What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

infectected? don't know! logon takes forever!

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
folks,

ok, my tale of woe, and what i've done so far>

1. setup: dell inspiron 1525 running dual boot with vista (never use it) and wxp/sp3; the xp partition is 24gb with 6gb free and 2gb swap space (defrag run several times and says no longer needed to defrag again)
2.setup: outlook files, data files, etc etc on 180gb partition with 150gb free
3. setup: running avast free anti-virus, outpost firewall pro, malwarebytes (i think i have the exclusions for each of these set up correctly, but not sure)
4. setup: use verizon wireless access with usb modem for the laptop

5. woe: after logon, HDD lite stays on for at least 75sec; if you try to start verizon access manager during this time, it sits and waits for lites out
6. woe: i had r2 studios start-up delayer running, to load outpost firewall pro after 5sec delay, then avast free anti-virus after 10sec delay – makes no difference
7. woe: i also closed off everything in msconfig 'startup' except for igfxtray, systray, op_mon, ctfmon and that makes no difference

so, i followed the hijackthis instructions and here's the logfile:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:36:32 PM, on 10/10/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\WLTRYSVC.EXE
E:\WINDOWS\System32\bcmwltry.exe
E:\Program Files\Alwil Software\Avast5\AvastSvc.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Dell\Dell Mobile Broadband\systray.exe
E:\Program Files\Common Files\Java\Java Update\jusched.exe
E:\WINDOWS\system32\igfxpers.exe
E:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
E:\WINDOWS\system32\igfxsrvc.exe
E:\Program Files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe
E:\WINDOWS\system32\hkcmd.exe
E:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe
E:\WINDOWS\system32\WLTRAY.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
E:\WINDOWS\system32\LEXBCES.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Brother\BRAdmin Professional 3\bratimer.exe
E:\Program Files\Java\jre6\bin\jqs.exe
E:\WINDOWS\system32\ptumlcmsvc.exe
E:\Program Files\Macrium\Reflect\ReflectService.exe
E:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\STacSV.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\WinZip System Utilities Suite\WINZIPSSDefragSrv.exe
E:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
E:\Program Files\HiJackThis\Trend Micro\HiJackThis\HiJackThis.exe
E:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://jubakpicks.com/?gclid=CIjPuvuS3Z0CFQtN5QodzzT1MQ
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - E:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - E:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - E:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - E:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: MSN Toolbar - {8dcb7100-df86-4384-8842-8fa844297b3f} - E:\Program Files\MSN Toolbar\Platform\4.0.0379.0\npwinext.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - E:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IgfxTray] E:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [systray] "E:\Program Files\Dell\Dell Mobile Broadband\systray.exe"
O4 - HKLM\..\Run: [OutpostMonitor] "E:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe" /tray /noservice
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Persistence] E:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Nikon Transfer Monitor] E:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O4 - HKLM\..\Run: [MSN Toolbar] "E:\Program Files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe"
O4 - HKLM\..\Run: [Microsoft Default Manager] "E:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
O4 - HKLM\..\Run: [HotKeysCmds] E:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Google Quick Search Box] "E:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
O4 - HKLM\..\Run: [eCopyPWPrntHlpr] "E:\Program Files\eCopy\PaperWorks\Bin\eCopyPWPrntHlpr.exe"
O4 - HKLM\..\Run: [eCopy Scan Inbox Monitor] "E:\Program Files\eCopy\PaperWorks\Bin\InboxMonitor.exe" -run
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] E:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Adobe ARM] "E:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [ctfmon.exe] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RoboForm] "E:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [DriverScanner] "E:\Program Files\Uniblue\DriverScanner\launcher.exe" delay 20000
O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "E:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "E:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
O8 - Extra context menu item: Customize Menu - file://E:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://E:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Google Sidewiki… - res://E:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
O8 - Extra context menu item: RoboForm Toolbar - file://E:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://E:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://E:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://E:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://E:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://E:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - E:\Program Files\Agnitum\Outpost Firewall Pro\ie_bar.dll
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://E:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://E:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - E:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - E:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: E:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://www.standardandpoors.com
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlcdnet.asus.com/pub/ASUS/misc/dlm-…vex-2.2.5.0.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1271299514406
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - E:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O20 - AppInit_DLLs: e:\progra~1\agnitum\outpos~1\wl_hook.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - E:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - E:\WINDOWS\System32\browseui.dll
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - E:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe
O23 - Service: avast! Antivirus - AVAST Software - E:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Brother BRAdminPro Scheduler (BRA_Scheduler) - Unknown owner - E:\Program Files\Brother\BRAdmin Professional 3\bratimer.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - E:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - E:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - E:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: PTUML290 Connection Manager Service (ptumlcmsvc) - DEVGURU Co., LTD - E:\WINDOWS\system32\ptumlcmsvc.exe
O23 - Service: Macrium Reflect Image Mounting Service (ReflectService) - Unknown owner - E:\Program Files\Macrium\Reflect\ReflectService.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - E:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\STacSV.exe
O23 - Service: WINZIPSSDiskOptimizer - WinZip Computing, S.L. (WinZip Computing) - E:\Program Files\WinZip System Utilities Suite\WINZIPSSDefragSrv.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - E:\WINDOWS\System32\WLTRYSVC.EXE

–
End of file - 11681 bytes

first time filing with whattehtech so i hope i did this right.
thanks for your help.
ron
Post #2

**In any case where you happen to be busy or unable to give us a reply, we would be grateful if you keep us informed in advance and we will be more than happy to wait. Failure to do so we will have your thread closed in THREE(3) days. :)


Hello there, Ron

:welcome:

I'm Conspire, I'll be glad to help you with your computer problems.

Please observe these rules while we work:
  • Read the entire procedure
  • It is important to perform ALL actions in sequence.
  • If you don't know, stop and ask! Don't keep going on.
  • Please reply to this thread. Do not start a new topic.
  • Stick with me till you're given the all clear.
  • Remember, absence of symptoms does not mean the infection is all gone.
  • Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.

IMPORTANT NOTE : Please do not delete anything unless instructed to. Remember to backup all your important data(if possible) before moving on.
Post #3
Hello there,

Download OTL to your Desktop
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Click on Minimal Output at the top
  • Download the following file scan.txt to your Desktop. Click here to download it. You may need to right click on it and select "Save"
  • Double click inside the Custom Scan box at the bottom
  • A window will appear saying "Click OK to load a custom scan from a file or Cancel to cancel"
  • Click the OK button and navigate to the file scan.txt which we just saved to your desktop
  • Select scan.txt and click Open. Writing will now appear under the Custom Scan box
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic
===================================================

[external image: Posted Image]
  • Please download GMER from one of the following locations, and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zip Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Extract the contents of the zipped file to desktop (applicable only to Zip mirror) .
  • Double click [external image: Posted Image] or [external image: Posted Image] on your desktop.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
    [external image: Posted Image]

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

===================================================

Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
===================================================

On your next reply please post :
OTL log
GMER log
Checkup log

Let me know if you have any problems in performing with the steps above or any questions you may have.

