What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

ICE Cyber Crime virus on Windows XP [Solved]

36 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16

RogueKiller V9.2.9.0 [Jul 11 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : https://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows XP (5.1.2600 Service Pack 2) 32 bits version
Started in : Normal mode
User : Joe Blow [Admin rights]
Mode : Scan – Date : 09/05/2014  09:13:53

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 13 ¤¤¤
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 192.168.0.1 [removed]  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 192.168.0.1 [removed]  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 192.168.0.1 [removed]  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters | DhcpNameServer : 192.168.0.1 [removed]  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{133E1BE7-4823-45B8-A4D6-09AE514650DC} | DhcpNameServer : 192.168.0.1 [removed]  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{133E1BE7-4823-45B8-A4D6-09AE514650DC} | DhcpNameServer : 192.168.0.1 [removed]  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{133E1BE7-4823-45B8-A4D6-09AE514650DC} | DhcpNameServer : 192.168.0.1 [removed]  -> FOUND
[PUM.Dns] HKEY_LOCAL_MACHINE\System\ControlSet003\Services\Tcpip\Parameters\Interfaces\{133E1BE7-4823-45B8-A4D6-09AE514650DC} | DhcpNameServer : 192.168.0.1 [removed]  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2291903390-3433162778-840360825-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowPrinters : 0  -> FOUND
[PUM.StartMenu] HKEY_USERS\S-1-5-21-2291903390-3433162778-840360825-1006\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 0  -> FOUND
[PUM.DesktopIcons] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1  -> FOUND
[Rans.Gendarm] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\winmgmt\Parameters | ServiceDll : C:\DOCUME~1\ALLUSE~1\APPLIC~1\50BC232.cpp  -> FOUND
[PUM.SearchPage] HKEY_USERS\S-1-5-21-2291903390-3433162778-840360825-1006\Software\Microsoft\Internet Explorer\Main | Search Page : http://rd.yahoo.com/customize/yessentials_cq/defaults/sp/*http://www.yahoo.com  -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 1 ¤¤¤
[C:\WINDOWS\System32\drivers\etc\hosts] 127.0.0.1       localhost

¤¤¤ Antirootkit : 44 (Driver: LOADED) ¤¤¤
[SSDT:Addr(Hook.SSDT)] NtAlertResumeThread[12] : Unknown @ 0x87057f38
[SSDT:Addr(Hook.SSDT)] NtAlertThread[13] : Unknown @ 0x87057fd0
[SSDT:Addr(Hook.SSDT)] NtAllocateVirtualMemory[17] : Unknown @ 0x86d5e3c0
[SSDT:Addr(Hook.SSDT)] NtAssignProcessToJobObject[19] : Unknown @ 0x86f43458
[SSDT:Addr(Hook.SSDT)] NtConnectPort[31] : Unknown @ 0x8714e1f8
[SSDT:Addr(Hook.SSDT)] NtCreateMutant[43] : Unknown @ 0x870bd4a8
[SSDT:Addr(Hook.SSDT)] NtCreateSymbolicLinkObject[52] : Unknown @ 0x86f43308
[SSDT:Addr(Hook.SSDT)] NtCreateThread[53] : Unknown @ 0x86e98da8
[SSDT:Addr(Hook.SSDT)] NtDebugActiveProcess[57] : Unknown @ 0x87073448
[SSDT:Addr(Hook.SSDT)] NtDuplicateObject[68] : Unknown @ 0x870955b8
[SSDT:Addr(Hook.SSDT)] NtFreeVirtualMemory[83] : Unknown @ 0x870cbbe0
[SSDT:Addr(Hook.SSDT)] NtImpersonateAnonymousToken[89] : Unknown @ 0x87057e08
[SSDT:Addr(Hook.SSDT)] NtImpersonateThread[91] : Unknown @ 0x87057ea0
[SSDT:Addr(Hook.SSDT)] NtLoadDriver[97] : Unknown @ 0x8716adf0
[SSDT:Addr(Hook.SSDT)] NtMapViewOfSection[108] : Unknown @ 0x870cbb28
[SSDT:Addr(Hook.SSDT)] NtOpenEvent[114] : Unknown @ 0x870bd410
[SSDT:Addr(Hook.SSDT)] NtOpenProcess[122] : Unknown @ 0x86f3cbb0
[SSDT:Addr(Hook.SSDT)] NtOpenProcessToken[123] : Unknown @ 0x87095520
[SSDT:Addr(Hook.SSDT)] NtOpenSection[125] : Unknown @ 0x87073598
[SSDT:Addr(Hook.SSDT)] NtOpenThread[128] : Unknown @ 0x86f3cb28
[SSDT:Addr(Hook.SSDT)] NtProtectVirtualMemory[137] : Unknown @ 0x86f433b0
[SSDT:Addr(Hook.SSDT)] NtQueueApcThread[180] : Unknown @ 0x8704d890
[SSDT:Addr(Hook.SSDT)] NtResumeThread[206] : Unknown @ 0x86eb6e80
[SSDT:Addr(Hook.SSDT)] NtSetContextThread[213] : Unknown @ 0x87084460
[SSDT:Addr(Hook.SSDT)] NtSetInformationProcess[228] : Unknown @ 0x870844f8
[SSDT:Addr(Hook.SSDT)] NtSetSystemInformation[240] : Unknown @ 0x870734e0
[SSDT:Addr(Hook.SSDT)] NtSuspendProcess[253] : Unknown @ 0x870bd378
[SSDT:Addr(Hook.SSDT)] NtSuspendThread[254] : Unknown @ 0x86eb6f18
[SSDT:Addr(Hook.SSDT)] NtTerminateProcess[257] : Unknown @ 0x870bf310
[SSDT:Addr(Hook.SSDT)] NtTerminateThread[258] : Unknown @ 0x86eb6f90
[SSDT:Addr(Hook.SSDT)] NtUnmapViewOfSection[267] : Unknown @ 0x870845a0
[SSDT:Addr(Hook.SSDT)] NtWriteVirtualMemory[277] : Unknown @ 0x86d5e318
[ShwSSDT:Addr(Hook.Shadow)] NtUserAttachThreadInput[307] : Unknown @ 0x870c1ac0
[ShwSSDT:Addr(Hook.Shadow)] NtUserGetAsyncKeyState[383] : Unknown @ 0x870c7ae0
[ShwSSDT:Addr(Hook.Shadow)] NtUserGetKeyboardState[414] : Unknown @ 0x86d697b0
[ShwSSDT:Addr(Hook.Shadow)] NtUserGetKeyState[416] : Unknown @ 0x870c7b58
[ShwSSDT:Addr(Hook.Shadow)] NtUserGetRawInputData[428] : Unknown @ 0x870c1a38
[ShwSSDT:Addr(Hook.Shadow)] NtUserMessageCall[460] : Unknown @ 0x86eff288
[ShwSSDT:Addr(Hook.Shadow)] NtUserPostMessage[475] : Unknown @ 0x86d69728
[ShwSSDT:Addr(Hook.Shadow)] NtUserPostThreadMessage[476] : Unknown @ 0x86eff310
[ShwSSDT:Addr(Hook.Shadow)] NtUserSetWindowsHookEx[549] : Unknown @ 0x86f37290
[ShwSSDT:Addr(Hook.Shadow)] NtUserSetWinEventHook[552] : Unknown @ 0x86d6b8a0
[Filter(Kernel.Filter)] \Driver\atapi @ \Device\CdRom1 : \Driver\redbook @ Unknown (\SystemRoot\System32\DRIVERS\redbook.sys)
[Filter(Kernel.Filter)] \Driver\atapi @ \Device\CdRom0 : \Driver\redbook @ Unknown (\SystemRoot\System32\DRIVERS\redbook.sys)

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: SAMSUNG SV1204H +++++
— User —
[MBR] f805a109462a5da52bf7725f32d6a765
[BSP] 44e76c70a7a409e06dba851ad28fef86 : Unknown MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 114485 MB
User = LL1 … OK
User = LL2 … OK

============================================
RKreport_SCN_09052014_073613.log

Post #17

When I ran FRST.exe    Norton blocked it and removed it..

 

Here is the norton message

 

Filename: frst.exe
Threat name: SONAR.Heuristic.120Full Path: Not Available

____________________________

Details
Very Few Users,  Very New,  Risk High

Origin
Downloaded from
 Unknown

Activity
Actions performed: 6

____________________________

On computers as of 9/5/2014 at 9:15:02 AM
Last Used 9/5/2014 at 9:15:02 AM
Startup Item No
Launched Yes

____________________________

Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.

SONAR Protection monitors for suspicious program activity on your computer.

____________________________

Source: External Media

Source File:
frst.exe

____________________________

File Actions

File: c:\documents and settings\joe blow\desktop\frst.exe
Removed
____________________________

Network Actions

Event: Network activity (Performed by c:\documents and settings\joe blow\desktop\frst.exe, PID:4056)
No action taken
____________________________

System Settings Actions

Event: Browser process start (Performed by c:\documents and settings\joe blow\desktop\frst.exe, PID:4056)
No action taken
(Performed by c:\documents and settings\joe blow\desktop\frst.exe, PID:4056)
No action taken
Event: Process start: c:\documents and settings\joe blow\desktop\frst.exe, PID:4056 (Performed by c:\documents and settings\joe blow\desktop\frst.exe, PID:4056)
No action taken
____________________________

Suspicious Actions

(Performed by c:\documents and settings\joe blow\desktop\frst.exe, PID:4056)
No action taken
____________________________

File Thumbprint - SHA:
Not available
File Thumbprint - MD5:
Not available

Post #19

Hi Larry, 

 

This is a false-positive, and can be ignored. 

 

Either restore FRST, or temporarily disable Norton (right-click the Norton icon in your System Tray and select Temporarily Disable). 

Post #20

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-09-2014
Ran by [removed] at 2014-09-05 09:32:26
Running from C:\Documents and Settings\[removed]\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Norton Internet Security (Disabled - Up to date) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security (Disabled) {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat 5.0 (HKLM\…\Adobe Acrobat 5.0) (Version: 5.0 - Adobe Systems, Inc.)
Adobe Flash Player 14 ActiveX (HKLM\…\Adobe Flash Player ActiveX) (Version: 14.0.0.176 - Adobe Systems Incorporated)
Intel(R) 845G Chipset Graphics Driver Software (HKLM\…\{8A708DD8-A5E6-11D4-A706-000629E95E20}) (Version:  - )
InterVideo WinDVD (HKLM\…\{C1939820-A945-11D4-86F6-0001031E5712}) (Version:  - InterVideo Inc.)
Java 2 Runtime Environment Standard Edition v1.3.1 (HKLM\…\JRE 1.3.1) (Version:  - )
Norton Internet Security (HKLM\…\NIS) (Version: 21.5.0.19 - Symantec Corporation)
NVIDIA Windows 2000/XP Display Drivers (HKLM\…\NVIDIA) (Version:  - )
outobox (HKLM\…\outobox) (Version: 2013.12.07.011955 - outobox) <==== ATTENTION
Python 2.2 combined Win32 extensions (HKLM\…\Python 2.2 combined Win32 extensions) (Version:  - )
Python 2.2.1 (HKLM\…\Python 2.2.1) (Version: 2.2.1 - PythonLabs at Zope Corporation)
S3Display (HKLM\…\S3Display) (Version:  - )
S3Gamma2 (HKLM\…\S3Gamma2) (Version:  - )
S3Info2 (HKLM\…\S3Info2) (Version:  - )
S3Overlay (HKLM\…\S3Overlay) (Version:  - )
Viewpoint Media Player (Remove Only) (HKLM\…\ViewpointMediaPlayer) (Version:  - )
WebFldrs XP (Version: 9.50.5318 - Microsoft Corporation) Hidden
Windows Internet Explorer 8 (HKLM\…\ie8) (Version: 20090308.140743 - Microsoft Corporation)
Windows XP Service Pack 2 (HKLM\…\Windows XP Service Pack) (Version: 20040803.231319 - Microsoft Corporation)
Works Suite OS Pack (Version: 1.0.0.0000 - Microsoft Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

==================== Restore Points  =========================

24-01-2014 20:01:08 System Checkpoint
23-03-2014 20:26:15 System Checkpoint
12-04-2014 17:33:06 System Checkpoint
13-04-2014 18:14:36 System Checkpoint
14-04-2014 18:27:35 System Checkpoint
03-09-2014 01:19:53 System Checkpoint

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2002-08-01 19:32 - 2001-08-18 12:00 - 00000734 ____A C:\WINDOWS\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\Registration reminder 2.job => C:\WINDOWS\System32\OOBE\oobebaln.exe
Task: C:\WINDOWS\Tasks\Registration reminder 3.job => C:\WINDOWS\System32\OOBE\oobebaln.exe

==================== Loaded Modules (whitelisted) =============

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SMR410 => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\UploadMgr => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (09/04/2014 01:53:36 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (09/04/2014 01:53:35 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: This network connection does not exist.

Error: (09/04/2014 01:53:35 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved

Error: (09/04/2014 01:53:11 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved

Error: (09/04/2014 01:52:28 PM) (Source: crypt32) (EventID: 8) (User: )
Description: Failed auto update retrieval of third-party root list sequence number from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt> with error: The server name or address could not be resolved

Error: (08/25/2014 08:59:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module cowpplg.dll, version 2014.7.6.15, fault address 0x0000a7c9.
Processing media-specific event for [iexplore.exe!ws!]

Error: (06/04/2014 00:26:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module mshtml.dll, version 8.0.6001.18702, fault address 0x00265067.
Processing media-specific event for [iexplore.exe!ws!]

Error: (04/19/2014 09:05:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module msvcr100.dll, version 10.0.40219.325, fault address 0x00001fd0.
Processing media-specific event for [iexplore.exe!ws!]

Error: (04/19/2014 09:04:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module mshtml.dll, version 8.0.6001.18702, fault address 0x001c3837.
Processing media-specific event for [iexplore.exe!ws!]

Error: (04/10/2014 00:04:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application iexplore.exe, version 8.0.6001.18702, faulting module jvm.dll, version 0.0.0.0, fault address 0x000495ba.
Processing media-specific event for [iexplore.exe!ws!]

System errors:
=============
Error: (09/05/2014 09:03:33 AM) (Source: Dhcp) (EventID: 1002) (User: )
Description: The IP address lease 192.168.0.16 for the Network Card with network address 42FEAFE13152 has been
denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).

Error: (09/05/2014 09:02:28 AM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)
Description: DCOM got error "%%1084" attempting to start the service EventSystem with arguments ""
in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

Error: (09/05/2014 07:35:30 AM) (Source: DCOM) (EventID: 10010) (User: OLD_DESK_TOP)
Description: The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register with DCOM within the required timeout.

Error: (09/05/2014 07:34:59 AM) (Source: DCOM) (EventID: 10010) (User: OLD_DESK_TOP)
Description: The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register with DCOM within the required timeout.

Error: (09/05/2014 07:34:29 AM) (Source: DCOM) (EventID: 10010) (User: OLD_DESK_TOP)
Description: The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register with DCOM within the required timeout.

Error: (09/05/2014 07:33:59 AM) (Source: DCOM) (EventID: 10010) (User: OLD_DESK_TOP)
Description: The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register with DCOM within the required timeout.

Error: (09/05/2014 07:33:29 AM) (Source: DCOM) (EventID: 10010) (User: OLD_DESK_TOP)
Description: The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register with DCOM within the required timeout.

Error: (09/05/2014 07:32:59 AM) (Source: DCOM) (EventID: 10010) (User: OLD_DESK_TOP)
Description: The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register with DCOM within the required timeout.

Error: (09/05/2014 07:32:29 AM) (Source: DCOM) (EventID: 10010) (User: OLD_DESK_TOP)
Description: The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register with DCOM within the required timeout.

Error: (09/05/2014 07:31:59 AM) (Source: DCOM) (EventID: 10010) (User: OLD_DESK_TOP)
Description: The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register with DCOM within the required timeout.

Microsoft Office Sessions:
=========================
Error: (09/04/2014 01:53:36 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (09/04/2014 01:53:35 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThis network connection does not exist.

Error: (09/04/2014 01:53:35 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThe server name or address could not be resolved

Error: (09/04/2014 01:53:11 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThe server name or address could not be resolved

Error: (09/04/2014 01:52:28 PM) (Source: crypt32) (EventID: 8) (User: )
Description: http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txtThe server name or address could not be resolved

Error: (08/25/2014 08:59:25 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe8.0.6001.18702cowpplg.dll2014.7.6.150000a7c9

Error: (06/04/2014 00:26:16 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe8.0.6001.18702mshtml.dll8.0.6001.1870200265067

Error: (04/19/2014 09:05:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe8.0.6001.18702msvcr100.dll10.0.40219.32500001fd0

Error: (04/19/2014 09:04:07 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe8.0.6001.18702mshtml.dll8.0.6001.18702001c3837

Error: (04/10/2014 00:04:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: iexplore.exe8.0.6001.18702jvm.dll0.0.0.0000495ba

==================== Memory info ===========================

Processor:  Intel(R) Pentium(R) 4 CPU 2.53GHz
Percentage of memory in use: 35%
Total physical RAM: 1023.49 MB
Available physical RAM: 657.87 MB
Total Pagefile: 2461.27 MB
Available Pagefile: 2197.87 MB
Total Virtual: 2047.88 MB
Available Virtual: 1924.89 MB

==================== Drives ================================

Drive c: (PRESARIO) (Fixed) (Total:111.8 GB) (Free:102.63 GB) NTFS ==>[Drive with boot components (Windows XP)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 111.8 GB) (Disk ID: FCB1EC06)
Partition 1: (Active) - (Size=111.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Post #21

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-09-2014
Ran by [removed] (administrator) on OLD_DESK_TOP on 05-09-2014 09:31:30
Running from C:\Documents and Settings\[removed]\Desktop
Platform: Microsoft Windows XP Home Edition Service Pack 2 (X86) OS Language: English (United States)
Internet Explorer Version 8
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Hewlett-Packard Company) C:\WINDOWS\system\hpsysdrv.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.5.0.19\nis.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.5.0.19\nis.exe
(Microsoft Corporation) C:\WINDOWS\system32\rundll32.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\…\Run: [hpsysdrv] => c:\windows\system\hpsysdrv.exe [52736 1998-05-07] (Hewlett-Packard Company)
HKLM\…\Run: [Recguard] => C:\WINDOWS\SMINST\RECGUARD.EXE [212992 2002-07-04] ()
HKLM\…\Run: [srmclean] => C:\Cpqs\Scom\srmclean.exe [36864 2001-07-24] ()
HKLM\…\Run: [NvCplDaemon] => RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
HKLM\…\Run: [nwiz] => nwiz.exe /install
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxsrvc.dll (Intel Corporation)
HKU\S-1-5-21-2291903390-3433162778-840360825-1006\…\Run: [Microsoft Works Update Detection] => c:\Program Files\Microsoft Works\WkDetect.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://rd.yahoo.com/customize/yessentials_cq/defaults/sp/*http://www.yahoo.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=searchfavweb&c=2c02&lc=0409
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/yessentials_cq/defaults/sb/*http://www.yahoo.com/search/ie.html
SearchScopes: HKCU - DefaultScope {46A120EA-A6CA-427F-88AA-618F1920B282} URL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {46A120EA-A6CA-427F-88AA-618F1920B282} URL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = http://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=NIS&chn=retail&geo=US&ver=21&locale=en_US&gct=sb&qsrc=2869
BHO: AcroIEHlprObj Class -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Internet Security\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files\Norton Internet Security\Engine\21.5.0.19\IPS\IPSBHO.DLL (Symantec Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/1.3.1/jinstall-131-win.cab
DPF: {CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA} http://java.sun.com/products/plugin/1.3.1/jinstall-131-win.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: lid - {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\System32\msvidctl.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 [removed]

FireFox:
========
FF HKLM\…\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-12-11]
FF HKLM\…\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn [2014-09-05]

Chrome:
=======
CHR HKLM\…\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\21.5.0.19\Exts\Chrome.crx [2014-08-21]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.5.0.19\NIS.exe [276376 2014-07-31] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 ALCXWDM; C:\WINDOWS\System32\drivers\ALCXWDM.SYS [656172 2002-06-22] (Avance Logic, Inc.)
R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140821.007\BHDrvx86.sys [1138480 2014-08-18] (Symantec Corporation)
R1 ccSet_NIS; C:\WINDOWS\system32\drivers\NIS\1505000.013\ccSetx86.sys [127064 2013-09-25] (Symantec Corporation)
S3 eaps2kbd; C:\WINDOWS\System32\DRIVERS\eaps2kbd.sys [24035 2001-12-28] (Compaq Computer Corp.)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [377648 2014-06-23] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [109872 2014-06-11] (Symantec Corporation)
R3 gameenum; C:\WINDOWS\System32\DRIVERS\gameenum.sys [10624 2004-08-03] (Microsoft Corporation)
S3 i81x; C:\WINDOWS\System32\DRIVERS\i81xnt5.sys [158140 2001-08-08] (Intel(R) Corporation)
S3 iAimFP0; C:\WINDOWS\System32\DRIVERS\wADV01nt.sys [12479 2001-08-08] (Intel(R) Corporation)
S3 iAimFP1; C:\WINDOWS\System32\DRIVERS\wADV02NT.sys [12031 2001-08-08] (Intel(R) Corporation)
S3 iAimFP2; C:\WINDOWS\System32\DRIVERS\wADV05NT.sys [11679 2001-08-08] (Intel(R) Corporation)
S3 iAimFP3; C:\WINDOWS\System32\DRIVERS\wSiINTxx.sys [11999 2001-08-08] (Intel(R) Corporation)
S3 iAimFP4; C:\WINDOWS\System32\DRIVERS\wVchNTxx.sys [19359 2001-08-08] (Intel(R) Corporation)
S3 iAimTV0; C:\WINDOWS\System32\DRIVERS\wATV01nt.sys [29215 2001-08-08] (Intel(R) Corporation)
S3 iAimTV1; C:\WINDOWS\System32\DRIVERS\wATV02NT.sys [19199 2001-08-08] (Intel(R) Corporation)
S3 iAimTV3; C:\WINDOWS\System32\DRIVERS\wATV04nt.sys [33503 2001-08-08] (Intel(R) Corporation)
S3 iAimTV4; C:\WINDOWS\System32\DRIVERS\wCh7xxNT.sys [23519 2001-08-08] (Intel(R) Corporation)
R3 IDSxpx86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140904.002\IDSxpx86.sys [448664 2014-08-29] (Symantec Corporation)
R3 ltmodem5; C:\WINDOWS\System32\DRIVERS\ltmdmnt.sys [623633 2002-01-24] (LT)
R3 ms_mpu401; C:\WINDOWS\System32\drivers\msmpu401.sys [2944 2001-08-17] (Microsoft Corporation)
R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140904.021\NAVENG.SYS [95704 2014-08-21] (Symantec Corporation)
R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140904.021\NAVEX15.SYS [1636696 2014-08-21] (Symantec Corporation)
R3 rtl8139; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [20992 2004-08-03] (Realtek Semiconductor Corporation)
S3 S3Psddr; C:\WINDOWS\System32\DRIVERS\s3gnbm.sys [155008 2002-07-13] (S3 Graphics, Inc.)
S3 Secdrv; C:\WINDOWS\System32\DRIVERS\secdrv.sys [27440 2001-08-18] ()
R1 SRTSP; C:\WINDOWS\System32\Drivers\NIS\1505000.013\SRTSP.SYS [664280 2014-02-12] (Symantec Corporation)
R1 SRTSPX; C:\WINDOWS\system32\drivers\NIS\1505000.013\SRTSPX.SYS [32344 2013-09-09] (Symantec Corporation)
R0 SymDS; C:\WINDOWS\System32\drivers\NIS\1505000.013\SYMDS.SYS [367704 2013-09-09] (Symantec Corporation)
R0 SymEFA; C:\WINDOWS\System32\drivers\NIS\1505000.013\SYMEFA.SYS [936152 2014-03-03] (Symantec Corporation)
R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT.SYS [142936 2013-12-11] (Symantec Corporation)
R1 SymIRON; C:\WINDOWS\system32\drivers\NIS\1505000.013\Ironx86.SYS [206936 2013-09-26] (Symantec Corporation)
R1 SYMTDI; C:\WINDOWS\System32\Drivers\NIS\1505000.013\SYMTDI.SYS [423256 2014-02-17] (Symantec Corporation)
R0 viaagp1; C:\WINDOWS\System32\DRIVERS\viaagp1.sys [27648 2002-03-04] (VIA Technologies, Inc.)
S3 wandrv; C:\WINDOWS\System32\DRIVERS\wandrv.sys [22608 2001-08-10] (America Online, Inc.)
S1 {6080A529-897E-4629-A488-ABA0C29B635E}; C:\WINDOWS\System32\drivers\ialmsbw.sys [90336 2002-05-22] (Intel Corporation)
S3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91}; C:\WINDOWS\System32\drivers\ialmkchw.sys [69504 2002-05-22] (Intel Corporation)
S4 hpt3xx; No ImagePath
S3 iAimTV2; System32\DRIVERS\wATV03nt.sys [X]
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96256 2004-08-03] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-05 09:29 - 2014-09-05 09:29 - 01096704 _____ (Farbar) C:\Documents and Settings\Joe Blow\Desktop\frst.exe
2014-09-05 07:16 - 2014-09-05 09:08 - 00033512 _____ () C:\WINDOWS\system32\Drivers\TrueSight.sys
2014-09-05 07:16 - 2014-09-05 07:16 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\RogueKiller
2014-09-05 07:14 - 2014-09-05 07:14 - 04857944 _____ () C:\Documents and Settings\Joe Blow\Desktop\RogueKiller.exe
2014-09-05 04:38 - 2014-09-05 04:41 - 00012602 _____ () C:\Documents and Settings\Joe Blow\Desktop\Addition.txt
2014-09-05 04:37 - 2014-09-05 09:31 - 00010899 _____ () C:\Documents and Settings\Joe Blow\Desktop\FRST.txt
2014-09-05 04:37 - 2014-09-05 09:31 - 00000000 ____D () C:\FRST
2014-09-04 15:22 - 2014-09-04 15:22 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\SMR410
2014-09-04 15:20 - 2014-09-04 15:20 - 03077584 ____N (Symantec Corporation) C:\Documents and Settings\Joe Blow\Desktop\NPE.exe
2014-09-04 15:18 - 2014-09-04 15:24 - 00000000 ____D () C:\Documents and Settings\Joe Blow\Local Settings\Application Data\NPE
2014-09-04 14:06 - 2014-09-04 14:06 - 00000000 __SHD () C:\Documents and Settings\Administrator\PrivacIE
2014-09-04 13:51 - 2014-09-04 13:51 - 00000000 __SHD () C:\Documents and Settings\Administrator\IETldCache
2014-09-04 13:51 - 2002-03-22 22:47 - 00053248 _____ () C:\Documents and Settings\Administrator\Desktop\Hot Deals from Compaq.exe
2014-09-04 13:50 - 2014-09-04 14:49 - 00000178 ___SH () C:\Documents and Settings\Administrator\ntuser.ini
2014-09-04 13:50 - 2014-09-04 14:39 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Temp
2014-09-04 13:50 - 2014-09-04 14:06 - 00000000 ____D () C:\Documents and Settings\Administrator
2014-09-04 13:50 - 2013-12-11 16:43 - 00000000 ___RD () C:\Documents and Settings\Administrator\Start Menu\Programs\Accessories
2014-09-04 13:50 - 2002-08-02 02:15 - 00000000 ____D () C:\Documents and Settings\Administrator\WINDOWS
2014-09-04 13:50 - 2002-08-02 02:15 - 00000000 ____D () C:\Documents and Settings\Administrator\Start Menu\Programs\Quicken Financial Center
2014-09-04 13:50 - 2002-08-02 02:15 - 00000000 ____D () C:\Documents and Settings\Administrator\My Documents\My eBooks
2014-09-04 13:50 - 2002-08-02 02:15 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\VERITAS
2014-09-04 13:50 - 2002-08-02 02:15 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\Symantec
2014-09-04 13:50 - 2002-08-02 02:15 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\Real
2014-09-04 13:50 - 2002-08-02 02:14 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\InterTrust
2014-09-04 13:50 - 2002-08-02 02:14 - 00000000 ____D () C:\Documents and Settings\Administrator\Application Data\Adobe
2014-09-04 13:50 - 2002-08-01 22:01 - 00000809 _____ () C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.lnk
2014-09-04 13:50 - 2002-08-01 20:04 - 00006905 _____ () C:\Documents and Settings\Administrator\ml2.srt
2014-09-04 13:50 - 2002-08-01 20:04 - 00006892 _____ () C:\Documents and Settings\Administrator\ml1.srt
2014-09-04 13:50 - 2002-08-01 20:04 - 00003318 _____ () C:\Documents and Settings\Administrator\tempdiff.txt
2014-09-04 13:50 - 2002-08-01 19:47 - 00001599 _____ () C:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk
2014-09-04 13:50 - 2002-02-21 02:05 - 00000173 _____ () C:\Documents and Settings\Administrator\oobecmt.ini
2014-09-04 13:50 - 2001-11-13 03:49 - 00000205 _____ () C:\Documents and Settings\Administrator\My Documents\Yahoo! Briefcase.url
2014-09-02 08:15 - 2014-09-02 08:19 - 00000000 ____D () C:\Documents and Settings\Joe Blow\Local Settings\Application Data\Adobe
2014-08-30 08:57 - 2014-08-30 08:57 - 00000579 _____ () C:\Documents and Settings\Joe Blow\plugin131.trace
2014-08-30 08:57 - 2014-08-30 08:57 - 00000000 ____D () C:\Documents and Settings\Joe Blow\.java

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-05 09:31 - 2014-09-05 04:37 - 00010899 _____ () C:\Documents and Settings\Joe Blow\Desktop\FRST.txt
2014-09-05 09:31 - 2014-09-05 04:37 - 00000000 ____D () C:\FRST
2014-09-05 09:31 - 2013-12-11 17:59 - 00000000 ____D () C:\Documents and Settings\Joe Blow\Local Settings\Temp
2014-09-05 09:29 - 2014-09-05 09:29 - 01096704 _____ (Farbar) C:\Documents and Settings\Joe Blow\Desktop\frst.exe
2014-09-05 09:26 - 2013-12-12 11:19 - 00000830 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-09-05 09:15 - 2002-08-01 12:34 - 00000000 ____D () C:\WINDOWS\system
2014-09-05 09:10 - 2013-12-11 20:41 - 00527140 _____ () C:\WINDOWS\WindowsUpdate.log
2014-09-05 09:08 - 2014-09-05 07:16 - 00033512 _____ () C:\WINDOWS\system32\Drivers\TrueSight.sys
2014-09-05 09:03 - 2013-12-11 17:59 - 00000184 _____ () C:\WINDOWS\system\hpsysdrv.DAT
2014-09-05 09:03 - 2002-08-01 19:46 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-09-05 09:02 - 2013-12-11 17:59 - 00000178 ___SH () C:\Documents and Settings\Joe Blow\ntuser.ini
2014-09-05 07:16 - 2014-09-05 07:16 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\RogueKiller
2014-09-05 07:14 - 2014-09-05 07:14 - 04857944 _____ () C:\Documents and Settings\Joe Blow\Desktop\RogueKiller.exe
2014-09-05 04:41 - 2014-09-05 04:38 - 00012602 _____ () C:\Documents and Settings\Joe Blow\Desktop\Addition.txt
2014-09-05 04:26 - 2002-08-01 19:51 - 00032594 _____ () C:\WINDOWS\SchedLgU.Txt
2014-09-04 15:24 - 2014-09-04 15:18 - 00000000 ____D () C:\Documents and Settings\Joe Blow\Local Settings\Application Data\NPE
2014-09-04 15:22 - 2014-09-04 15:22 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\SMR410
2014-09-04 15:22 - 2002-08-01 19:33 - 00000220 __RSH () C:\boot.ini
2014-09-04 15:20 - 2014-09-04 15:20 - 03077584 ____N (Symantec Corporation) C:\Documents and Settings\Joe Blow\Desktop\NPE.exe
2014-09-04 15:18 - 2013-12-11 21:16 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Norton
2014-09-04 15:18 - 2013-12-11 17:50 - 00321664 _____ () C:\WINDOWS\ntbtlog.txt.bak
2014-09-04 14:56 - 2002-08-01 12:37 - 00131944 _____ () C:\WINDOWS\FaxSetup.log
2014-09-04 14:56 - 2002-08-01 12:37 - 00073718 _____ () C:\WINDOWS\ocgen.log
2014-09-04 14:56 - 2002-08-01 12:37 - 00055849 _____ () C:\WINDOWS\tsoc.log
2014-09-04 14:56 - 2002-08-01 12:37 - 00048577 _____ () C:\WINDOWS\comsetup.log
2014-09-04 14:56 - 2002-08-01 12:37 - 00029819 _____ () C:\WINDOWS\ntdtcsetup.log
2014-09-04 14:56 - 2002-08-01 12:37 - 00016663 _____ () C:\WINDOWS\iis6.log
2014-09-04 14:56 - 2002-08-01 12:37 - 00006335 _____ () C:\WINDOWS\msgsocm.log
2014-09-04 14:56 - 2002-08-01 12:37 - 00005766 _____ () C:\WINDOWS\ocmsn.log
2014-09-04 14:56 - 2002-08-01 12:37 - 00001891 _____ () C:\WINDOWS\imsins.log
2014-09-04 14:55 - 2013-12-11 20:06 - 00195692 _____ () C:\WINDOWS\setupapi.log
2014-09-04 14:55 - 2002-08-01 22:03 - 00000000 ____D () C:\Program Files\WildTangent
2014-09-04 14:49 - 2014-09-04 13:50 - 00000178 ___SH () C:\Documents and Settings\Administrator\ntuser.ini
2014-09-04 14:39 - 2014-09-04 13:50 - 00000000 ____D () C:\Documents and Settings\Administrator\Local Settings\Temp
2014-09-04 14:06 - 2014-09-04 14:06 - 00000000 __SHD () C:\Documents and Settings\Administrator\PrivacIE
2014-09-04 14:06 - 2014-09-04 13:50 - 00000000 ____D () C:\Documents and Settings\Administrator
2014-09-04 13:51 - 2014-09-04 13:51 - 00000000 __SHD () C:\Documents and Settings\Administrator\IETldCache
2014-09-04 13:13 - 2002-08-01 19:32 - 00001158 _____ () C:\WINDOWS\system32\wpa.dbl
2014-09-02 08:19 - 2014-09-02 08:15 - 00000000 ____D () C:\Documents and Settings\Joe Blow\Local Settings\Application Data\Adobe
2014-09-02 08:17 - 2013-12-12 11:19 - 00699568 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2014-09-02 08:17 - 2013-12-12 11:19 - 00071344 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2014-08-30 08:57 - 2014-08-30 08:57 - 00000579 _____ () C:\Documents and Settings\Joe Blow\plugin131.trace
2014-08-30 08:57 - 2014-08-30 08:57 - 00000000 ____D () C:\Documents and Settings\Joe Blow\.java
2014-08-21 13:04 - 2013-12-11 21:25 - 00001981 _____ () C:\Documents and Settings\All Users\Desktop\Norton Internet Security.LNK
2014-08-21 13:04 - 2013-12-11 21:25 - 00000000 ____D () C:\WINDOWS\system32\Drivers\NIS
2014-08-21 13:04 - 2013-12-11 21:24 - 00000000 ____D () C:\Documents and Settings\All Users\Start Menu\Programs\Norton Internet Security

Some content of TEMP:
====================
C:\Documents and Settings\Joe Blow\Local Settings\Temp\oi_{EE64BE09-1704-4AB7-B6D8-222458F2C2B9}.exe
C:\Documents and Settings\Joe Blow\Local Settings\Temp\Outobox.exe
C:\Documents and Settings\Joe Blow\Local Settings\Temp\uninst.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================

Post #22

Hello Larry, 

 

Please complete the following steps and let me know how you get on. 

 
STEP 1
[external image: aA7bkRO.png.pagespeed.ce.OIlgGSNBU0.png] aswMBR

  • Please download aswMBR and save the file to your Desktop. 
  • Temporarily disable your anti-virus software. For instructions, please refer to the following link.
  • Double-Click aswMBR.exe to run the programme.
  • Click Yes when prompted to download avast! virus definitions. Wait until AVAST engine defs: ### appears. 
  • If you are prompted to enable the use of "Virtualization Technology", click Yes.
  • Click the AV Scan: drop down box and click C:\.
  • Click Scan. 
  • Upon completion, you will see Scan finished successfully. Click Save log. Save the log to your Desktop. 
  • Re-enable your anti-virus software.
  • Copy the contents of the log and paste in your next reply.

Note: Do NOT click Fix or FixMBR.
Note: A file (MBR.dat) will be created on your Desktop. Do NOT click or delete it.
 
 
STEP 2
[external image: xgxJsKn9.png.pagespeed.ic.M4hykS4GUJ.png] Farbar Service Scanner (FSS)

  • Please download FSS and save the file to your Desktop.
  • Double-click FSS.exe to run the programme.
  • Ensure the following items are checked:
    • [external image: xH5woOOZ.png.pagespeed.ic.T3Pfzk_LLB.png].
    • [external image: xTA6BLVm.png.pagespeed.ic.sqmxnaDPxe.png].
    • [external image: xe1PK1mD.png.pagespeed.ic.55-up2Fsst.png].
    • [external image: xmQdJltp.png.pagespeed.ic.LswxcoOK3I.png].
    • [external image: 7wCHunX.png.pagespeed.ce.KZduXTGibJ.png].
    • [external image: wU6iCZ5.png.pagespeed.ce.r8ASNNqNd0.png].
  • Click [external image: YMLYaf6.png.pagespeed.ce.KGKSzJqO7G.png].
  • A log (FSS.txt) will be created on your Desktop. Copy the contents of the log and paste in your next reply.
     

STEP 3
[external image: xnWhGEI3.png.pagespeed.ic.cDN7g2AqT7.png] VirusTotal Upload

  • Please go to VirusTotal.com.
  • Click Choose File and locate the following file:
    • C:\Documents and Settings\Joe Blow\Desktop\MBR.dat
  • ​Click Scan it!.
  • If you receive the following notification: File already analysed click Reanalyse.
  • Once the file has been analyzed, copy the page URL at the top of the window and paste in your next reply. 
  • Please do the same for the files below:
    • C:\WINDOWS\System32\DRIVERS\secdrv.sys
    • C:\WINDOWS\system32\wpa.dbl
       

======================================================
 
STEP 4
[external image: xpfNZP4A.png.pagespeed.ic.bp5cRl1pJg.jpg] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

  • aswMBR log
  • FSS.txt
  • VirusTotal results
Post #23

aswMBR version 1.0.1.2041 Copyright© 2014 AVAST Software
Run date: 2014-09-05 10:15:27
—————————–
10:15:27.625    OS Version: Windows 5.1.2600 Service Pack 2
10:15:27.625    Number of processors: 1 586 0x204
10:15:27.625    ComputerName: OLD_DESK_TOP  UserName: Joe Blow
10:15:28.500    Initialize success
10:15:29.046    VM: initialized successfully
10:15:29.093    VM: Intel CPU virtualization not supported
10:20:14.265    AVAST engine defs: 14090502
10:22:31.250    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
10:22:31.250    Disk 0 Vendor: SAMSUNG_SV1204H RK100-09 Size: 114498MB BusType: 3
10:22:31.437    Disk 0 MBR read successfully
10:22:31.437    Disk 0 MBR scan
10:22:31.531    Disk 0 unknown MBR code
10:22:31.546    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       114485 MB offset 63
10:22:31.562    Disk 0 unknown boot code
10:22:31.562    Scan finished successfully
10:22:57.343    Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Joe Blow\Desktop\MBR.dat"
10:22:57.343    The log file has been saved successfully to "C:\Documents and Settings\Joe Blow\Desktop\aswMBR.txt"

 

Post #24

Farbar Service Scanner Version: 21-07-2014
Ran by [removed] (administrator) on 05-09-2014 at 10:28:21
Running from "C:\Documents and Settings\Joe Blow\Desktop"
Microsoft Windows XP Home Edition Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0

System Restore:
============

System Restore Disabled Policy:
========================

Security Center:
============

Other Services:
==============

File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\afd.sys => File is digitally signed
C:\WINDOWS\system32\Drivers\netbt.sys => File is digitally signed
C:\WINDOWS\system32\Drivers\tcpip.sys => File is digitally signed
C:\WINDOWS\system32\Drivers\ipsec.sys => File is digitally signed
C:\WINDOWS\system32\dnsrslvr.dll => File is digitally signed
C:\WINDOWS\system32\ipnathlp.dll => File is digitally signed
C:\WINDOWS\system32\netman.dll => File is digitally signed
C:\WINDOWS\system32\wbem\WMIsvc.dll => File is digitally signed
C:\WINDOWS\system32\srsvc.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\sr.sys => File is digitally signed
C:\WINDOWS\system32\wscsvc.dll => File is digitally signed
C:\WINDOWS\system32\wbem\WMIsvc.dll => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed

Extra List:
=======
Bridge(9) BridgeMP(8) Gpc(6) IPSec(4) NetBT(5) PSched(7) SYMTDI(10) Tcpip(3)
0x0A000000040000000100000002000000030000000A0000000500000006000000070000000800000009000000
IpSec Tag value is correct.

**** End of log ****

Post #26

aswMBR version 1.0.1.2041 Copyright© 2014 AVAST Software
Run date: 2014-09-05 10:15:27
—————————–
10:15:27.625    OS Version: Windows 5.1.2600 Service Pack 2
10:15:27.625    Number of processors: 1 586 0x204
10:15:27.625    ComputerName: OLD_DESK_TOP  UserName: Joe Blow
10:15:28.500    Initialize success
10:15:29.046    VM: initialized successfully
10:15:29.093    VM: Intel CPU virtualization not supported
10:20:14.265    AVAST engine defs: 14090502
10:22:31.250    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
10:22:31.250    Disk 0 Vendor: SAMSUNG_SV1204H RK100-09 Size: 114498MB BusType: 3
10:22:31.437    Disk 0 MBR read successfully
10:22:31.437    Disk 0 MBR scan
10:22:31.531    Disk 0 unknown MBR code
10:22:31.546    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       114485 MB offset 63
10:22:31.562    Disk 0 unknown boot code
10:22:31.562    Scan finished successfully
10:22:57.343    Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Joe Blow\Desktop\MBR.dat"
10:22:57.343    The log file has been saved successfully to "C:\Documents and Settings\Joe Blow\Desktop\aswMBR.txt"

 

Post #27 


Farbar Service Scanner Version: 21-07-2014

Ran by [removed] (administrator) on 05-09-2014 at 10:28:21

Running from "C:\Documents and Settings\Joe Blow\Desktop"

Microsoft Windows XP Home Edition Service Pack 2 (X86)

Boot Mode: Normal

****************************************************************


Internet Services:

============


Connection Status:

==============

Localhost is accessible.

LAN connected.

Google IP is accessible.

Google.com is accessible.

Yahoo.com is accessible.



Windows Firewall:

=============


Firewall Disabled Policy:

==================

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall"=DWORD:0



System Restore:

============


System Restore Disabled Policy:

========================



Security Center:

============



Other Services:

==============



File Check:

========

C:\WINDOWS\system32\dhcpcsvc.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\afd.sys => File is digitally signed

C:\WINDOWS\system32\Drivers\netbt.sys => File is digitally signed

C:\WINDOWS\system32\Drivers\tcpip.sys => File is digitally signed

C:\WINDOWS\system32\Drivers\ipsec.sys => File is digitally signed

C:\WINDOWS\system32\dnsrslvr.dll => File is digitally signed

C:\WINDOWS\system32\ipnathlp.dll => File is digitally signed

C:\WINDOWS\system32\netman.dll => File is digitally signed

C:\WINDOWS\system32\wbem\WMIsvc.dll => File is digitally signed

C:\WINDOWS\system32\srsvc.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\sr.sys => File is digitally signed

C:\WINDOWS\system32\wscsvc.dll => File is digitally signed

C:\WINDOWS\system32\wbem\WMIsvc.dll => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed


Extra List:

=======

Bridge(9) BridgeMP(8) Gpc(6) IPSec(4) NetBT(5) PSched(7) SYMTDI(10) Tcpip(3)

0x0A000000040000000100000002000000030000000A0000000500000006000000070000000800000009000000

IpSec Tag value is correct.


**** End of log ****










  
  

    
    
    

      Post #29
      
    

  

  
  
Hi Larry, 


 






No file labled virustotal results???






Don't worry, I was referring to the three VirusTotal URLs which you have already posted. 


 


I shall return with instructions shortly.









  
  

    
    
    

      Post #30
      
    

  

  
  
Hi Larry, 

 

Please ensure both your Anti-Virus and Firewall are enabled. If you are unable to run any of the programmes, ensure you only temporarily disable your security software, and enable once complete. 

 
After completing the steps below, please provide an update on your computer. Are there any outstanding issues?

 
STEP 1
[external image: xmlEX1wH.png.pagespeed.ic.X-j6_-PJTh.jpg] RogueKiller Fix


  • Close any running programmes.
    • 

  • Double-click RogueKiller.exe to run the programme.
    • 

  • Allow the Prescan to complete. Upon completion, a window will open. Click Accept.
    • 

  • A browser window may open. Close the browser window.
    • 

  • Return to RogueKiller and click [external image: jpgUwzp.png.pagespeed.ce.8zdHrQQ8b1.png]. 
    • 

  • Upon completion, click the following tabs and check the following items:
    
 
    • 

  • Click [external image: 5UKuIKl.png.pagespeed.ce.74zCUq9qxj.png] and place a checkmark next to the following items. Ensure any other items are unchecked.

    • [Rans.Gendarm] HKEY_LOCAL_MACHINE\System\ControlSet001\Services\winmgmt\Parameters | ServiceDll : C:\DOCUME~1\ALLUSE~1\APPLIC~1\50BC232.cpp  -> FOUND

      
 
      • 

    • [PUM.SearchPage] HKEY_USERS\S-1-5-21-2291903390-3433162778-840360825-1006\Software\Microsoft\Internet Explorer\Main | Search Page :  -> FOUND 
      • 

    • 

  • Click [external image: phPvmc6.png.pagespeed.ce.35uP5hQ2MX.png].
    • 

  • A log (RKreport.txt) will be open. Copy the contents of the log and paste in your next reply.
    
 
    • 

STEP 2
[external image: x6JO0hXH.png.pagespeed.ic.PEMzZKYEz_.png] Revo Uninstaller


  • Please download and install Revo Uninstaller Free.
    • 

  • Double-click Revo Uninstaller to run the programme. 
    • 

  • From the list of programmes, locate the following, or anything similar and carry out the steps below one at a time.

    • outobox
      • 

    • Viewpoint Media Player 
      • 

    • 

  • ​Double-click the programme. 
    • 

  • When prompted if you want to uninstall click Yes.
    • 

  • Ensure the Moderate option is selected and click Next.
    • 

  • The programme will run. If prompted again click Yes.
    • 

  • Once the built-in uninstaller is finished click Next.
    • 

  • Once the programme has searched for leftovers click Next.
    • 

  • Check items in bold only in the list and click Delete. You may have to expand folders by clicking the "+" mark.
    • 

  • When prompted click Yes, followed by Next.
    • 

  • Click Select all, followed by Delete.
    • 

  • When prompted click Yes, followed by Next.
    • 

  • Once done click Finish.
    
 
    • 

STEP 3
[external image: xlK5Hdb.png.pagespeed.ce.J4MzrrPAEo.png] Farbar Recovery Scan Tool (FRST) Script


  • Press the Windows Key [external image: xpdKOQKY.png.pagespeed.ic.tmAgS1-k6q.png] + r on your keyboard at the same time. Type Notepad and click OK.
    • 

  • Copy the entire contents of the codebox below and paste into the Notepad document.
    start
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://rd.yahoo.com/…//www.yahoo.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://store.presari…&c=2c02&lc=0409
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/…/search/ie.html
SearchScopes: HKCU - DefaultScope {46A120EA-A6CA-427F-88AA-618F1920B282} URL = http://search.yahoo….=utf-8&fr=b1ie7
SearchScopes: HKCU - {46A120EA-A6CA-427F-88AA-618F1920B282} URL = http://search.yahoo….=utf-8&fr=b1ie7
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = http://nortonsafe.se…ct=sb&qsrc=2869
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\UploadMgr => ""="Service"
C:\Documents and Settings\Administrator\Desktop\Hot Deals from Compaq.exe
Folder: C:\Documents and Settings\Administrator\WINDOWS
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
CMD: bitsadmin /reset /allusers
EmptyTemp:
end
    

    • 

  • Click File, Save As and type fixlist.txt as the File Name. 
    • 

  • Important: The file must be saved in the same location as FRST.exe. 
    • 

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.


  • Double-Click FRST.exe to run the programme.
    • 

  • Click Fix.
    • 

  • A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
    
 
    • 

======================================================

 
STEP 4
[external image: xpfNZP4A.png.pagespeed.ic.bp5cRl1pJg.jpg] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.


  • RKreport.txt
    • 

  • Did the programmes uninstall OK in Revo?
    • 

  • Fixlog.txt
    • 

  • Are there any outstanding issues?
    • 













  
  
  
  







  
 Ask AI

  
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

  
  

    
    

      
      
    

  

  
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI