rmfred
Topic Starter
After running the fixes suggested in this topic: http://forums.whatthetech.com/index.php?showtopic=124590 something caused my database connected ASP pages to quit working.
After running WR-AIO as per this topic: http://forums.whatthetech.com/index.php?showtopic=124885; my anti-virus (Sophos) detected and reported the following errors:
\\.\GlobalRoot\Device\Harddisk\VolumeShadowCopy1\Documents and Settings\username\recent\windows repair.lnk
\\.\GlobalRoot\Device\Harddisk\VolumeShadowCopy2\Documents and Settings\username\recent\windows repair.lnk
Uninstalling WR-AIO took care of the constant Sophos errors.
After uninstalling WR-AIO I got the following error from Sophos regarding something called psExec:
C:\System Volume Information\_restore{4617D869-6DFF-4342-BE3F-6D5D37A05BC1}\RP11\A0011920.exe
C:\System Volume Information\_restore{4617D869-6DFF-4342-BE3F-6D5D37A05BC1}\RP11\A0011920.exe\FILE:0000
I let Sophos "clean it up" and no longer received the error.
Today, I ran a scan with Malwarebytes and received this error from Sophos; Adware or PUA (psExec) hacking tool located at
C:\WINDOWS\PSEXESVC.EXE - item quarantined
I have submitted the file to Sophos for review.
Here is the result of running DDS:
DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_33
Run by [removed] at 15:42:28 on 2012-11-21
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2039.1011 [GMT -7:00]
.
AV: Sophos Anti-Virus *Disabled/Updated* {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.
============== Running Processes ================
.
C:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Condusiv Technologies\Diskeeper\DkService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Update\1.3.21.123\GoogleCrashHandler.exe
C:\Program Files\Sophos\AutoUpdate\almon.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Documents and Settings\rmfred\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\LMabcoms.exe
C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSvcm.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\Program Files\Sophos\Remote Management System\RouterNT.exe
C:\Program Files\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\msdtc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
C:\Documents and Settings\rmfred\Local Settings\Application Data\Google\Update\1.3.21.123\GoogleCrashHandler.exe
C:\program files\real\realplayer\update\realsched.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
c:\program files\real\realplayer\RealPlay.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\svchost.exe -k netsvcs
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: LastPass Vault: {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - c:\program files\lastpass\LPToolbar.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office 2010\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - c:\program files\lastpass\LPToolbar.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} -
uRun: [SansaDispatch] c:\documents and settings\rmfred\application data\sandisk\sansa updater\SansaDispatch.exe
uRun: [StrgSync.exe] c:\program files\storagesync\StrgSync.exe -w
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil32_11_4_402_287_Plugin.exe -update plugin
mRun: [Sophos AutoUpdate Monitor] c:\program files\sophos\autoupdate\almon.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe
dRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
uPolicies-Explorer: NoThumbnailCache = dword:1
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: shutdownnotificationflags = dword:-1014642277
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: E&xport to Microsoft Excel - c:\progra~1\mi7967~1\office14\EXCEL.EXE/3000
IE: LastPass - c:\documents and settings\rmfred\local settings\application data\lastpass\context.html?cmd=lastpass
IE: LastPass Fill Forms - c:\documents and settings\rmfred\local settings\application data\lastpass\context.html?cmd=fillforms
IE: Se&nd to OneNote - c:\progra~1\mi7967~1\office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office 2010\office14\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\INetRepl.dll
IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - c:\program files\lastpass\LPToolbar.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office 2010\office14\ONBttnIELinkedNotes.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: c:\documents and settings\all users\application data\sophos\web intelligence\swi_ifslsp.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {32505657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1262041079509
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1347905419839
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {93D532DD-85FC-4A92-8254-8DB5437D8690} - hxxp://mcarimgweb01.mclaneco.com/ECdocs/activex/OBXPopup.cab
DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} - hxxp://javadl-esd.sun.com/update/1.4.2/jinstall-1_4_2-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://firestreamww.webex.com/client/v_mywebex-t20/webex/ieatgpc.cab
TCP: Interfaces\{31B081FD-EF8C-4058-9792-0D57D444E950} : NameServer = 216.67.153.137,8.8.8.8
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: LMIinit - LMIinit.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\rmfred\application data\mozilla\firefox\profiles\xua8likb.default-1351791893336\
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\documents and settings\rmfred\application data\mozilla\plugins\npatgpc.dll
FF - plugin: c:\documents and settings\rmfred\local settings\application data\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\documents and settings\rmfred\local settings\application data\yahoo!\browserplus\2.9.8\plugins\npybrowserplus_2.9.8.dll
FF - plugin: c:\progra~1\mi7967~1\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\mi7967~1\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPJinit13117.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nprpplugin.dll
FF - plugin: c:\program files\picasa2\npPicasa2.dll
FF - plugin: c:\program files\picasa2\npPicasa3.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_4_402_287.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
FF - plugin: c:\windows\system32\npwmsdrm.dll
FF - ExtSQL: 2012-10-28 10:44; {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}; c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF - ExtSQL: 2012-11-01 11:52; {a7c6cf7f-112c-4500-a7ea-39801a327e5f}; c:\documents and settings\rmfred\application data\mozilla\firefox\profiles\xua8likb.default-1351791893336\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
FF - ExtSQL: 2012-11-01 12:05; [removed]; c:\documents and settings\rmfred\application data\mozilla\firefox\profiles\xua8likb.default-1351791893336\extensions\[removed]
.
============= SERVICES / DRIVERS ===============
.
R0 DKDFM;Device Filter Manager Driver;c:\windows\system32\drivers\DKDFM.sys [2012-6-29 35120]
R0 DKTLFSMF;Telemetry File System Mini Filter Driver;c:\windows\system32\drivers\DKTLFSMF.sys [2012-6-29 85328]
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-12-2 193552]
R0 nlem32nt;nlem32nt;c:\windows\system32\drivers\nlem32nt.sys [2010-6-15 70424]
R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [2007-10-18 3026]
R1 MpKsl1c9bad6d;MpKsl1c9bad6d;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8771e6a0-f21d-4d4d-b1da-a4ef3f3aee70}\MpKsl1c9bad6d.sys [2012-11-21 29904]
R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [2006-9-6 155392]
R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [2006-9-6 24832]
R1 SKMScan;SKMScan;c:\windows\system32\drivers\skmscan.sys [2012-7-25 31736]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-8-11 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2010-1-20 47640]
R2 msoidsvc;Microsoft Online Services Sign-in Assistant;c:\program files\common files\microsoft shared\microsoft online services\MSOIDSVC.EXE [2011-2-23 1578400]
R2 MSSQL$HPWJA;SQL Server (HPWJA);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2010-12-10 29293408]
R2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\sophos\sophos anti-virus\SAVAdminService.exe [2012-9-17 216640]
R2 SAVService;Sophos Anti-Virus;c:\program files\sophos\sophos anti-virus\SavService.exe [2012-7-25 139840]
R2 Sophos Agent;Sophos Agent;c:\program files\sophos\remote management system\ManagementAgentNT.exe [2012-9-17 289856]
R2 Sophos AutoUpdate Service;Sophos AutoUpdate Service;c:\program files\sophos\autoupdate\ALsvc.exe [2012-8-8 232512]
R2 Sophos Message Router;Sophos Message Router;c:\program files\sophos\remote management system\RouterNT.exe [2012-9-17 818240]
R2 Sophos Web Control Service;Sophos Web Control Service;c:\program files\sophos\sophos anti-virus\web control\swc_service.exe [2012-7-25 357400]
R2 swi_service;Sophos Web Intelligence Service;c:\program files\sophos\sophos anti-virus\web intelligence\swi_service.exe [2012-9-17 2863168]
R3 DKRtWrt;DKRtWrt;c:\windows\system32\drivers\DKRtWrt.sys [2012-6-29 44496]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 HPWJAService;HPWJA Service;c:\program files\hewlett-packard\web jetadmin 10\bin\HPWJAService.exe [2012-6-29 45056]
S2 HPWSProAdapter;HPWSProAdapter;c:\program files\hewlett-packard\web jetadmin 10\hpwsproadapter\filesystems\core\bin\xp-x86\release\HP.Dss.App.WinService.exe [2012-5-18 9728]
S2 swi_update;Sophos Web Intelligence Update;c:\documents and settings\all users\application data\sophos\web intelligence\swi_update.exe [2012-7-25 1465920]
S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys –> c:\windows\system32\drivers\motfilt.sys [?]
S3 chromoting;Chrome Remote Desktop Service;c:\program files\google\chrome remote desktop\1.9.1271.87\remoting_service.exe [2012-11-9 347160]
S3 cpuz135;cpuz135;\??\c:\windows\temp\cpuz135\cpuz135_x32.sys –> c:\windows\temp\cpuz135\cpuz135_x32.sys [?]
S3 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2010-11-14 374184]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys –> c:\windows\system32\drivers\motccgp.sys [?]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys –> c:\windows\system32\drivers\motccgpfl.sys [?]
S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\motousbnet.sys –> c:\windows\system32\drivers\Motousbnet.sys [?]
S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys –> c:\windows\system32\drivers\motusbdevice.sys [?]
S3 sdcfilter;sdcfilter;c:\windows\system32\drivers\sdcfilter.sys [2011-3-28 33696]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [2012-2-10 14976]
.
=============== File Associations ===============
.
ShellExec: MediaConverter.exe: open="c:\program files\sandisk\sansa media converter\uMediaConverter.exe" "%1"
.
=============== Created Last 30 ================
.
2012-11-21 19:15:04 60872 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8771e6a0-f21d-4d4d-b1da-a4ef3f3aee70}\offreg.dll
2012-11-21 19:15:04 29904 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8771e6a0-f21d-4d4d-b1da-a4ef3f3aee70}\MpKsl1c9bad6d.sys
2012-11-21 19:03:05 6812136 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8771e6a0-f21d-4d4d-b1da-a4ef3f3aee70}\mpengine.dll
2012-11-21 15:49:27 6812136 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2012-11-18 18:23:57 290304 —-a-w- C:\subinacl.exe
2012-11-18 18:13:05 ——– d—–w- C:\RegBackup
2012-11-18 17:59:38 116224 —-a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2012-11-18 17:59:37 23040 —-a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2012-11-18 17:59:35 27648 —-a-w- c:\windows\system32\dllcache\xrxftplt.exe
2012-11-18 17:59:35 18944 —-a-w- c:\windows\system32\dllcache\xrxscnui.dll
2012-11-18 17:59:34 4608 —-a-w- c:\windows\system32\dllcache\xrxflnch.exe
2012-11-18 17:59:08 99865 —-a-w- c:\windows\system32\dllcache\xlog.exe
2012-11-18 17:59:07 16970 —-a-w- c:\windows\system32\dllcache\xem336n5.sys
2012-11-18 17:58:58 8192 —-a-w- c:\windows\system32\dllcache\wshirda.dll
2012-11-18 17:58:22 8832 —-a-w- c:\windows\system32\dllcache\wmiacpi.sys
2012-11-18 17:58:17 34890 —-a-w- c:\windows\system32\dllcache\wlandrv2.sys
2012-11-18 17:58:17 154624 —-a-w- c:\windows\system32\dllcache\wlluc48.sys
2012-11-18 17:58:08 771581 —-a-w- c:\windows\system32\dllcache\winacisa.sys
2012-11-18 17:58:05 53760 —-a-w- c:\windows\system32\dllcache\wiamsmud.dll
2012-11-18 17:58:04 87040 —-a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2012-11-18 17:58:03 31232 —-a-w- c:\windows\system32\dllcache\weitekp9.sys
2012-11-18 17:58:02 41600 —-a-w- c:\windows\system32\dllcache\weitekp9.dll
2012-11-18 17:58:00 701386 —-a-w- c:\windows\system32\dllcache\wdhaalba.sys
2012-11-18 17:56:58 211968 —-a-w- c:\windows\system32\dllcache\um54scan.dll
2012-11-18 17:55:58 30464 —-a-w- c:\windows\system32\dllcache\tbatm155.sys
2012-11-18 17:54:59 7552 —-a-w- c:\windows\system32\dllcache\sonyait.sys
2012-11-18 17:53:55 161568 —-a-w- c:\windows\system32\dllcache\sgsmusb.sys
2012-11-18 17:52:59 166720 —-a-w- c:\windows\system32\dllcache\s3m.sys
2012-11-18 17:51:58 16128 —-a-w- c:\windows\system32\dllcache\pscr.sys
2012-11-18 17:50:55 198144 —-a-w- c:\windows\system32\dllcache\nv3.sys
2012-11-18 17:49:42 49024 —-a-w- c:\windows\system32\dllcache\mstape.sys
2012-11-18 17:49:38 12416 —-a-w- c:\windows\system32\dllcache\msriffwv.sys
2012-11-18 17:49:30 2944 —-a-w- c:\windows\system32\dllcache\msmpu401.sys
2012-11-18 17:49:28 22016 —-a-w- c:\windows\system32\dllcache\msircomm.sys
2012-11-18 17:49:16 6016 —-a-w- c:\windows\system32\dllcache\msfsio.sys
2012-11-18 17:49:16 35200 —-a-w- c:\windows\system32\dllcache\msgame.sys
2012-11-18 17:49:06 17280 —-a-w- c:\windows\system32\dllcache\mraid35x.sys
2012-11-18 17:47:59 48640 —-a-w- c:\windows\system32\dllcache\kdsui.dll
2012-11-18 17:46:46 372824 —-a-w- c:\windows\system32\dllcache\iconf32.dll
2012-11-18 17:45:59 20352 —-a-w- c:\windows\system32\dllcache\hidbatt.sys
2012-11-18 17:44:59 7040 —-a-w- c:\windows\system32\dllcache\exabyte2.sys
2012-11-18 17:43:59 8704 —-a-w- c:\windows\system32\dllcache\dot4scan.sys
2012-11-18 17:42:59 50176 —-a-w- c:\windows\system32\dllcache\cyyport.sys
2012-11-18 17:41:58 248064 —-a-w- c:\windows\system32\dllcache\cl546xm.sys
2012-11-18 17:40:59 5120 —-a-w- c:\windows\system32\dllcache\brscnrsm.dll
2012-11-18 17:39:59 75136 —-a-w- c:\windows\system32\dllcache\atimpae.sys
2012-11-18 17:38:59 61440 —-a-w- c:\windows\system32\dllcache\acerscad.dll
2012-11-18 17:37:16 66048 —-a-w- c:\windows\system32\dllcache\s3legacy.dll
2012-11-18 17:15:09 ——– d—–w- C:\Tweaking.com_Windows_Repair_Logs
2012-11-18 17:10:02 ——– d—–w- c:\program files\Tweaking.com
2012-11-16 22:30:41 ——– d—–w- c:\program files\Carbonite
2012-11-16 22:30:40 ——– d—–w- c:\documents and settings\all users\application data\Carbonite
2012-11-15 20:23:20 ——– d—–w- c:\documents and settings\rmfred\SyncFolder
2012-11-15 20:06:07 ——– d—–w- c:\program files\ZipCloud
2012-11-15 16:32:44 ——– d—–w- c:\documents and settings\rmfred\local settings\application data\PCHealth
2012-11-14 18:51:12 ——– d—–w- c:\program files\Dropbox
2012-11-08 18:28:47 ——– d—–w- c:\windows\system32\wbem\repository\FS
2012-11-08 18:28:47 ——– d—–w- c:\windows\system32\wbem\Repository
2012-11-08 18:28:18 ——– d—–w- c:\program files\3COM
2012-11-07 20:23:01 ——– d—–w- c:\program files\3COM(2)
2012-11-06 21:58:18 125712 —-a-w- c:\windows\system32\vb6de.dll
2012-11-06 21:58:18 102160 —-a-w- c:\windows\system32\vb6jp.dll
2012-11-06 21:58:10 67376 —-a-r- c:\windows\system32\SYSINFO.OCX
2012-11-06 21:58:07 525352 —-a-r- c:\windows\system32\DBGRID32.OCX
2012-11-06 19:25:09 70656 —-a-w- c:\windows\system32\u2lesbse.dll
2012-11-06 19:25:09 36864 —-a-w- c:\windows\system32\u2lexch.dll
2012-11-06 19:25:09 12288 —-a-w- c:\windows\system32\u2lfinra.dll
2012-11-06 19:25:08 49152 —-a-w- c:\windows\system32\u2l2000.dll
2012-11-06 19:25:08 40960 —-a-w- c:\windows\system32\u2lbar.dll
2012-11-06 19:25:08 38400 —-a-w- c:\windows\system32\u2ldts.dll
2012-11-06 19:25:08 151040 —-a-w- c:\windows\system32\u2lcom.dll
2012-11-06 19:25:03 125952 —-a-w- c:\windows\system32\u2fxls.dll
2012-11-06 19:25:03 118272 —-a-w- c:\windows\system32\u2fwordw.dll
2012-11-06 19:25:03 115712 —-a-w- c:\windows\system32\u2ftext.dll
2012-10-28 16:44:45 96224 —-a-w- c:\program files\mozilla firefox\webapprt-stub.exe
.
==================== Find3M ====================
.
2012-10-22 08:37:31 1866368 —-a-w- c:\windows\system32\win32k.sys
2012-10-09 12:52:33 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-09 12:52:33 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-02 18:04:21 58368 —-a-w- c:\windows\system32\synceng.dll
2012-09-30 01:54:26 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-08-31 04:03:50 193552 —-a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-28 15:14:53 916992 —-a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14:53 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14:52 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07:15 385024 —-a-w- c:\windows\system32\html.iec
2012-08-24 13:53:22 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-07-29 15:47:56 10974280 —-a-w- c:\program files\common files\lpuninstall.exe
.
============= FINISH: 15:45:04.84 ===============
After running WR-AIO as per this topic: http://forums.whatthetech.com/index.php?showtopic=124885; my anti-virus (Sophos) detected and reported the following errors:
\\.\GlobalRoot\Device\Harddisk\VolumeShadowCopy1\Documents and Settings\username\recent\windows repair.lnk
\\.\GlobalRoot\Device\Harddisk\VolumeShadowCopy2\Documents and Settings\username\recent\windows repair.lnk
Uninstalling WR-AIO took care of the constant Sophos errors.
After uninstalling WR-AIO I got the following error from Sophos regarding something called psExec:
C:\System Volume Information\_restore{4617D869-6DFF-4342-BE3F-6D5D37A05BC1}\RP11\A0011920.exe
C:\System Volume Information\_restore{4617D869-6DFF-4342-BE3F-6D5D37A05BC1}\RP11\A0011920.exe\FILE:0000
I let Sophos "clean it up" and no longer received the error.
Today, I ran a scan with Malwarebytes and received this error from Sophos; Adware or PUA (psExec) hacking tool located at
C:\WINDOWS\PSEXESVC.EXE - item quarantined
I have submitted the file to Sophos for review.
Here is the result of running DDS:
DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_33
Run by [removed] at 15:42:28 on 2012-11-21
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2039.1011 [GMT -7:00]
.
AV: Sophos Anti-Virus *Disabled/Updated* {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
.
============== Running Processes ================
.
C:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\Condusiv Technologies\Diskeeper\DkService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Update\1.3.21.123\GoogleCrashHandler.exe
C:\Program Files\Sophos\AutoUpdate\almon.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Documents and Settings\rmfred\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\LMabcoms.exe
C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSvcm.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\Program Files\Sophos\Remote Management System\RouterNT.exe
C:\Program Files\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\vssvc.exe
C:\WINDOWS\System32\dllhost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\msdtc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
C:\Documents and Settings\rmfred\Local Settings\Application Data\Google\Update\1.3.21.123\GoogleCrashHandler.exe
C:\program files\real\realplayer\update\realsched.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
c:\program files\real\realplayer\RealPlay.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\svchost.exe -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\WINDOWS\system32\svchost.exe -k netsvcs
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = iexplore
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: LastPass Vault: {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - c:\program files\lastpass\LPToolbar.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office 2010\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - c:\program files\lastpass\LPToolbar.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} -
uRun: [SansaDispatch] c:\documents and settings\rmfred\application data\sandisk\sansa updater\SansaDispatch.exe
uRun: [StrgSync.exe] c:\program files\storagesync\StrgSync.exe -w
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\FlashUtil32_11_4_402_287_Plugin.exe -update plugin
mRun: [Sophos AutoUpdate Monitor] c:\program files\sophos\autoupdate\almon.exe
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [TkBellExe] "c:\program files\real\realplayer\update\realsched.exe" -osboot
mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe
dRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
uPolicies-Explorer: NoThumbnailCache = dword:1
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: shutdownnotificationflags = dword:-1014642277
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
IE: E&xport to Microsoft Excel - c:\progra~1\mi7967~1\office14\EXCEL.EXE/3000
IE: LastPass - c:\documents and settings\rmfred\local settings\application data\lastpass\context.html?cmd=lastpass
IE: LastPass Fill Forms - c:\documents and settings\rmfred\local settings\application data\lastpass\context.html?cmd=fillforms
IE: Se&nd to OneNote - c:\progra~1\mi7967~1\office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office 2010\office14\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\program files\microsoft activesync\INetRepl.dll
IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - c:\program files\lastpass\LPToolbar.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office 2010\office14\ONBttnIELinkedNotes.dll
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
LSP: c:\documents and settings\all users\application data\sophos\web intelligence\swi_ifslsp.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {32505657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/A/9/0A9F8B32-9F8C-4D74-A130-E4CAB36EB01F/wmvadvd.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1262041079509
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1347905419839
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {93D532DD-85FC-4A92-8254-8DB5437D8690} - hxxp://mcarimgweb01.mclaneco.com/ECdocs/activex/OBXPopup.cab
DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} - hxxp://javadl-esd.sun.com/update/1.4.2/jinstall-1_4_2-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://firestreamww.webex.com/client/v_mywebex-t20/webex/ieatgpc.cab
TCP: Interfaces\{31B081FD-EF8C-4058-9792-0D57D444E950} : NameServer = 216.67.153.137,8.8.8.8
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: LMIinit - LMIinit.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\rmfred\application data\mozilla\firefox\profiles\xua8likb.default-1351791893336\
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprpchromebrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\documents and settings\rmfred\application data\mozilla\plugins\npatgpc.dll
FF - plugin: c:\documents and settings\rmfred\local settings\application data\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\documents and settings\rmfred\local settings\application data\yahoo!\browserplus\2.9.8\plugins\npybrowserplus_2.9.8.dll
FF - plugin: c:\progra~1\mi7967~1\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\mi7967~1\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPJinit13117.dll
FF - plugin: c:\program files\mozilla firefox\plugins\nprpplugin.dll
FF - plugin: c:\program files\picasa2\npPicasa2.dll
FF - plugin: c:\program files\picasa2\npPicasa3.dll
FF - plugin: c:\program files\real\realplayer\netscape6\nprpplugin.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_4_402_287.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
FF - plugin: c:\windows\system32\npwmsdrm.dll
FF - ExtSQL: 2012-10-28 10:44; {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}; c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF - ExtSQL: 2012-11-01 11:52; {a7c6cf7f-112c-4500-a7ea-39801a327e5f}; c:\documents and settings\rmfred\application data\mozilla\firefox\profiles\xua8likb.default-1351791893336\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}.xpi
FF - ExtSQL: 2012-11-01 12:05; [removed]; c:\documents and settings\rmfred\application data\mozilla\firefox\profiles\xua8likb.default-1351791893336\extensions\[removed]
.
============= SERVICES / DRIVERS ===============
.
R0 DKDFM;Device Filter Manager Driver;c:\windows\system32\drivers\DKDFM.sys [2012-6-29 35120]
R0 DKTLFSMF;Telemetry File System Mini Filter Driver;c:\windows\system32\drivers\DKTLFSMF.sys [2012-6-29 85328]
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-12-2 193552]
R0 nlem32nt;nlem32nt;c:\windows\system32\drivers\nlem32nt.sys [2010-6-15 70424]
R1 hwinterface;hwinterface;c:\windows\system32\drivers\hwinterface.sys [2007-10-18 3026]
R1 MpKsl1c9bad6d;MpKsl1c9bad6d;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8771e6a0-f21d-4d4d-b1da-a4ef3f3aee70}\MpKsl1c9bad6d.sys [2012-11-21 29904]
R1 SAVOnAccessControl;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [2006-9-6 155392]
R1 SAVOnAccessFilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [2006-9-6 24832]
R1 SKMScan;SKMScan;c:\windows\system32\drivers\skmscan.sys [2012-7-25 31736]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-8-11 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2010-1-20 47640]
R2 msoidsvc;Microsoft Online Services Sign-in Assistant;c:\program files\common files\microsoft shared\microsoft online services\MSOIDSVC.EXE [2011-2-23 1578400]
R2 MSSQL$HPWJA;SQL Server (HPWJA);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2010-12-10 29293408]
R2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\sophos\sophos anti-virus\SAVAdminService.exe [2012-9-17 216640]
R2 SAVService;Sophos Anti-Virus;c:\program files\sophos\sophos anti-virus\SavService.exe [2012-7-25 139840]
R2 Sophos Agent;Sophos Agent;c:\program files\sophos\remote management system\ManagementAgentNT.exe [2012-9-17 289856]
R2 Sophos AutoUpdate Service;Sophos AutoUpdate Service;c:\program files\sophos\autoupdate\ALsvc.exe [2012-8-8 232512]
R2 Sophos Message Router;Sophos Message Router;c:\program files\sophos\remote management system\RouterNT.exe [2012-9-17 818240]
R2 Sophos Web Control Service;Sophos Web Control Service;c:\program files\sophos\sophos anti-virus\web control\swc_service.exe [2012-7-25 357400]
R2 swi_service;Sophos Web Intelligence Service;c:\program files\sophos\sophos anti-virus\web intelligence\swi_service.exe [2012-9-17 2863168]
R3 DKRtWrt;DKRtWrt;c:\windows\system32\drivers\DKRtWrt.sys [2012-6-29 44496]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 HPWJAService;HPWJA Service;c:\program files\hewlett-packard\web jetadmin 10\bin\HPWJAService.exe [2012-6-29 45056]
S2 HPWSProAdapter;HPWSProAdapter;c:\program files\hewlett-packard\web jetadmin 10\hpwsproadapter\filesystems\core\bin\xp-x86\release\HP.Dss.App.WinService.exe [2012-5-18 9728]
S2 swi_update;Sophos Web Intelligence Update;c:\documents and settings\all users\application data\sophos\web intelligence\swi_update.exe [2012-7-25 1465920]
S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys –> c:\windows\system32\drivers\motfilt.sys [?]
S3 chromoting;Chrome Remote Desktop Service;c:\program files\google\chrome remote desktop\1.9.1271.87\remoting_service.exe [2012-11-9 347160]
S3 cpuz135;cpuz135;\??\c:\windows\temp\cpuz135\cpuz135_x32.sys –> c:\windows\temp\cpuz135\cpuz135_x32.sys [?]
S3 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2010-11-14 374184]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys –> c:\windows\system32\drivers\motccgp.sys [?]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys –> c:\windows\system32\drivers\motccgpfl.sys [?]
S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\motousbnet.sys –> c:\windows\system32\drivers\Motousbnet.sys [?]
S3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\drivers\motusbdevice.sys –> c:\windows\system32\drivers\motusbdevice.sys [?]
S3 sdcfilter;sdcfilter;c:\windows\system32\drivers\sdcfilter.sys [2011-3-28 33696]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [2012-2-10 14976]
.
=============== File Associations ===============
.
ShellExec: MediaConverter.exe: open="c:\program files\sandisk\sansa media converter\uMediaConverter.exe" "%1"
.
=============== Created Last 30 ================
.
2012-11-21 19:15:04 60872 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8771e6a0-f21d-4d4d-b1da-a4ef3f3aee70}\offreg.dll
2012-11-21 19:15:04 29904 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8771e6a0-f21d-4d4d-b1da-a4ef3f3aee70}\MpKsl1c9bad6d.sys
2012-11-21 19:03:05 6812136 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{8771e6a0-f21d-4d4d-b1da-a4ef3f3aee70}\mpengine.dll
2012-11-21 15:49:27 6812136 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2012-11-18 18:23:57 290304 —-a-w- C:\subinacl.exe
2012-11-18 18:13:05 ——– d—–w- C:\RegBackup
2012-11-18 17:59:38 116224 —-a-w- c:\windows\system32\dllcache\xrxwiadr.dll
2012-11-18 17:59:37 23040 —-a-w- c:\windows\system32\dllcache\xrxwbtmp.dll
2012-11-18 17:59:35 27648 —-a-w- c:\windows\system32\dllcache\xrxftplt.exe
2012-11-18 17:59:35 18944 —-a-w- c:\windows\system32\dllcache\xrxscnui.dll
2012-11-18 17:59:34 4608 —-a-w- c:\windows\system32\dllcache\xrxflnch.exe
2012-11-18 17:59:08 99865 —-a-w- c:\windows\system32\dllcache\xlog.exe
2012-11-18 17:59:07 16970 —-a-w- c:\windows\system32\dllcache\xem336n5.sys
2012-11-18 17:58:58 8192 —-a-w- c:\windows\system32\dllcache\wshirda.dll
2012-11-18 17:58:22 8832 —-a-w- c:\windows\system32\dllcache\wmiacpi.sys
2012-11-18 17:58:17 34890 —-a-w- c:\windows\system32\dllcache\wlandrv2.sys
2012-11-18 17:58:17 154624 —-a-w- c:\windows\system32\dllcache\wlluc48.sys
2012-11-18 17:58:08 771581 —-a-w- c:\windows\system32\dllcache\winacisa.sys
2012-11-18 17:58:05 53760 —-a-w- c:\windows\system32\dllcache\wiamsmud.dll
2012-11-18 17:58:04 87040 —-a-w- c:\windows\system32\dllcache\wiafbdrv.dll
2012-11-18 17:58:03 31232 —-a-w- c:\windows\system32\dllcache\weitekp9.sys
2012-11-18 17:58:02 41600 —-a-w- c:\windows\system32\dllcache\weitekp9.dll
2012-11-18 17:58:00 701386 —-a-w- c:\windows\system32\dllcache\wdhaalba.sys
2012-11-18 17:56:58 211968 —-a-w- c:\windows\system32\dllcache\um54scan.dll
2012-11-18 17:55:58 30464 —-a-w- c:\windows\system32\dllcache\tbatm155.sys
2012-11-18 17:54:59 7552 —-a-w- c:\windows\system32\dllcache\sonyait.sys
2012-11-18 17:53:55 161568 —-a-w- c:\windows\system32\dllcache\sgsmusb.sys
2012-11-18 17:52:59 166720 —-a-w- c:\windows\system32\dllcache\s3m.sys
2012-11-18 17:51:58 16128 —-a-w- c:\windows\system32\dllcache\pscr.sys
2012-11-18 17:50:55 198144 —-a-w- c:\windows\system32\dllcache\nv3.sys
2012-11-18 17:49:42 49024 —-a-w- c:\windows\system32\dllcache\mstape.sys
2012-11-18 17:49:38 12416 —-a-w- c:\windows\system32\dllcache\msriffwv.sys
2012-11-18 17:49:30 2944 —-a-w- c:\windows\system32\dllcache\msmpu401.sys
2012-11-18 17:49:28 22016 —-a-w- c:\windows\system32\dllcache\msircomm.sys
2012-11-18 17:49:16 6016 —-a-w- c:\windows\system32\dllcache\msfsio.sys
2012-11-18 17:49:16 35200 —-a-w- c:\windows\system32\dllcache\msgame.sys
2012-11-18 17:49:06 17280 —-a-w- c:\windows\system32\dllcache\mraid35x.sys
2012-11-18 17:47:59 48640 —-a-w- c:\windows\system32\dllcache\kdsui.dll
2012-11-18 17:46:46 372824 —-a-w- c:\windows\system32\dllcache\iconf32.dll
2012-11-18 17:45:59 20352 —-a-w- c:\windows\system32\dllcache\hidbatt.sys
2012-11-18 17:44:59 7040 —-a-w- c:\windows\system32\dllcache\exabyte2.sys
2012-11-18 17:43:59 8704 —-a-w- c:\windows\system32\dllcache\dot4scan.sys
2012-11-18 17:42:59 50176 —-a-w- c:\windows\system32\dllcache\cyyport.sys
2012-11-18 17:41:58 248064 —-a-w- c:\windows\system32\dllcache\cl546xm.sys
2012-11-18 17:40:59 5120 —-a-w- c:\windows\system32\dllcache\brscnrsm.dll
2012-11-18 17:39:59 75136 —-a-w- c:\windows\system32\dllcache\atimpae.sys
2012-11-18 17:38:59 61440 —-a-w- c:\windows\system32\dllcache\acerscad.dll
2012-11-18 17:37:16 66048 —-a-w- c:\windows\system32\dllcache\s3legacy.dll
2012-11-18 17:15:09 ——– d—–w- C:\Tweaking.com_Windows_Repair_Logs
2012-11-18 17:10:02 ——– d—–w- c:\program files\Tweaking.com
2012-11-16 22:30:41 ——– d—–w- c:\program files\Carbonite
2012-11-16 22:30:40 ——– d—–w- c:\documents and settings\all users\application data\Carbonite
2012-11-15 20:23:20 ——– d—–w- c:\documents and settings\rmfred\SyncFolder
2012-11-15 20:06:07 ——– d—–w- c:\program files\ZipCloud
2012-11-15 16:32:44 ——– d—–w- c:\documents and settings\rmfred\local settings\application data\PCHealth
2012-11-14 18:51:12 ——– d—–w- c:\program files\Dropbox
2012-11-08 18:28:47 ——– d—–w- c:\windows\system32\wbem\repository\FS
2012-11-08 18:28:47 ——– d—–w- c:\windows\system32\wbem\Repository
2012-11-08 18:28:18 ——– d—–w- c:\program files\3COM
2012-11-07 20:23:01 ——– d—–w- c:\program files\3COM(2)
2012-11-06 21:58:18 125712 —-a-w- c:\windows\system32\vb6de.dll
2012-11-06 21:58:18 102160 —-a-w- c:\windows\system32\vb6jp.dll
2012-11-06 21:58:10 67376 —-a-r- c:\windows\system32\SYSINFO.OCX
2012-11-06 21:58:07 525352 —-a-r- c:\windows\system32\DBGRID32.OCX
2012-11-06 19:25:09 70656 —-a-w- c:\windows\system32\u2lesbse.dll
2012-11-06 19:25:09 36864 —-a-w- c:\windows\system32\u2lexch.dll
2012-11-06 19:25:09 12288 —-a-w- c:\windows\system32\u2lfinra.dll
2012-11-06 19:25:08 49152 —-a-w- c:\windows\system32\u2l2000.dll
2012-11-06 19:25:08 40960 —-a-w- c:\windows\system32\u2lbar.dll
2012-11-06 19:25:08 38400 —-a-w- c:\windows\system32\u2ldts.dll
2012-11-06 19:25:08 151040 —-a-w- c:\windows\system32\u2lcom.dll
2012-11-06 19:25:03 125952 —-a-w- c:\windows\system32\u2fxls.dll
2012-11-06 19:25:03 118272 —-a-w- c:\windows\system32\u2fwordw.dll
2012-11-06 19:25:03 115712 —-a-w- c:\windows\system32\u2ftext.dll
2012-10-28 16:44:45 96224 —-a-w- c:\program files\mozilla firefox\webapprt-stub.exe
.
==================== Find3M ====================
.
2012-10-22 08:37:31 1866368 —-a-w- c:\windows\system32\win32k.sys
2012-10-09 12:52:33 73656 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-10-09 12:52:33 696760 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2012-10-02 18:04:21 58368 —-a-w- c:\windows\system32\synceng.dll
2012-09-30 01:54:26 22856 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-08-31 04:03:50 193552 —-a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-28 15:14:53 916992 —-a-w- c:\windows\system32\wininet.dll
2012-08-28 15:14:53 43520 —-a-w- c:\windows\system32\licmgr10.dll
2012-08-28 15:14:52 1469440 —-a-w- c:\windows\system32\inetcpl.cpl
2012-08-28 12:07:15 385024 —-a-w- c:\windows\system32\html.iec
2012-08-24 13:53:22 177664 —-a-w- c:\windows\system32\wintrust.dll
2012-07-29 15:47:56 10974280 —-a-w- c:\program files\common files\lpuninstall.exe
.
============= FINISH: 15:45:04.84 ===============