Good Day!
Post #4
Conspire

bless you - i think i did it correctly:

otl.txt
++++
OTL logfile created on: 10/17/2011 1:03:43 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = F:\pcUtilities\pcMaintenance\WhatTheTech
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.49 Gb Total Physical Memory | 2.69 Gb Available Physical Memory | 77.02% Memory free
5.33 Gb Paging File | 4.69 Gb Available in Paging File | 87.94% Paging File free
Paging file location(s): E:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = E: | %SystemRoot% = E:\WINDOWS | %ProgramFiles% = E:\Program Files
Drive C: | 9.77 Gb Total Space | 4.41 Gb Free Space | 45.12% Space Free | Partition Type: NTFS
Drive D: | 24.41 Gb Total Space | 3.95 Gb Free Space | 16.20% Space Free | Partition Type: NTFS
Drive E: | 24.41 Gb Total Space | 6.04 Gb Free Space | 24.74% Space Free | Partition Type: NTFS
Drive F: | 174.25 Gb Total Space | 153.93 Gb Free Space | 88.34% Space Free | Partition Type: NTFS
Drive G: | 6.76 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: 7-LPTOP | User Name: ron | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - F:\pcUtilities\pcMaintenance\WhatTheTech\OTL.exe (OldTimer Tools)
PRC - E:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - E:\Program Files\IObit\Smart Defrag 2\SmartDefrag.exe (IObit)
PRC - E:\Program Files\WinZip System Utilities Suite\WINZIPSSDefragSrv.exe (WinZip Computing, S.L. (WinZip Computing))
PRC - E:\Program Files\Verizon Wireless\VZAccess Manager\VZAccess Manager.exe (Smith Micro Software, Inc.)
PRC - E:\WINDOWS\system32\ptumlcmsvc.exe (DEVGURU Co., LTD)
PRC - E:\Program Files\Macrium\Reflect\ReflectService.exe ()
PRC - E:\Program Files\Brother\BRAdmin Professional 3\bratimer.exe ()
PRC - E:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - E:\Program Files\Dell\Dell Mobile Broadband\systray.exe ()
PRC - E:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe (SigmaTel, Inc.)


========== Modules (No Company Name) ==========

MOD - E:\Program Files\Alwil Software\Avast5\defs\11101700\algo.dll ()
MOD - E:\Program Files\Alwil Software\Avast5\defs\11101601\algo.dll ()
MOD - E:\Program Files\Alwil Software\Avast5\defs\11101700\aswRep.dll ()
MOD - E:\Program Files\Alwil Software\Avast5\defs\11101601\aswRep.dll ()
MOD - E:\Program Files\IObit\Smart Defrag 2\NtfsData.dll ()
MOD - E:\Program Files\Macrium\Reflect\ReflectService.exe ()
MOD - E:\Program Files\Java\jre6\bin\jp2iexp.dll ()
MOD - E:\Program Files\Java\jre6\bin\jp2native.dll ()
MOD - E:\Program Files\Brother\BRAdmin Professional 3\bratimer.exe ()
MOD - E:\WINDOWS\system32\bcm1xsup.dll ()
MOD - E:\WINDOWS\system32\msdmo.dll ()
MOD - E:\Program Files\Dell\Dell Mobile Broadband\systray.exe ()
MOD - E:\WINDOWS\system32\lexdlls.dlL ()


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (getPlusHelper) getPlus® – File not found
SRV - (avast! Antivirus) – E:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (WINZIPSSDiskOptimizer) – E:\Program Files\WinZip System Utilities Suite\WINZIPSSDefragSrv.exe (WinZip Computing, S.L. (WinZip Computing))
SRV - (ptumlcmsvc) – E:\WINDOWS\system32\ptumlcmsvc.exe (DEVGURU Co., LTD)
SRV - (acssrv) – E:\Program Files\Agnitum\Outpost Firewall Pro\acs.exe (Agnitum Ltd.)
SRV - (ReflectService) – E:\Program Files\Macrium\Reflect\ReflectService.exe ()
SRV - (BRA_Scheduler) – E:\Program Files\Brother\BRAdmin Professional 3\bratimer.exe ()
SRV - (STacSV) – E:\Program Files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\stacsv.exe (SigmaTel, Inc.)


========== Driver Services (SafeList) ==========

DRV - (aswSnx) – E:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) – E:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) – E:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswTdi) – E:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) – E:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswFsBlk) – E:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) – E:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (PTUMLVsp) – E:\WINDOWS\system32\drivers\PTUMLVsp.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (PTUMLRMNET) – E:\WINDOWS\system32\drivers\PTUMLRMNET.sys (DEVGURU Co., LTD.)
DRV - (PTUMLNVsp) – E:\WINDOWS\system32\drivers\PTUMLNVsp.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (PTUMLMdm) – E:\WINDOWS\system32\drivers\PTUMLMdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (PTUMLCVsp) – E:\WINDOWS\system32\drivers\PTUMLCVsp.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (PTUMLNET) – E:\WINDOWS\system32\drivers\PTUMLNET.sys (DEVGURU Co., LTD.)
DRV - (PTUMLBUS) – E:\WINDOWS\system32\drivers\PTUMLBUS.sys (DEVGURU Co., LTD.)
DRV - (SandBox) – E:\WINDOWS\system32\drivers\SandBox.sys (Agnitum Ltd.)
DRV - (ASWFilt) – E:\WINDOWS\system32\Filt\ASWFilt.dll (Agnitum Ltd.)
DRV - (pssnap) – E:\WINDOWS\system32\DRIVERS\pssnap.sys (Macrium Software)
DRV - (SmartDefragDriver) – E:\WINDOWS\System32\Drivers\SmartDefragDriver.sys ()
DRV - (afwcore) – E:\WINDOWS\system32\drivers\afwcore.sys (Agnitum Ltd.)
DRV - (afw) – E:\WINDOWS\system32\drivers\afw.sys (Agnitum Ltd.)
DRV - (SMSIVZAM5) – E:\Program Files\Verizon Wireless\VZAccess Manager\SMSIVZAM5.sys (Smith Micro Inc.)
DRV - (Tcpip6) – E:\WINDOWS\system32\drivers\tcpip6.sys (Microsoft Corporation)
DRV - (hamachi) – E:\WINDOWS\system32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (BCM43XX) – E:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (yukonwxp) – E:\WINDOWS\system32\drivers\yk51x86.sys (Marvell)
DRV - (DgiVecp) – E:\WINDOWS\system32\drivers\DGIVECP.SYS (DeviceGuys, Inc.)
DRV - (HSF_DPV) – E:\WINDOWS\system32\drivers\HSF_DPV.sys (Conexant Systems, Inc.)
DRV - (HSFHWAZL) – E:\WINDOWS\system32\drivers\HSFHWAZL.sys (Conexant Systems, Inc.)
DRV - (winachsf) – E:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (NWADI) – E:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (PCASp50) – E:\WINDOWS\system32\drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (STHDA) – E:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (IntcHdmiAddService) Intel® – E:\WINDOWS\system32\drivers\IntcHdmi.sys (Intel® Corporation)
DRV - (rimmptsk) – E:\WINDOWS\system32\drivers\rimmptsk.sys (REDC)
DRV - (rimsptsk) – E:\WINDOWS\system32\drivers\rimsptsk.sys (REDC)
DRV - (rismxdp) – E:\WINDOWS\system32\drivers\rixdptsk.sys (REDC)
DRV - (vcdrom) – E:\WINDOWS\system32\drivers\VCdRom.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://jubakpicks.com/?gclid=CIjPuvuS3Z0CFQtN5QodzzT1MQ
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {393c3019-8406-4686-82bf-057e7a9331bb} - E:\Program Files\Tech-Pro.net\prxtbTech.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: E:\Program Files\iTunes\Mozilla Plugins\npitunes.dll File not found
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: E:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: E:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: E:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: E:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: E:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{27182e60-b5f3-411c-b545-b44205977502}: E:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2010/07/07 19:40:16 | 000,000,000 | —D | M]


========== Chrome ==========


O1 HOSTS File: ([2011/10/16 11:00:34 | 000,437,835 | R— | M]) - E:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 15061 more lines…
O2 - BHO: (Tech-Pro.net Toolbar) - {393c3019-8406-4686-82bf-057e7a9331bb} - E:\Program Files\Tech-Pro.net\prxtbTech.dll (Conduit Ltd.)
O2 - BHO: (Reg Error: Value error.) - {724d43a9-0d85-11d4-9908-00400523e39a} - E:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Tech-Pro.net Toolbar) - {393c3019-8406-4686-82bf-057e7a9331bb} - E:\Program Files\Tech-Pro.net\prxtbTech.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (&RoboForm;) - {724d43a0-0d85-11d4-9908-00400523e39a} - E:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (Tech-Pro.net Toolbar) - {393C3019-8406-4686-82BF-057E7A9331BB} - E:\Program Files\Tech-Pro.net\prxtbTech.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm;) - {724D43A0-0D85-11D4-9908-00400523E39A} - E:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O4 - HKLM..\Run: [OutpostMonitor] E:\Program Files\Agnitum\Outpost Firewall Pro\op_mon.exe (Agnitum Ltd.)
O4 - HKLM..\Run: [systray] E:\Program Files\Dell\Dell Mobile Broadband\systray.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 1
O8 - Extra context menu item: Customize Menu - E:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: Fill Forms - E:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: Google Sidewiki… - E:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O8 - Extra context menu item: RoboForm Toolbar - E:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O8 - Extra context menu item: Save Forms - E:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - E:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - E:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - E:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - E:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O9 - Extra Button: Outpost Firewall Pro Quick Tune - {44627E97-789B-40d4-B5C2-58BD171129A1} - E:\Program Files\Agnitum\Outpost Firewall Pro\ie_bar.dll (Agnitum Ltd.)
O9 - Extra Button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - E:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra 'Tools' menuitem : RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - E:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O12 - Plugin for: .spop - E:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O15 - HKCU\..Trusted Domains: standardandpoors.com ([www] http in Trusted sites)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} http://dlcdnet.asus.com/pub/ASUS/misc/dlm-…vex-2.2.5.0.cab (DLM Control)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1271299514406 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D9B4435E-7E86-4714-960B-B00DE3648173}: DhcpNameServer = [removed] [removed]
O20 - AppInit_DLLs: (e:\progra~1\agnitum\outpos~1\wl_hook.dll) -e:\Program Files\Agnitum\Outpost Firewall Pro\wl_hook.dll (Agnitum Ltd.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -E:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (E:\WINDOWS\system32\userinit.exe) -E:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: E:\Documents and Settings\ron\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: E:\Documents and Settings\ron\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/09/12 21:46:55 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | —- | M] () - D:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2007/02/07 13:20:05 | 000,000,076 | R— | M] () - G:\autorun.inf – [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - E:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - E:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - E:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - E:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - E:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - E:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - E:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - E:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - E:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/10/16 10:15:57 | 000,000,000 | —D | C] – E:\Documents and Settings\All Users\Start Menu\Programs\Spybot - Search & Destroy
[2011/10/16 10:15:53 | 000,000,000 | —D | C] – E:\Program Files\Spybot - Search & Destroy
[2011/10/16 10:15:53 | 000,000,000 | —D | C] – E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2011/10/15 21:33:29 | 000,000,000 | —D | C] – E:\Program Files\HAI
[2011/10/15 21:33:29 | 000,000,000 | —D | C] – E:\Documents and Settings\All Users\Start Menu\Programs\HAI
[2011/10/14 06:46:50 | 000,000,000 | —D | C] – E:\Program Files\Conduit
[2011/10/14 06:46:49 | 000,000,000 | —D | C] – E:\Documents and Settings\ron\Local Settings\Application Data\Tech-Pro.net
[2011/10/14 06:46:34 | 000,000,000 | —D | C] – E:\Program Files\Tech-Pro.net
[2011/10/14 06:20:03 | 000,000,000 | —D | C] – E:\Documents and Settings\LocalService\Application Data\Nuance
[2011/10/14 06:19:58 | 000,000,000 | —D | C] – E:\Documents and Settings\LocalService\Application Data\Zeon
[2011/10/10 14:28:39 | 000,000,000 | —D | C] – E:\Program Files\Common Files\Adobe AIR
[2011/10/10 14:27:59 | 000,000,000 | —D | C] – E:\Documents and Settings\ron\Local Settings\Application Data\Solid State Networks
[2011/10/10 14:26:43 | 000,000,000 | —D | C] – E:\Documents and Settings\ron\Application Data\AdobeUM
[2011/10/10 14:23:34 | 000,000,000 | —D | C] – E:\Program Files\Adobe
[2011/10/09 13:24:31 | 000,000,000 | —D | C] – E:\Documents and Settings\ron\Start Menu\Programs\HiJackThis
[2011/10/09 13:02:21 | 000,000,000 | —D | C] – E:\Program Files\HiJackThis
[2011/10/08 21:10:41 | 000,000,000 | —D | C] – E:\FontsBackUp
[2011/10/04 12:47:07 | 000,020,632 | —- | C] (Softland) – E:\WINDOWS\System32\novamnp5.dll
[2011/10/04 12:47:07 | 000,018,584 | —- | C] (Softland) – E:\WINDOWS\System32\novamip5.dll
[2011/10/04 12:45:45 | 000,000,000 | —D | C] – E:\Documents and Settings\All Users\Start Menu\Programs\novaPDF Professional Desktop 5
[2011/10/04 12:45:35 | 000,000,000 | —D | C] – E:\Program Files\Softland
[2011/10/04 07:33:53 | 000,000,000 | —D | C] – E:\Documents and Settings\All Users\Uniblue
[2011/10/03 14:36:11 | 000,000,000 | —D | C] – E:\Documents and Settings\ron\Local Settings\Application Data\IsolatedStorage
[2011/10/03 14:36:10 | 000,000,000 | —D | C] – E:\Documents and Settings\ron\Local Settings\Application Data\Numeral_Technology_LLC
[2011/10/03 14:36:09 | 000,000,000 | —D | C] – F:\pcDocuments\MyDocuments\Numeral Technology LLC
[2011/10/03 11:24:42 | 000,000,000 | —D | C] – E:\Documents and Settings\All Users\Start Menu\Programs\Point & Figure Charts
[2011/10/03 11:24:42 | 000,000,000 | —D | C] – E:\Program Files\Numeral Technology LLC
[2011/09/30 08:15:25 | 000,000,000 | —D | C] – E:\Documents and Settings\All Users\Start Menu\Programs\XLQ
[2011/09/30 08:15:23 | 000,000,000 | —D | C] – E:\Program Files\QMatix
[2011/09/27 22:18:15 | 000,118,784 | —- | C] (vbAccelerator) – E:\WINDOWS\System32\vbalNCSM6.dll
[2011/09/27 22:18:15 | 000,101,888 | —- | C] (Microsoft Corporation) – E:\WINDOWS\System32\Vb6stkit.dll
[2011/09/27 22:18:15 | 000,070,088 | —- | C] (xx) – E:\WINDOWS\System32\Project2-1.ocx
[2011/09/27 22:18:15 | 000,040,960 | —- | C] (
Post #5
Hi Ron,

Thanks. You did correctly. :)

Please download aswMBR.exe and save it to your desktop.
  • Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)
  • Click Scan

  • Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review. Note - do NOT attempt any Fix yet.
  • You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well.
Post #6
Conspire, greetings today. ok, here goes the next batch: aswMBR.txt +++++++++ aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software Run date: 2011-10-18 12:35:56 —————————– 12:35:56.713 OS Version: Windows 5.1.2600 Service Pack 3 12:35:56.713 Number of processors: 2 586 0xF0D 12:35:56.713 ComputerName: 7-LPTOP UserName: ron 12:36:05.416 Initialize success 12:36:05.588 AVAST engine defs: 11101800 12:36:32.150 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e 12:36:32.150 Disk 0 Vendor: SAMSUNG_HM251JI 2SS00_01 Size: 238475MB BusType: 3 12:36:34.244 Disk 0 MBR read successfully 12:36:34.244 Disk 0 MBR scan 12:36:34.244 Disk 0 Windows VISTA default MBR code 12:36:34.244 Disk 0 scanning sectors +488392065 12:36:34.322 Disk 0 scanning E:\WINDOWS\system32\drivers 12:36:42.775 Service scanning 12:36:45.385 Modules scanning 12:36:59.557 Disk 0 trace - called modules: 12:36:59.885 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS 12:37:02.838 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8b103ab8] 12:37:02.838 3 CLASSPNP.SYS[ba108fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-e[0x8b0a3030] 12:37:03.103 AVAST engine scan E:\WINDOWS 12:37:09.807 AVAST engine scan E:\WINDOWS\system32 12:38:10.900 AVAST engine scan E:\WINDOWS\system32\drivers 12:38:19.119 AVAST engine scan E:\Documents and Settings\ron 12:43:19.822 AVAST engine scan E:\Documents and Settings\All Users 12:43:33.869 Scan finished successfully 13:18:35.385 Disk 0 MBR has been saved successfully to "F:\pcUtilities\pcMaintenance\WhatTheTech\MBR.dat" 13:18:35.385 The log file has been saved successfully to "F:\pcUtilities\pcMaintenance\WhatTheTech\aswMBR.txt" MBR.zip ++++++ MBR.zip is attached. ok then, well, the education continues thanks again, ron

