17 11:48:44 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2011/03/17 11:32:50 | 000,000,128 | —- | C] () – C:\Documents and Settings\All Users\Application Data\~19783476r
[2011/03/17 11:32:50 | 000,000,080 | —- | C] () – C:\Documents and Settings\All Users\Application Data\~19783476
[2011/03/17 11:32:42 | 000,000,400 | —- | C] () – C:\Documents and Settings\All Users\Application Data\19783476
[2010/11/11 23:15:17 | 000,000,000 | —- | C] () – C:\WINDOWS\vpc32.INI
[2010/10/28 14:49:29 | 000,001,033 | —- | C] () – C:\WINDOWS\IC4USB32.ini
[2010/10/28 14:49:22 | 000,000,062 | —- | C] () – C:\WINDOWS\RP121032.ini
[2010/10/18 13:54:43 | 000,000,032 | —- | C] () – C:\WINDOWS\CD_Start.INI
[2010/10/15 14:13:07 | 000,204,800 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2010/10/15 14:13:07 | 000,200,704 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2010/10/15 14:13:07 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2010/10/15 14:13:07 | 000,192,512 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2010/10/15 14:13:07 | 000,188,416 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2010/10/15 14:13:07 | 000,020,480 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2010/10/15 14:00:46 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2010/10/15 13:55:02 | 000,021,640 | -H– | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2010/10/15 08:22:20 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2010/10/15 08:21:14 | 000,094,272 | -H– | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2009/04/15 18:50:14 | 000,000,068 | —- | C] () – C:\WINDOWS\reflsh32.ini
[2008/04/13 18:00:00 | 000,673,088 | -H– | C] () – C:\WINDOWS\System32\mlang.dat
[2008/04/13 18:00:00 | 000,441,692 | -H– | C] () – C:\WINDOWS\System32\perfh009.dat
[2008/04/13 18:00:00 | 000,272,128 | -H– | C] () – C:\WINDOWS\System32\perfi009.dat
[2008/04/13 18:00:00 | 000,218,003 | -H– | C] () – C:\WINDOWS\System32\dssec.dat
[2008/04/13 18:00:00 | 000,071,462 | -H– | C] () – C:\WINDOWS\System32\perfc009.dat
[2008/04/13 18:00:00 | 000,046,258 | -H– | C] () – C:\WINDOWS\System32\mib.bin
[2008/04/13 18:00:00 | 000,028,626 | -H– | C] () – C:\WINDOWS\System32\perfd009.dat
[2008/04/13 18:00:00 | 000,004,569 | -H– | C] () – C:\WINDOWS\System32\secupd.dat
[2008/04/13 18:00:00 | 000,001,804 | -H– | C] () – C:\WINDOWS\System32\Dcache.bin
[2008/04/13 18:00:00 | 000,000,741 | -H– | C] () – C:\WINDOWS\System32\noise.dat
[2007/03/13 21:30:04 | 003,107,788 | -H– | C] () – C:\WINDOWS\System32\ativvaxx.dat
[2007/03/06 18:04:54 | 000,143,676 | -H– | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2005/04/14 22:52:33 | 013,107,200 | -H– | C] () – C:\WINDOWS\System32\oembios.bin
[2005/04/14 22:52:33 | 000,004,627 | -H– | C] () – C:\WINDOWS\System32\oembios.dat
[2000/03/29 22:00:00 | 000,125,440 | —- | C] () – C:\WINDOWS\System32\UNZDLL.DLL
[1999/10/23 18:29:44 | 000,053,248 | —- | C] () – C:\WINDOWS\System32\UNRAR.DLL
[1999/08/11 15:28:02 | 000,101,888 | —- | C] () – C:\WINDOWS\System32\LIBBZ2.DLL
[1999/05/21 21:10:00 | 000,129,024 | —- | C] () – C:\WINDOWS\System32\ZIPDLL.DLL
[1998/01/28 00:06:04 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\UNACE.DLL

========== LOP Check ==========

[2011/05/16 06:12:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Cummins_Inc
[2011/05/12 10:04:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Nexiq
[2011/05/16 07:01:00 | 000,000,234 | -H– | M] () – C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job

========== Purity Check ==========

========== Custom Scans ==========

< >

< %SYSTEMDRIVE%\*.* >
[2011/03/30 11:51:04 | 000,000,086 | —- | M] () – C:\a.b
[2010/10/15 13:57:42 | 000,000,000 | -H– | M] () – C:\AUTOEXEC.BAT
[2010/10/15 13:53:28 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2010/10/15 13:57:42 | 000,000,000 | -H– | M] () – C:\CONFIG.SYS
[2010/10/15 13:57:42 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2010/10/15 13:57:42 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008/04/13 18:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/04/13 18:00:00 | 000,250,048 | RHS- | M] () – C:\ntldr
[2011/05/16 06:11:16 | 1610,612,736 | -HS- | M] () – C:\pagefile.sys

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | -H– | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | -H– | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | -H– | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | -H– | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2010/10/15 13:57:26 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 05:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2010/10/15 08:20:19 | 000,094,208 | -H– | M] () – C:\WINDOWS\system32\config\default.sav
[2010/10/15 08:20:19 | 001,089,536 | -H– | M] () – C:\WINDOWS\system32\config\software.sav
[2010/10/15 08:20:19 | 000,925,696 | -H– | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2010/10/15 13:57:43 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/10/15 14:05:16 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Tom Nesbitt\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2010/10/15 14:05:16 | 000,000,079 | -H– | M] () – C:\Documents and Settings\Tom Nesbitt\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< >

< End of report >

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:30:07 AM, on 5/16/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Cummins Inc\UpdateManager\UpdateService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\NEXIQ\BTConnectUtility\BTIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RAMAsst.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Tom Nesbitt\My Documents\OTL.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NEXIQ BTConnectIcon] C:\NEXIQ\BTConnectUtility\BTIcon.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMAsst.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1287177317250
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = beer.bekco.com
O17 - HKLM\Software\..\Telephony: DomainName = beer.bekco.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = beer.bekco.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = beer.bekco.com
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Cummins Update Service (CumminsUpdateService) - Cummins Inc. - C:\Program Files\Cummins Inc\UpdateManager\UpdateService.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

–
End of file - 6305 bytes

Mjr woodie460

Post #2May 16, 2011, 7:22 PM UTC

here is the missing part of the otl scan

OTL Extras logfile created on: 5/16/2011 6:47:27 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Fleet\My Documents
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,022.00 Mb Total Physical Memory | 282.00 Mb Available Physical Memory | 28.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 80.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.78 Gb Total Space | 95.49 Gb Free Space | 85.43% Space Free | Partition Type: NTFS

Computer Name: BFW-FLEET3300 | User Name: xxxxxxxxxxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] – rundll32.exe shdocvw.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
InternetShortcut [open] – rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{2085C617-589C-40F8-BE40-EDBC9E2CA2EB}" = Symantec AntiVirus
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java™ 6 Update 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7684CC67-32BD-4260-93CE-61094F3E85DD}" = INSITE
"{8718A2BC-7E23-4D23-969A-2A2EC9E45B0E}" = IC4 Interface Device by SU Enterprise, Inc.
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{9D765FA6-F2BC-40AF-8145-50808F9BDF4E}" = DVD-RAM Driver
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-AA0000000001}" = Adobe Reader X (10.0.1)
"{AD044254-C8D2-4866-9449-890EF278617B}" = CPU Idle Setting
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D62085AC-B32F-48EC-991D-8BB740682B0D}" = Cummins Inc. Update Manager
"ACB-DataLog_is1" = ACB-DataLog v1.0.8.0
"ACB-Diagnostics_is1" = ACB-Diagnostics v1.0.6.0
"ACom5_is1" = ACom5 v5.10.1.0
"ACom6 Pack_is1" = ACom6 Pack v6.3.8.0
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"ATI Display Driver" = ATI Display Driver
"HijackThis" = HijackThis 2.0.2
"ie8" = Windows Internet Explorer 8
"InstallShield_{7684CC67-32BD-4260-93CE-61094F3E85DD}" = INSITE
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"NEXIQ USB-Link" = NEXIQ USB-Link
"PowerArchiver" = PowerArchiver
"PROSet" = Intel® PRO Network Connections Drivers
"Sw2UDIF_is1" = Sw2UDIF v1.5.0.4
"TABS6-ADV_is1" = TABS6-ADV v1.2.9.1

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/16/2011 3:38:11 PM | Computer Name = BFW-FLEET3300 | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 updateservice.exe, P2 [removed], P3 4d2f1c83,
P4 updateservice, P5 2.1.2.3, P6 4d2f1c83, P7 2, P8 0, P9 system.io.filenotfoundexception,
P10 NIL.

Error - 3/16/2011 5:40:14 PM | Computer Name = BFW-FLEET3300 | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 updateservice.exe, P2 [removed], P3 4d2f1c83,
P4 updateservice, P5 2.1.2.3, P6 4d2f1c83, P7 2, P8 0, P9 system.io.filenotfoundexception,
P10 NIL.

Error - 3/17/2011 11:22:28 AM | Computer Name = BFW-FLEET3300 | Source = Userenv | ID = 1054
Description = Windows cannot obtain the domain controller name for your computer
network. (The specified domain either does not exist or could not be contacted.
). Group Policy processing aborted.

Error - 3/17/2011 11:22:29 AM | Computer Name = BFW-FLEET3300 | Source = AutoEnrollment | ID = 15
Description = Automatic certificate enrollment for local system failed to contact
the active directory (0x8007054b). The specified domain either does not exist
or could not be contacted. Enrollment will not be performed.

Error - 3/17/2011 11:22:30 AM | Computer Name = BFW-FLEET3300 | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 updateservice.exe, P2 [removed], P3 4d2f1c83,
P4 updateservice, P5 2.1.2.3, P6 4d2f1c83, P7 2, P8 0, P9 system.io.filenotfoundexception,
P10 NIL.

Error - 3/17/2011 12:11:43 PM | Computer Name = BFW-FLEET3300 | Source = MsiInstaller | ID = 11704
Description = Product: EZ Fonts – Error 1704. An installation for Cummins Inc.
Update Manager is currently suspended. You must undo the changes made by that installation
to continue. Do you want to undo those changes?

Error - 3/17/2011 12:24:05 PM | Computer Name = BFW-FLEET3300 | Source = Symantec AntiVirus | ID = 16711726
Description = Security Risk Found!Risk: Bloodhound.Exploit.385 in File: C:\Documents
and Settings\Fleet\Local Settings\Temp\jar_cache53054.tmp by: Auto-Protect scan.
Action: Quarantine succeeded. Action Description: The file was quarantined successfully.

Error - 3/17/2011 12:24:05 PM | Computer Name = BFW-FLEET3300 | Source = Symantec AntiVirus | ID = 16711685
Description = Risk Found!Risk: Bloodhound.Exploit.385 in File: C:\Documents and
Settings\Fleet\Local Settings\Temp\jar_cache53054.tmp by: Auto-Protect scan. Action:
Quarantine succeeded : Access denied. Action Description: The file was quarantined
successfully.

Error - 3/17/2011 12:24:05 PM | Computer Name = BFW-FLEET3300 | Source = Symantec AntiVirus | ID = 16711731
Description = Security Risk Found!Risk: Bloodhound.Exploit.385 in File: C:\Documents
and Settings\Fleet\Local Settings\Temp\jar_cache53054.tmp by: Auto-Protect scan.
Action: Quarantine succeeded : Access denied. Action Description: The file was
quarantined successfully.

Error - 3/17/2011 12:39:56 PM | Computer Name = BFW-FLEET3300 | Source = .NET Runtime 2.0 Error Reporting | ID = 5000
Description = EventType clr20r3, P1 updateservice.exe, P2 [removed], P3 4d2f1c83,
P4 updateservice, P5 2.1.2.3, P6 4d2f1c83, P7 2, P8 0, P9 system.io.filenotfoundexception,
P10 NIL.

[ System Events ]
Error - 5/12/2011 11:03:28 AM | Computer Name = BFW-FLEET3300 | Source = NETLOGON | ID = 5776
Description = Failed to create/open file \system32\config\netlogon.ftl with the
following error: %%5

Error - 5/12/2011 11:06:54 AM | Computer Name = BFW-FLEET3300 | Source = NETLOGON | ID = 5776
Description = Failed to create/open file \system32\config\netlogon.ftl with the
following error: %%5

Error - 5/12/2011 11:16:45 AM | Computer Name = BFW-FLEET3300 | Source = NETLOGON | ID = 5776
Description = Failed to create/open file \system32\config\netlogon.ftl with the
following error: %%5

Error - 5/12/2011 5:24:51 PM | Computer Name = BFW-FLEET3300 | Source = NETLOGON | ID = 5776
Description = Failed to create/open file \system32\config\netlogon.ftl with the
following error: %%5

Error - 5/12/2011 5:57:56 PM | Computer Name = BFW-FLEET3300 | Source = NETLOGON | ID = 5776
Description = Failed to create/open file \system32\config\netlogon.ftl with the
following error: %%5

Error - 5/13/2011 12:05:06 AM | Computer Name = BFW-FLEET3300 | Source = NETLOGON | ID = 5776
Description = Failed to create/open file \system32\config\netlogon.ftl with the
following error: %%5

Error - 5/13/2011 5:29:02 PM | Computer Name = BFW-FLEET3300 | Source = NETLOGON | ID = 5776
Description = Failed to create/open file \system32\config\netlogon.ftl with the
following error: %%5

Error - 5/13/2011 6:38:12 PM | Computer Name = BFW-FLEET3300 | Source = NETLOGON | ID = 5776
Description = Failed to create/open file \system32\config\netlogon.ftl with the
following error: %%5

Error - 5/16/2011 7:11:36 AM | Computer Name = BFW-FLEET3300 | Source = NETLOGON | ID = 5776
Description = Failed to create/open file \system32\config\netlogon.ftl with the
following error: %%5

Error - 5/16/2011 7:12:41 AM | Computer Name = BFW-FLEET3300 | Source = Windows Update Agent | ID = 16
Description = Unable to Connect: Windows is unable to connect to the automatic updates
service and therefore cannot download and install updates according to the set
schedule. Windows will continue to try to establish a connection.

< End of report >

Tomk

Post #3May 18, 2011, 8:17 PM UTC

Mjr woodie460,

Per the sites Terms of Use:

We offer free computer help and tech support for home and personal use. We are not here to support others that work for profit, or to support/replace your company's IT department.

From the information you have posted, and the log provided, it is obvious that this is a corporate computer. The computer also has some specialized programs that may or may not react "strangely" with the tools we use. As I hope you are aware, there is always a risk involved in malware removal or "tweaking" of a computer system and therefore the person we help must have the authority to modify the system. In the corporate world, that authority is typically vested in the IT department.

It would not appear that it would be feasible for us to "mess" with this computer. I suggest you contact your IT department - if such exists. If not, I suggest you contact whomever maintains your network.

Mjr woodie460

Post #4May 18, 2011, 10:07 PM UTC

Thanks for the reply . Yes this is a business computer . My I T guy is useless. The last time I had him do something to the laptop it lasted about a month and then crashed completely , he wiped it out and installed new harddrive. All programs lost. If it looks as if it has a virus or spyware let me know so I can tell him. He is not very popular around our area. I am not going to try to remove it with out being told to, but if u still cannot help me I thank you anyway .

Tomk

Post #5May 18, 2011, 11:18 PM UTC

From the information I have… I don't see obvious malware but that doesn't always mean you don't have any. Further digging could identify something. You have out-of -date programs. Often… wiping the drive and starting over is the fastest way to handle the situation. That is why it is so often used in the business world. Up and running in a few hours vs days of malware hunting…. and time is money. If you have a good backup system in place… it shouldn't be that hard to reinstall the programs. Good luck.

Tomk

Post #6May 18, 2011, 11:18 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

script errors and blue screen restarts

✨ Ask AI

Ask AI