Attachments:

Post #7
Please read through these instructions to familarize yourself with what to expect when this tool runs

Refer to the ComboFix User's Guide

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs

    **********************************************
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #8
Conspire,

hi there - ok, this time it looks like it did some things - here's the log file:

combofix.log.txt
++++++++++++

ComboFix 11-10-20.03 - ron 10/20/2011 7:16.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3574.2859 [GMT -4:00]
Running from: f:\pcutilities\pcMaintenance\WhatTheTech\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Outpost Firewall Pro *Disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
e:\documents and settings\ron\Desktop\Internet Explorer.lnk
e:\program files\messenger\msmsgsin.exe
e:\program files\msn\msncorefiles\custdial.dll
e:\program files\msn\msncorefiles\logonmgr.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-09-20 to 2011-10-20 )))))))))))))))))))))))))))))))
.
.
2011-10-16 14:15 . 2011-10-16 15:00 ——– d—–w- e:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2011-10-16 14:15 . 2011-10-16 14:17 ——– d—–w- e:\program files\Spybot - Search & Destroy
2011-10-16 01:33 . 2011-10-16 01:33 ——– d—–w- e:\program files\HAI
2011-10-14 11:35 . 2011-10-14 11:35 664 —-a-w- e:\documents and settings\ron\Local Settings\Application Data\d3d9caps.tmp
2011-10-14 10:46 . 2011-10-14 10:46 ——– d—–w- e:\program files\Conduit
2011-10-14 10:46 . 2011-10-17 11:13 ——– d—–w- e:\documents and settings\ron\Local Settings\Application Data\Tech-Pro.net
2011-10-14 10:46 . 2011-10-14 10:46 ——– d—–w- e:\program files\Tech-Pro.net
2011-10-14 10:20 . 2011-10-14 10:20 ——– d—–w- e:\documents and settings\LocalService\Application Data\Nuance
2011-10-14 10:19 . 2011-10-14 10:19 ——– d—–w- e:\documents and settings\LocalService\Application Data\Zeon
2011-10-10 18:28 . 2011-10-10 18:28 ——– d—–w- e:\program files\Common Files\Adobe AIR
2011-10-10 18:27 . 2011-10-10 18:27 ——– d—–w- e:\documents and settings\ron\Local Settings\Application Data\Solid State Networks
2011-10-10 18:26 . 2011-10-10 18:26 ——– d—–w- e:\documents and settings\ron\Application Data\AdobeUM
2011-10-10 18:08 . 2011-10-10 18:22 24064 —-a-w- e:\windows\autoload.exe
2011-10-09 17:24 . 2011-10-09 17:24 388096 —-a-r- e:\documents and settings\ron\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-10-09 01:10 . 2011-10-09 01:23 ——– d—–w- E:\FontsBackUp
2011-10-04 16:47 . 2008-11-28 18:23 20632 —-a-w- e:\windows\system32\novamnp5.dll
2011-10-04 16:47 . 2008-11-28 18:23 18584 —-a-w- e:\windows\system32\novamip5.dll
2011-10-04 16:45 . 2011-10-04 16:45 ——– d—–w- e:\program files\Softland
2011-10-04 11:33 . 2011-10-04 11:33 ——– d—–w- e:\documents and settings\All Users\Uniblue
2011-10-03 18:36 . 2011-10-03 18:36 ——– d—–w- e:\documents and settings\ron\Local Settings\Application Data\IsolatedStorage
2011-10-03 18:36 . 2011-10-03 18:36 ——– d—–w- e:\documents and settings\ron\Local Settings\Application Data\Numeral_Technology_LLC
2011-10-03 15:24 . 2011-10-03 15:24 ——– d—–w- e:\program files\Numeral Technology LLC
2011-09-30 12:15 . 2011-09-30 12:15 ——– d—–w- e:\program files\QMatix
2011-09-28 02:18 . 2000-07-17 18:41 70088 —-a-w- e:\windows\system32\Project2-1.ocx
2011-09-28 02:18 . 2000-03-21 04:55 118784 —-a-w- e:\windows\system32\vbalNCSM6.dll
2011-09-28 02:18 . 1999-03-26 04:00 101888 —-a-w- e:\windows\system32\Vb6stkit.dll
2011-09-28 02:18 . 1999-02-19 12:54 40960 —-a-w- e:\windows\system32\SSubTmr6.dll
2011-09-25 13:21 . 2011-08-19 20:33 25944 —-a-w- e:\windows\system32\SmartDefragBootTime.exe
2011-09-25 13:21 . 2010-11-26 22:02 14776 —-a-w- e:\windows\system32\drivers\SmartDefragDriver.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-03 14:22 . 2011-06-08 21:46 404640 —-a-w- e:\windows\system32\FlashPlayerCPLApp.cpl
2011-09-26 15:41 . 2007-10-09 17:03 611328 —-a-w- e:\windows\system32\uiautomationcore.dll
2011-09-26 15:41 . 2001-08-23 12:00 220160 —-a-w- e:\windows\system32\oleacc.dll
2011-09-26 15:41 . 2001-08-23 12:00 20480 —-a-w- e:\windows\system32\oleaccrc.dll
2011-09-15 11:20 . 2002-02-10 05:00 72748 —-a-w- e:\windows\unins000.exe
2011-09-10 23:21 . 2011-09-10 23:21 49152 —-a-r- e:\documents and settings\ron\Application Data\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe
2011-09-10 23:20 . 2011-09-10 23:20 335872 —-a-r- e:\documents and settings\ron\Application Data\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe
2011-09-09 09:12 . 2001-08-23 12:00 599040 —-a-w- e:\windows\system32\crypt32.dll
2011-09-06 20:45 . 2010-09-19 13:26 41184 —-a-w- e:\windows\avastSS.scr
2011-09-06 20:45 . 2009-10-25 19:27 199304 —-a-w- e:\windows\system32\aswBoot.exe
2011-09-06 20:38 . 2011-06-03 20:59 442200 —-a-w- e:\windows\system32\drivers\aswSnx.sys
2011-09-06 20:37 . 2009-10-25 19:27 320856 —-a-w- e:\windows\system32\drivers\aswSP.sys
2011-09-06 20:36 . 2009-10-25 19:27 34392 —-a-w- e:\windows\system32\drivers\aswRdr.sys
2011-09-06 20:36 . 2009-10-25 19:27 52568 —-a-w- e:\windows\system32\drivers\aswTdi.sys
2011-09-06 20:36 . 2009-10-25 19:27 110552 —-a-w- e:\windows\system32\drivers\aswmon2.sys
2011-09-06 20:36 . 2009-10-25 19:27 104536 —-a-w- e:\windows\system32\drivers\aswmon.sys
2011-09-06 20:36 . 2009-10-25 19:27 20568 —-a-w- e:\windows\system32\drivers\aswFsBlk.sys
2011-09-06 20:33 . 2009-10-25 19:27 30808 —-a-w- e:\windows\system32\drivers\aavmker4.sys
2011-09-06 13:20 . 2001-08-23 12:00 1858944 —-a-w- e:\windows\system32\win32k.sys
2011-08-31 21:00 . 2010-07-09 18:14 22216 —-a-w- e:\windows\system32\drivers\mbam.sys
2011-08-22 23:48 . 2001-08-23 12:00 916480 —-a-w- e:\windows\system32\wininet.dll
2011-08-22 23:48 . 2001-08-23 12:00 43520 —-a-w- e:\windows\system32\licmgr10.dll
2011-08-22 23:48 . 2001-08-23 12:00 1469440 —-a-w- e:\windows\system32\inetcpl.cpl
2011-08-22 11:56 . 2009-10-20 00:38 385024 —-a-w- e:\windows\system32\html.iec
2011-08-17 13:49 . 2001-08-23 12:00 138496 —-a-w- e:\windows\system32\drivers\afd.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{393c3019-8406-4686-82bf-057e7a9331bb}"= "e:\program files\Tech-Pro.net\prxtbTech.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{393c3019-8406-4686-82bf-057e7a9331bb}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{393c3019-8406-4686-82bf-057e7a9331bb}]
2011-05-09 09:49 176936 —-a-w- e:\program files\Tech-Pro.net\prxtbTech.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{393c3019-8406-4686-82bf-057e7a9331bb}"= "e:\program files\Tech-Pro.net\prxtbTech.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{393c3019-8406-4686-82bf-057e7a9331bb}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{393C3019-8406-4686-82BF-057E7A9331BB}"= "e:\program files\Tech-Pro.net\prxtbTech.dll" [2011-05-09 176936]
.
[HKEY_CLASSES_ROOT\clsid\{393c3019-8406-4686-82bf-057e7a9331bb}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-09-06 20:45 122512 —-a-w- e:\program files\Alwil Software\Avast5\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Outpost]
@="{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}"
[HKEY_CLASSES_ROOT\CLSID\{33C9E362-3EDA-4930-8AFE-5DA39A8BB77A}]
2011-02-04 20:54 283736 —-a-w- e:\program files\Agnitum\Outpost Firewall Pro\op_shell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="e:\windows\system32\igfxtray.exe" [2007-11-15 141848]
"systray"="e:\program files\Dell\Dell Mobile Broadband\systray.exe" [2007-06-23 331851]
"OutpostMonitor"="e:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2011-02-04 2898592]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="e:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2010-10-29 160328]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk]
backup=e:\windows\pss\Acrobat Assistant.lnkCommon Startup
.
[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
backup=e:\windows\pss\Digital Line Detect.lnkCommon Startup
.
[HKLM\~\startupfolder\E:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
backup=e:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKLM\~\startupfolder\E:^Documents and Settings^ron^Start Menu^Programs^Startup^Check for TWS Updates.lnk]
backup=e:\windows\pss\Check for TWS Updates.lnkStartup
.
[HKLM\~\startupfolder\E:^Documents and Settings^ron^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
backup=e:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ihanotify
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InboxMonitor
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogMeIn Hamachi Ui
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDF7 Registry Controller
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFHook
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PdfProInboxMonitor
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Verizon_McciTrayApp
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 16:55 937920 —-a-w- e:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
2008-06-02 16:42 2220032 —-a-w- e:\windows\system32\WLTRAY.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eCopy Scan Inbox Monitor]
2010-06-16 07:07 83232 —-a-w- e:\program files\eCopy\PaperWorks\Bin\InboxMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eCopyPWPrntHlpr]
2010-06-16 06:51 509216 —-a-w- e:\program files\eCopy\PaperWorks\Bin\eCopyPWPrntHlpr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Quick Search Box]
2011-04-20 23:52 126976 —-a-w- e:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2007-11-15 19:32 166424 —-a-w- e:\windows\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Default Manager]
2009-07-17 16:12 288080 —-a-w- e:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSN Toolbar]
2009-12-09 02:29 240992 —-a-w- e:\program files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nikon Transfer Monitor]
2008-09-30 18:06 485208 —-a-w- e:\program files\Common Files\Nikon\Monitor\NkMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OutpostFeedBack]
2011-02-04 19:54 491272 —-a-w- e:\program files\Agnitum\Outpost Firewall Pro\feedback.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2007-11-15 19:33 137752 —-a-w- e:\windows\system32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoboForm]
2010-10-29 11:46 160328 —-a-w- e:\program files\Siber Systems\AI RoboForm\robotaskbaricon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2007-05-10 15:22 405504 —-a-w- e:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 16:44 248552 —-a-w- e:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-08-28 15:32 1557800 -c–a-w- e:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"e:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"e:\\Program Files\\eCopy\\PaperWorks\\Bin\\eCopyPaperWorks.exe"=
"e:\\WINDOWS\\system32\\mmc.exe"=
"e:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1723:TCP"= 1723:TCP:@xpsp2res.dll,-22015
"1701:UDP"= 1701:UDP:@xpsp2res.dll,-22016
"500:UDP"= 500:UDP:@xpsp2res.dll,-22017
.
R0 pssnap;Paramount Software Snapshot Filter;e:\windows\system32\drivers\pssnap.sys [1/17/2011 8:02 PM 16024]
R0 SmartDefragDriver;SmartDefragDriver;e:\windows\system32\drivers\SmartDefragDriver.sys [9/25/2011 9:21 AM 14776]
R1 aswSnx;aswSnx;e:\windows\system32\drivers\aswSnx.sys [6/3/2011 4:59 PM 442200]
R1 aswSP;aswSP;e:\windows\system32\drivers\aswSP.sys [10/25/2009 3:27 PM 320856]
R1 SandBox;SandBox;e:\windows\system32\drivers\SandBox.sys [12/15/2010 7:34 PM 710824]
R1 vcdrom;Virtual CD-ROM Device Driver;e:\windows\system32\drivers\VCdRom.sys [1/28/2011 1:03 PM 8576]
R2 aswFsBlk;aswFsBlk;e:\windows\system32\drivers\aswFsBlk.sys [10/25/2009 3:27 PM 20568]
R2 BRA_Scheduler;Brother BRAdminPro Scheduler;e:\program files\Brother\BRAdmin Professional 3\bratimer.exe [3/6/2011 1:46 PM 65536]
R2 ptumlcmsvc;PTUML290 Connection Manager Service;e:\windows\system32\ptumlcmsvc.exe [2/21/2011 5:27 PM 106496]
R2 ReflectService;Macrium Reflect Image Mounting Service;e:\program files\Macrium\Reflect\ReflectService.exe [1/17/2011 8:02 PM 220824]
R2 WINZIPSSDiskOptimizer;WINZIPSSDiskOptimizer;e:\program files\WinZip System Utilities Suite\WINZIPSSDefragSrv.exe [9/18/2011 6:53 PM 605520]
R3 afw;Agnitum firewall driver;e:\windows\system32\drivers\afw.sys [12/15/2010 7:33 PM 34280]
R3 afwcore;afwcore;e:\windows\system32\drivers\afwcore.sys [12/15/2010 7:34 PM 267624]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI Service;e:\windows\system32\drivers\IntcHdmi.sys [11/7/2009 4:26 PM 105984]
R3 PTUMLBUS;PTUML USB Composite Device Driver;e:\windows\system32\drivers\PTUMLBUS.sys [7/14/2011 7:02 AM 59792]
R3 PTUMLCVsp;PANTECH UML290 Connection Manager Port;e:\windows\system32\drivers\PTUMLCVsp.sys [7/14/2011 7:02 AM 168208]
R3 PTUMLMdm;PANTECH UML290;e:\windows\system32\drivers\PTUMLMdm.sys [7/14/2011 7:02 AM 168208]
R3 PTUMLNVsp;PANTECH UML290 NMEA Port;e:\windows\system32\drivers\PTUMLNVsp.sys [7/14/2011 7:02 AM 168848]
R3 PTUMLRMNET;PANTECH UML290 RMNET Service;e:\windows\system32\drivers\PTUMLRMNET.sys [7/14/2011 7:02 AM 60432]
R3 PTUMLVsp;PANTECH UML290 Diagnostic Port;e:\windows\system32\drivers\PTUMLVsp.sys [7/14/2011 7:02 AM 168208]
S2 acssrv;Agnitum Client Security Service;e:\progra~1\Agnitum\OUTPOS~1\acs.exe [12/15/2010 7:33 PM 2040144]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;e:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
S2 gupdate;Google Update Service (gupdate);e:\program files\Google\Update\GoogleUpdate.exe [2/2/2010 9:10 AM 135664]
S3 ASWFilt;ASWFilt;e:\windows\system32\Filt\ASWFilt.dll [12/15/2010 7:34 PM 72352]
S3 gupdatem;Google Update Service (gupdatem);e:\program files\Google\Update\GoogleUpdate.exe [2/2/2010 9:10 AM 135664]
S3 PTDUBus;PANTECH UM175 Composite Device Driver ;e:\windows\system32\DRIVERS\PTDUBus.sys –> e:\windows\system32\DRIVERS\PTDUBus.sys [?]
S3 PTDUMdm;PANTECH UM175 Drivers;e:\windows\system32\DRIVERS\PTDUMdm.sys –> e:\windows\system32\DRIVERS\PTDUMdm.sys [?]
S3 PTDUVsp;PANTECH UM175 Diagnostic Port;e:\windows\system32\DRIVERS\PTDUVsp.sys –> e:\windows\system32\DRIVERS\PTDUVsp.sys [?]
S3 PTDUWFLT;PTDUWWAN Filter Driver;e:\windows\system32\DRIVERS\PTDUWFLT.sys –> e:\windows\system32\DRIVERS\PTDUWFLT.sys [?]
S3 PTDUWWAN;PANTECH UM175 WWAN Driver;e:\windows\system32\DRIVERS\PTDUWWAN.sys –> e:\windows\system32\DRIVERS\PTDUWWAN.sys [?]
S3 PTUMLNET;PANTECH UML290 WWAN;e:\windows\system32\drivers\PTUMLNET.sys [7/14/2011 7:02 AM 80912]
S3 SkLaggProtocol;Marvell Link Aggregation Protocol;e:\windows\system32\DRIVERS\yk51x86l.sys –> e:\windows\system32\DRIVERS\yk51x86l.sys [?]
S3 SkVlanProtocol;Marvell VLAN Protocol;e:\windows\system32\DRIVERS\yk51x86v.sys –> e:\windows\system32\DRIVERS\yk51x86v.sys [?]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;e:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [4/14/2010 8:29 PM 32408]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;e:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-20 e:\windows\Tasks\GlaryInitialize.job
- e:\program files\Glary Utilities\initialize.exe [2011-03-05 13:26]
.
2011-10-20 e:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- e:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 13:10]
.
2011-10-20 e:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- e:\program files\Google\Update\GoogleUpdate.exe [2010-02-02 13:10]
.
2011-10-20 e:\windows\Tasks\SmartDefrag_Startup.job
- e:\program files\IObit\Smart Defrag 2\SmartDefrag.exe [2011-09-25 14:35]
.
2011-10-20 e:\windows\Tasks\User_Feed_Synchronization-{C83B75BF-C8ED-4E39-88C0-03459AF249F7}.job
- e:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://jubakpicks.com/?gclid=CIjPuvuS3Z0CFQtN5QodzzT1MQ
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Customize Menu - file://e:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - e:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Fill Forms - file://e:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: Google Sidewiki… - e:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
IE: RoboForm Toolbar - file://e:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://e:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
Trusted Zone: standardandpoors.com\www
TCP: DhcpNameServer = [removed] [removed]
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-DriverScanner - e:\program files\Uniblue\DriverScanner\launcher.exe
MSConfigStartUp-QuickTime Task - e:\program files\QuickTime Alternative\qttask.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-20 07:30
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,9f,67,20,e0,dd,59,7c,47,a1,ae,a6,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,9f,67,20,e0,dd,59,7c,47,a1,ae,a6,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(1892)
e:\windows\system32\WININET.dll
e:\program files\Agnitum\Outpost Firewall Pro\op_shell.dll
e:\windows\system32\ieframe.dll
e:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
e:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
e:\windows\System32\WLTRYSVC.EXE
e:\windows\System32\bcmwltry.exe
e:\program files\Alwil Software\Avast5\AvastSvc.exe
e:\windows\system32\LEXBCES.EXE
e:\program files\Java\jre6\bin\jqs.exe
e:\program files\SigmaTel\C-Major Audio\DellXPM_5515v131\WDM\STacSV.exe
e:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
e:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
.
**************************************************************************
.
Completion time: 2011-10-20 07:38:14 - machine was rebooted
ComboFix-quarantined-files.txt 2011-10-20 11:38
.
Pre-Run: 5,944,287,232 bytes free
Post-Run: 6,395,707,392 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(4)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(4)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 9EFC6FF7A0DE6F91AB76BFE84FA4BAC9

ok, that's it.
now, tell me the truth, you wanted to be a brain surgeon, but this was more fun?
me, i started out as a physicist, then one day, in a class in grad school on 'relativistic quantum mechanics', i decided that just maybe this wasn't what i felt like doing for the rest of my life.

thanks again.
ron
Post #9
:lol: Absolutely no! Never in my life I would have thought of becoming a brain surgeon. :lol: I just happen to be taking a subject in Uni related to QM though haha On the other hand, is there any noticeable difference? Need your feedback before I can decide on the next action.
Post #10
conspire, no, unfortunately, hdd lite still spins a good long time. so, let's rethink here a bit from a different point of view: 1. my first thought, after running avast, malwarebytes and even spybot, was that no malware, but rather a clogged e-drive. so i defragged, then unloaded a bunch of stuff, then defragged a bunch more times. so now the partition is 24gb with say 6gb free, and a 2gb swap component. now, the wxp utility shows fragmentation, but says defrag is no longer required. 2. i thought mabe to try gparted, and double the e-drive. but i didn't want to mess with that just yet – plus i'm not sure that really addresses the problem anyway. i'm a bit at a loss. what do you think? i know we've tried a bunch of stuff - maybe we are looking under the wrong rock? the other option is rethinking outpost pro? however, even if i disable pro, the hdd still starts off the same. ok, check in with you later. thanks, ron
Post #11
Don't think this has something to do with the partition. Probably some running processes in the background. Let's try a little experiment, we boot the PC into Safe Mode and observe the HDD. Is it still showing the same thing?

Reboot your computer in Safe Mode
  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
Tutorial if you need it How to boot into Safemode
Post #12
conspire, ok, i booted into safe mode. same thing, about 80sec before hdd drops off. while waiting, i tried to bring up 'spider solitaire' – launched, put up 1 card on the screen, then hung. now, i noticed 1 thing after i reboot. i use outpost firewall pro. when it launches, it always wants to go out and try to get a db update. however, i don't start my verizon usb modem right away – frankly it's locked out until the hdd lite goes off. formerly, i tried a product from r2 studios – start-up delayer – which times the the programs in wxp statrup. it worked pretty decently until a month or so ago and then the hdd stuff kept longer and longer. right now, in msconfig, there is no delay, and start-up only includes igfxtry, systray, op_mon and ctfmon. maybe i should restart the r2 product, launch verizon right away and put outpost firewall start-up 30sec later? and then avast antivirus 30 sec after that? make any sense? ron
Post #13
Ok thanks, this is a bit tricky here. I will try to dig what I can while you carry out the instructions needed.

I realize you have Macrium, did you try to image your drive back to the point where you had no problem?

Follow these steps to display hidden files and folders.

  • Open Folder Options by clicking the Start button [external image: Posted Image], clicking Control Panel, clicking Appearance and Personalization, and then clicking Folder Options.
  • Click the View tab.
  • Under Advanced settings, click Show hidden files and folders
  • Click OK. (Remember to Hide files and folders once done)

Please go to one of the below sites to scan the following files:
Virus Total (Recommended)
jotti.org
VirScan


click on Browse, and upload the following file for analysis:
e:\windows\system32\Project2-1.ocx
e:\windows\system32\vbalNCSM6.dll
e:\windows\system32\Vb6stkit.dll
e:\windows\system32\SSubTmr6.dll
E:\WINDOWS\MSPUNIN.EXE

Then click Submit. Allow the file to be scanned, and then please copy and paste the results link(for Virus Total) here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.
Post #14
conspire, bit busy at work, so doing your instructions this morning. by the way, i sent a note to agnitum (outpost firewall pro), noting that of the 75sec or more of hdd spin time, i realized that the 'shield' from outpost came up, greyed out, and stayed that way almost until the hdd blinked off. after the hdd stopped spinning, then the '?' in the center of the outpost 'shield' came on. now,not sure outpost is the problem, or maybe maybe avast is slowing it down, or something else. but i also notice that IE8 is now progressively getting slower as well, ie, performance is generally degrading. agnitum asked me to do the following, which i did; ……..If the problem recurs with Outpost Firewall Pro 7.5.1, to examine this case, we will need to take a closer look on what is going on at your computer. Please, follow this instruction to save and send log-files: 1. Go to Settings -> Logs, and select the 'Enable logging' check box. 2. Turn on 'Log debugging information' option and set 'Log' parameter to 2. Click OK to save the settings for logging. 3. Restart the PC. 4. Reproduce this problem. 5. Immediately after the problem is reproduced, right-click Outpost system tray icon, and select 'Save and archive logs'. After you will click it, 'Feedback' sub-directory will open. 6. Send us feedback.zip file, and also attach your configuration files - configuration.conf and machine.ini that can be found in Outpost installation folder. If you can't see extensions of these files, please, open "Start - Control Panel - Folder options - View" and untick "Hide extensions for known filetypes". All extensions will now be visible to you. We will reply you once we will examine the log-files. We are sorry for this inconvenience………. i have since removed the 'log debugging information' option; and will run your next steps straightaway. thanks, ron
Post #15
conspire, ok, here's the virustotal results; Project2-1.ocx 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: Project2-1.ocx Submission date: 2011-10-29 14:01:37 (UTC) Current status: finished Result: 0/ 43 (0.0%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result AhnLab-V3 2011.10.29.00 2011.10.29 - AntiVir 7.11.16.201 2011.10.28 - Antiy-AVL 2.0.3.7 2011.10.29 - Avast 6.0.1289.0 2011.10.29 - AVG 10.0.0.1190 2011.10.29 - BitDefender 7.2 2011.10.29 - ByteHero 1.0.0.1 2011.09.23 - CAT-QuickHeal 11.00 2011.10.29 - ClamAV 0.97.3.0 2011.10.29 - Commtouch 5.3.2.6 2011.10.29 - Comodo 10594 2011.10.29 - DrWeb 5.0.2.03300 2011.10.29 - Emsisoft 5.1.0.11 2011.10.29 - eSafe 7.0.17.0 2011.10.26 - eTrust-Vet 36.1.8645 2011.10.28 - F-Prot 4.6.5.141 2011.10.29 - F-Secure 9.0.16440.0 2011.10.29 - Fortinet 4.3.370.0 2011.10.29 - GData 22 2011.10.29 - Ikarus T3.1.1.107.0 2011.10.29 - Jiangmin 13.0.900 2011.10.29 - K7AntiVirus 9.116.5351 2011.10.28 - Kaspersky 9.0.0.837 2011.10.29 - McAfee 5.400.0.1158 2011.10.29 - McAfee-GW-Edition 2010.1D 2011.10.28 - Microsoft 1.7801 2011.10.29 - NOD32 6585 2011.10.29 - Norman 6.07.13 2011.10.29 - nProtect 2011-10-29.01 2011.10.29 - Panda 10.0.3.5 2011.10.29 - PCTools 8.0.0.5 2011.10.29 - Prevx 3.0 2011.10.29 - Rising 23.81.04.01 2011.10.28 - Sophos 4.70.0 2011.10.29 - SUPERAntiSpyware 4.40.0.1006 2011.10.29 - Symantec 20111.2.0.82 2011.10.29 - TheHacker 6.7.0.1.335 2011.10.28 - TrendMicro 9.500.0.1008 2011.10.29 - TrendMicro-HouseCall 9.500.0.1008 2011.10.29 - VBA32 3.12.16.4 2011.10.25 - VIPRE 10909 2011.10.29 - ViRobot 2011.10.29.4745 2011.10.29 - VirusBuster 14.1.36.0 2011.10.28 - Additional information Show all MD5 : 7f7782226705f154500c7db90bb400e4 SHA1 : 385a90c61519fc010fc752b03fcd3dceaaa2a1e8 SHA256: 51a66c74783a5c7149730534b599e01f55bd31b6a95b2720e67800ef874227d8 VT Community This file has never been reviewed by any VT Community member. Be the first one to comment on it! VirusTotal Team vbalNCSM6.dll 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: vbalNCSM6.dll Submission date: 2011-10-29 13:40:15 (UTC) Current status: finished Result: 0/ 43 (0.0%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result AhnLab-V3 2011.10.29.00 2011.10.29 - AntiVir 7.11.16.201 2011.10.28 - Antiy-AVL 2.0.3.7 2011.10.29 - Avast 6.0.1289.0 2011.10.29 - AVG 10.0.0.1190 2011.10.29 - BitDefender 7.2 2011.10.29 - ByteHero 1.0.0.1 2011.09.23 - CAT-QuickHeal 11.00 2011.10.29 - ClamAV 0.97.3.0 2011.10.29 - Commtouch 5.3.2.6 2011.10.29 - Comodo 10594 2011.10.29 - DrWeb 5.0.2.03300 2011.10.29 - Emsisoft 5.1.0.11 2011.10.29 - eSafe 7.0.17.0 2011.10.26 - eTrust-Vet 36.1.8645 2011.10.28 - F-Prot 4.6.5.141 2011.10.29 - F-Secure 9.0.16440.0 2011.10.29 - Fortinet 4.3.370.0 2011.10.29 - GData 22 2011.10.29 - Ikarus T3.1.1.107.0 2011.10.29 - Jiangmin 13.0.900 2011.10.29 - K7AntiVirus 9.116.5351 2011.10.28 - Kaspersky 9.0.0.837 2011.10.29 - McAfee 5.400.0.1158 2011.10.29 - McAfee-GW-Edition 2010.1D 2011.10.28 - Microsoft 1.7801 2011.10.29 - NOD32 6585 2011.10.29 - Norman 6.07.13 2011.10.29 - nProtect 2011-10-29.01 2011.10.29 - Panda 10.0.3.5 2011.10.29 - PCTools 8.0.0.5 2011.10.29 - Prevx 3.0 2011.10.29 - Rising 23.81.04.01 2011.10.28 - Sophos 4.70.0 2011.10.29 - SUPERAntiSpyware 4.40.0.1006 2011.10.29 - Symantec 20111.2.0.82 2011.10.29 - TheHacker 6.7.0.1.335 2011.10.28 - TrendMicro 9.500.0.1008 2011.10.29 - TrendMicro-HouseCall 9.500.0.1008 2011.10.29 - VBA32 3.12.16.4 2011.10.25 - VIPRE 10909 2011.10.29 - ViRobot 2011.10.29.4745 2011.10.29 - VirusBuster 14.1.36.0 2011.10.28 - Additional information Show all MD5 : 903a2efaa4f1e069510b99e2f7e7a4fc SHA1 : 540424d8ccb6bba0317b3ab6ecdcc80654698da6 SHA256: 3e07e3ac22539329dd62fcae9cfbefe875ed1f86435ae23e0e5730997e91ced8 VT Community This file has never been reviewed by any VT Community member. Be the first one to comment on it! VirusTotal Team Vb6stkit.dll 1 VT Community user(s) with a total of 18760 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: Vb6stkit.dll Submission date: 2011-10-29 13:45:37 (UTC) Current status: finished Result: 0/ 43 (0.0%) VT Community goodware Safety score: 100.0% Compact Print results Antivirus Version Last Update Result AhnLab-V3 2011.10.29.00 2011.10.29 - AntiVir 7.11.16.201 2011.10.28 - Antiy-AVL 2.0.3.7 2011.10.29 - Avast 6.0.1289.0 2011.10.29 - AVG 10.0.0.1190 2011.10.29 - BitDefender 7.2 2011.10.29 - ByteHero 1.0.0.1 2011.09.23 - CAT-QuickHeal 11.00 2011.10.29 - ClamAV 0.97.3.0 2011.10.29 - Commtouch 5.3.2.6 2011.10.29 - Comodo 10594 2011.10.29 - DrWeb 5.0.2.03300 2011.10.29 - Emsisoft 5.1.0.11 2011.10.29 - eSafe 7.0.17.0 2011.10.26 - eTrust-Vet 36.1.8645 2011.10.28 - F-Prot 4.6.5.141 2011.10.29 - F-Secure 9.0.16440.0 2011.10.29 - Fortinet 4.3.370.0 2011.10.29 - GData 22 2011.10.29 - Ikarus T3.1.1.107.0 2011.10.29 - Jiangmin 13.0.900 2011.10.29 - K7AntiVirus 9.116.5351 2011.10.28 - Kaspersky 9.0.0.837 2011.10.29 - McAfee 5.400.0.1158 2011.10.29 - McAfee-GW-Edition 2010.1D 2011.10.28 - Microsoft 1.7801 2011.10.29 - NOD32 6585 2011.10.29 - Norman 6.07.13 2011.10.29 - nProtect 2011-10-29.01 2011.10.29 - Panda 10.0.3.5 2011.10.29 - PCTools 8.0.0.5 2011.10.29 - Prevx 3.0 2011.10.29 - Rising 23.81.04.01 2011.10.28 - Sophos 4.70.0 2011.10.29 - SUPERAntiSpyware 4.40.0.1006 2011.10.29 - Symantec 20111.2.0.82 2011.10.29 - TheHacker 6.7.0.1.335 2011.10.28 - TrendMicro 9.500.0.1008 2011.10.29 - TrendMicro-HouseCall 9.500.0.1008 2011.10.29 - VBA32 3.12.16.4 2011.10.25 - VIPRE 10909 2011.10.29 - ViRobot 2011.10.29.4745 2011.10.29 - VirusBuster 14.1.36.0 2011.10.28 - Additional information Show all MD5 : cff867572b44212b01b711c1fa009537 SHA1 : 3978c9f7a3d77c0bdff4353949e2143757eebc79 SHA256: df6e2f111773adec3b33dcb0b31e2a4d21ef7d51740706335f411e2c999c0e6b VT Community Ssubtmr6.dll 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: SSubTmr6.dll Submission date: 2011-10-29 13:54:48 (UTC) Current status: finished Result: 0/ 43 (0.0%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result AhnLab-V3 2011.10.29.00 2011.10.29 - AntiVir 7.11.16.201 2011.10.28 - Antiy-AVL 2.0.3.7 2011.10.29 - Avast 6.0.1289.0 2011.10.29 - AVG 10.0.0.1190 2011.10.29 - BitDefender 7.2 2011.10.29 - ByteHero 1.0.0.1 2011.09.23 - CAT-QuickHeal 11.00 2011.10.29 - ClamAV 0.97.3.0 2011.10.29 - Commtouch 5.3.2.6 2011.10.29 - Comodo 10594 2011.10.29 - DrWeb 5.0.2.03300 2011.10.29 - Emsisoft 5.1.0.11 2011.10.29 - eSafe 7.0.17.0 2011.10.26 - eTrust-Vet 36.1.8645 2011.10.28 - F-Prot 4.6.5.141 2011.10.29 - F-Secure 9.0.16440.0 2011.10.29 - Fortinet 4.3.370.0 2011.10.29 - GData 22 2011.10.29 - Ikarus T3.1.1.107.0 2011.10.29 - Jiangmin 13.0.900 2011.10.29 - K7AntiVirus 9.116.5351 2011.10.28 - Kaspersky 9.0.0.837 2011.10.29 - McAfee 5.400.0.1158 2011.10.29 - McAfee-GW-Edition 2010.1D 2011.10.28 - Microsoft 1.7801 2011.10.29 - NOD32 6585 2011.10.29 - Norman 6.07.13 2011.10.28 - nProtect 2011-10-29.01 2011.10.29 - Panda 10.0.3.5 2011.10.29 - PCTools 8.0.0.5 2011.10.29 - Prevx 3.0 2011.10.29 - Rising 23.81.04.01 2011.10.28 - Sophos 4.70.0 2011.10.29 - SUPERAntiSpyware 4.40.0.1006 2011.10.29 - Symantec 20111.2.0.82 2011.10.29 - TheHacker 6.7.0.1.335 2011.10.28 - TrendMicro 9.500.0.1008 2011.10.29 - TrendMicro-HouseCall 9.500.0.1008 2011.10.29 - VBA32 3.12.16.4 2011.10.25 - VIPRE 10909 2011.10.29 - ViRobot 2011.10.29.4745 2011.10.29 - VirusBuster 14.1.36.0 2011.10.28 - Additional information Show all MD5 : 1556c5b52a751c31b4ca6fe757704131 SHA1 : a04263b37b69a5a53eaccc6d30dda61b2808224a SHA256: 48bb226b418dae999d66731599996e042c5592d845ea11548a15ccd3a00fb5ab VT Community This file has never been reviewed by any VT Community member. Be the first one to comment on it! VirusTotal Team Mspunin 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: MSPUNIN.EXE Submission date: 2011-10-29 13:58:44 (UTC) Current status: finished Result: 0/ 42 (0.0%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result AhnLab-V3 2011.10.29.00 2011.10.29 - AntiVir 7.11.16.201 2011.10.28 - Antiy-AVL 2.0.3.7 2011.10.29 - Avast 6.0.1289.0 2011.10.29 - AVG 10.0.0.1190 2011.10.29 - BitDefender 7.2 2011.10.29 - ByteHero 1.0.0.1 2011.09.23 - CAT-QuickHeal 11.00 2011.10.29 - ClamAV 0.97.3.0 2011.10.29 - Commtouch 5.3.2.6 2011.10.29 - Comodo 10594 2011.10.29 - DrWeb 5.0.2.03300 2011.10.29 - Emsisoft 5.1.0.11 2011.10.29 - eSafe 7.0.17.0 2011.10.26 - eTrust-Vet 36.1.8645 2011.10.28 - F-Prot 4.6.5.141 2011.10.29 - F-Secure 9.0.16440.0 2011.10.29 - Fortinet 4.3.370.0 2011.10.29 - GData 22 2011.10.29 - Ikarus T3.1.1.107.0 2011.10.29 - Jiangmin 13.0.900 2011.10.29 - K7AntiVirus 9.116.5351 2011.10.28 - Kaspersky 9.0.0.837 2011.10.29 - McAfee 5.400.0.1158 2011.10.29 - McAfee-GW-Edition 2010.1D 2011.10.28 - Microsoft 1.7801 2011.10.29 - NOD32 6585 2011.10.29 - Norman 6.07.13 2011.10.29 - nProtect 2011-10-29.01 2011.10.29 - Panda 10.0.3.5 2011.10.29 - PCTools 8.0.0.5 2011.10.29 - Prevx 3.0 2011.10.29 - Rising 23.81.04.01 2011.10.28 - SUPERAntiSpyware 4.40.0.1006 2011.10.29 - Symantec 20111.2.0.82 2011.10.29 - TheHacker 6.7.0.1.335 2011.10.28 - TrendMicro 9.500.0.1008 2011.10.29 - TrendMicro-HouseCall 9.500.0.1008 2011.10.29 - VBA32 3.12.16.4 2011.10.25 - VIPRE 10909 2011.10.29 - ViRobot 2011.10.29.4745 2011.10.29 - VirusBuster 14.1.36.0 2011.10.28 - Additional information Show all MD5 : 3c3bd2a4eab89a9d88152e3892932671 SHA1 : 313b733743e9044aa98236ce8a11edafb15f4d60 SHA256: 30fbf5ecd6a429bfe5e76556ada311e8d44ce4827a9a55c079a2c6daf8f7ed04 VT Community This file has never been reviewed by any VT Community member. Be the first one to comment on it! VirusTotal Team okay, that's it. let's keep going when you are ready. thanks, ron

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI