LDTate
Try and look in administrator tools.
click Start, open control panel, open administrator tools, open Local Users and Groups, open Groups and double click administrators and make sure your user name is listed.
Spyware / Malware / Virus Removal
[Resolved] Tried alot now im her with log
24 min read
metman
Local Users and Groups is not listed there.
On a side note,
Could the baddies have messed this up?
LDTate
Anything is possible. Try booting in safe mode and login as administrator and see if Local Users and Groups is listed.Local Users and Groups is not listed there.
On a side note,
Could the baddies have messed this up?
metman
Not there either, under user accounts all users have admin though.
Still blocked fro getting into program files and cant adjust IE7 on one users account to turn on pop up blocker saying it needs admin rights.
LDTate
Guess we need to look at another users HijackThis log.
You'll need to login as that user and post a hijackthis log.
How many users do you have?
metman
3 users
Michael T………….where all the problems started I believe.
EllenT who cant access program files
Michael, which I created thinking that Michael T profile was corrupt so not really needed.
I'll scan Michael T wh cant turn on the pop up blocker first.
BRB
metman
Michael T log who cant turn on pop up blocker, says needs admin rights. Also does not have rights to get into program files folder.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:53:04 PM, on 3/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\Energizer FileSaver\UPSMON_Service.Exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.32\QOELoader.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\hijack this-202\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [cafw] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.32\QOELoader.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: FileSaver_Service - Unknown owner - C:\Program Files\Energizer FileSaver\UPSMON_Service.Exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
–
End of file - 8390 bytes
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:53:04 PM, on 3/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\Energizer FileSaver\UPSMON_Service.Exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.32\QOELoader.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\hijack this-202\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [cafw] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.32\QOELoader.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo…IOS/tgctlcm.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…83/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,20/mcgdmgr.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: FileSaver_Service - Unknown owner - C:\Program Files\Energizer FileSaver\UPSMON_Service.Exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
–
End of file - 8390 bytes
LDTate
Did you add a internet Restriction for this use?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
metman
no
LDTate
Run a combofix under this users name.
metman
Here is Michael T combofix report
ComboFix 08-03-08.1 - Michael 2008-03-08 22:11:56.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.476 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-02-09 to 2008-03-09 )))))))))))))))))))))))))))))))
.
2008-03-08 19:02 . 2008-03-08 19:02 20,262 –a—— C:\catchme2008-03-08_194625.79.zip
2008-03-08 18:05 . 2008-03-08 21:52 d——– C:\hijack this-202
2008-03-08 17:33 . 2008-03-08 17:31 1,427,992 –a—— C:\mbam-setup.exe
2008-03-08 17:32 . 2008-03-08 17:30 50,688 –a—— C:\ATF-Cleaner.exe
2008-03-07 23:53 . 2008-03-07 23:53 812,344 –a—— C:\HJTInstall.exe
2008-03-07 23:21 . 2008-03-07 23:21 d——– C:\spybotS&D
2008-03-07 22:57 . 2008-03-07 22:57 d–hs—- C:\Documents and Settings\Michael\UserData
2008-03-07 22:22 . 2008-03-07 22:22 d——– C:\Documents and Settings\Michael\Contacts
2008-03-07 22:22 . 2008-03-07 22:22 d——– C:\Documents and Settings\Michael\Application Data\AdobeUM
2008-03-07 22:21 . 2008-03-07 22:21 d——– C:\Documents and Settings\Michael\Application Data\Intuit
2008-03-07 22:21 . 2008-03-07 22:21 d——– C:\Documents and Settings\Michael\Application Data\GetRightToGo
2008-03-07 22:21 . 2008-03-07 22:21 d——– C:\Documents and Settings\Michael\Application Data\Corel
2008-03-07 22:21 . 2008-03-07 22:21 d——– C:\Documents and Settings\Michael\Application Data\Apple Computer
2008-03-07 22:21 . 2008-03-07 22:21 d——– C:\Documents and Settings\Michael\Application Data\Aim
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\WeatherBug
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\Snapfish
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\Sammsoft
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\Roxio
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\MSNInstaller
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\MSN6
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\Motive
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\Lycos
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\Lavasoft
2008-03-07 22:04 . 2008-03-07 22:21 d——– C:\Documents and Settings\Michael\Application Data\GTek
2008-03-07 22:02 . 2003-08-27 09:14 d——– C:\Documents and Settings\Michael\WINDOWS
2008-03-07 21:28 . 2008-03-07 22:03 d–hs—- C:\WINDOWS\Installer
2008-03-07 20:49 . 2008-03-07 20:49 22 –a—— C:\WINDOWS\SYSTEM32\ati64hlp.stb
2008-03-07 20:16 . 2001-09-26 20:22 93,722 –a—— C:\WINDOWS\SYSTEM32\atmenuxx.hlp
2008-03-07 20:16 . 2008-03-07 20:49 10,842 –ah—– C:\WINDOWS\SYSTEM32\ATMenuxx.GID
2008-03-07 00:35 . 2008-03-08 01:03 d——– C:\WINDOWS\CAVTemp
2008-03-06 20:57 . 2008-03-08 21:38 257,654 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k0
2008-03-06 20:57 . 2008-03-08 21:38 64 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k7
2008-03-06 20:57 . 2008-03-08 21:38 64 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k6
2008-03-06 20:57 . 2008-03-08 21:38 64 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k5
2008-03-06 20:57 . 2008-03-08 21:38 64 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k4
2008-03-06 20:57 . 2008-03-08 21:38 64 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k3
2008-03-06 20:57 . 2008-03-08 21:38 64 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k2
2008-03-06 20:57 . 2008-03-08 21:38 64 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k1
2008-03-06 20:20 . 2008-03-06 20:20 d——– C:\Program Files\Common Files\Scanner
2008-03-06 20:20 . 2007-11-23 11:48 879,784 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\vetefile.sys
2008-03-06 20:20 . 2007-11-22 15:37 250,544 –a—— C:\WINDOWS\SYSTEM32\KeyHelp.ocx
2008-03-06 20:20 . 2007-11-23 11:48 108,312 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\veteboot.sys
2008-03-06 20:20 . 2008-03-06 20:24 99,592 –a—— C:\WINDOWS\SYSTEM32\isafeif.dll
2008-03-06 20:20 . 2008-03-06 20:24 91,400 –a—— C:\WINDOWS\SYSTEM32\isafprod.dll
2008-03-06 20:20 . 2008-03-06 20:24 83,256 –a—— C:\WINDOWS\SYSTEM32\vetredir.dll
2008-03-06 20:20 . 2008-03-06 20:24 32,264 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\vetmonnt.sys
2008-03-06 20:20 . 2008-03-06 20:24 26,376 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\vet-filt.sys
2008-03-06 20:20 . 2008-03-06 20:24 21,512 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\vetfddnt.sys
2008-03-06 20:20 . 2008-03-06 20:24 21,128 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\vet-rec.sys
2008-03-06 20:11 . 2008-03-08 21:52 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-03-06 20:11 . 2008-03-06 20:11 1,409 –a—— C:\WINDOWS\QTFont.for
2008-03-06 19:25 . 2001-08-17 13:48 12,160 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mouhid.sys
2008-02-24 21:45 . 2008-02-24 21:45 d——– C:\Documents and Settings\Michael\Application Data\Sammsoft
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-08 23:01 ——— d—–w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-03-07 14:48 ——— d—–w C:\Documents and Settings\Ellen Turturro\Application Data\Lavasoft
2008-03-07 02:36 ——— d—–w C:\Program Files\Common Files\Motive
2008-03-07 02:13 ——— d—–w C:\Documents and Settings\Michael\Application Data\Lycos
2008-03-07 02:13 ——— d—–w C:\Documents and Settings\Ellen\Application Data\Lycos
2008-03-07 01:33 ——— d—–w C:\Documents and Settings\All Users\Application Data\CA
2008-03-07 01:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-03-04 21:24 ——— d—–w C:\Documents and Settings\Michael\Application Data\AdobeUM
2008-01-28 19:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\Dell
2008-01-23 20:37 ——— d—–w C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-01-23 20:34 ——— d—–w C:\Program Files\Common Files\supportsoft
2008-01-11 21:35 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-01-11 21:28 ——— d—–w C:\Documents and Settings\Michael\Application Data\GetRightToGo
2008-01-11 05:53 44,544 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll
2007-12-20 13:10 499,712 —-a-w C:\WINDOWS\SYSTEM32\msvcp71.dll
2007-12-20 13:10 348,160 —-a-w C:\WINDOWS\SYSTEM32\msvcr71.dll
2007-12-19 23:01 347,136 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll
2007-12-18 09:51 179,584 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mrxdav.sys
1601-01-01 00:00 0 ——w C:\Program Files\
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2005-10-19 07:59 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2005-10-19 07:59 126976]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-12-17 12:28 684032]
"CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2008-03-06 20:24 234760]
"cafw"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [2008-03-06 20:24 771336]
"capfasem"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe" [2008-03-06 20:24 173320]
"capfupgrade"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2008-03-06 20:24 259336]
"QOELOADER"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.32\QOELoader.exe" [2008-03-06 20:24 14088]
"AtiPTA"="atiptaxx.exe" [2001-09-26 22:39 245760 C:\WINDOWS\SYSTEM32\atiptaxx.exe]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2003-04-09 05:56:24 598150]
KODAK Software Updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2002-03-13 04:08:34 16384]
Office Startup.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE [1997-08-01 51984]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
UmxWnp.Dll 2007-05-18 13:30 79368 C:\WINDOWS\SYSTEM32\UmxWNP.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
–a—— 2007-01-19 11:54 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
–a—— 2003-08-27 09:18 26112 C:\Program Files\Real\RealPlayer\RealPlay.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\CA Personal Firewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\MSN\\MSNCoreFiles\\msn.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
R0 KmxStart;KmxStart;C:\WINDOWS\system32\DRIVERS\kmxstart.sys [2007-10-18 10:24]
R1 KmxAgent;KmxAgent;C:\WINDOWS\system32\DRIVERS\kmxagent.sys [2007-05-18 13:30]
R1 KmxFile;KmxFile;C:\WINDOWS\system32\DRIVERS\KmxFile.sys [2007-05-18 13:30]
R1 KmxFw;KmxFw;C:\WINDOWS\system32\DRIVERS\kmxfw.sys [2007-10-18 14:21]
R2 FileSaver_Service;FileSaver_Service;"C:\Program Files\Energizer FileSaver\UPSMON_Service.Exe" [2003-07-20 16:03]
R2 KmxCF;KmxCF;C:\WINDOWS\system32\DRIVERS\KmxCF.sys [2007-10-18 10:24]
R2 KmxSbx;KmxSbx;C:\WINDOWS\system32\DRIVERS\KmxSbx.sys [2007-11-02 12:09]
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 09:23]
R2 UmxAgent;HIPS Event Manager;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe" [2007-10-18 10:24]
R2 UmxCfg;HIPS Configuration Interpreter;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe" [2007-10-18 10:24]
R2 UmxPol;HIPS Policy Manager;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe" [2007-05-18 13:30]
R3 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2004-08-04 00:29]
R3 KmxCfg;KmxCfg;C:\WINDOWS\system32\DRIVERS\kmxcfg.sys [2007-09-13 15:15]
S3 PPCtlPriv;PPCtlPriv;"C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe" [2008-03-06 20:24]
.
Contents of the 'Scheduled Tasks' folder
"2008-03-08 14:11:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-08 02:21:00 C:\WINDOWS\Tasks\CAAntiSpywareScan_Daily as Michael Turturro at 8 21 PM.job"
- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-08 22:19:13
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-03-08 22:22:19
ComboFix2.txt 2008-03-09 00:57:18
.
2008-03-08 02:20:15 — E O F —
ComboFix 08-03-08.1 - Michael 2008-03-08 22:11:56.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.476 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-02-09 to 2008-03-09 )))))))))))))))))))))))))))))))
.
2008-03-08 19:02 . 2008-03-08 19:02 20,262 –a—— C:\catchme2008-03-08_194625.79.zip
2008-03-08 18:05 . 2008-03-08 21:52 d——– C:\hijack this-202
2008-03-08 17:33 . 2008-03-08 17:31 1,427,992 –a—— C:\mbam-setup.exe
2008-03-08 17:32 . 2008-03-08 17:30 50,688 –a—— C:\ATF-Cleaner.exe
2008-03-07 23:53 . 2008-03-07 23:53 812,344 –a—— C:\HJTInstall.exe
2008-03-07 23:21 . 2008-03-07 23:21 d——– C:\spybotS&D
2008-03-07 22:57 . 2008-03-07 22:57 d–hs—- C:\Documents and Settings\Michael\UserData
2008-03-07 22:22 . 2008-03-07 22:22 d——– C:\Documents and Settings\Michael\Contacts
2008-03-07 22:22 . 2008-03-07 22:22 d——– C:\Documents and Settings\Michael\Application Data\AdobeUM
2008-03-07 22:21 . 2008-03-07 22:21 d——– C:\Documents and Settings\Michael\Application Data\Intuit
2008-03-07 22:21 . 2008-03-07 22:21 d——– C:\Documents and Settings\Michael\Application Data\GetRightToGo
2008-03-07 22:21 . 2008-03-07 22:21 d——– C:\Documents and Settings\Michael\Application Data\Corel
2008-03-07 22:21 . 2008-03-07 22:21 d——– C:\Documents and Settings\Michael\Application Data\Apple Computer
2008-03-07 22:21 . 2008-03-07 22:21 d——– C:\Documents and Settings\Michael\Application Data\Aim
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\WeatherBug
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\Snapfish
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\Sammsoft
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\Roxio
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\MSNInstaller
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\MSN6
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\Motive
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\Lycos
2008-03-07 22:20 . 2008-03-07 22:20 d——– C:\Documents and Settings\Michael\Application Data\Lavasoft
2008-03-07 22:04 . 2008-03-07 22:21 d——– C:\Documents and Settings\Michael\Application Data\GTek
2008-03-07 22:02 . 2003-08-27 09:14 d——– C:\Documents and Settings\Michael\WINDOWS
2008-03-07 21:28 . 2008-03-07 22:03 d–hs—- C:\WINDOWS\Installer
2008-03-07 20:49 . 2008-03-07 20:49 22 –a—— C:\WINDOWS\SYSTEM32\ati64hlp.stb
2008-03-07 20:16 . 2001-09-26 20:22 93,722 –a—— C:\WINDOWS\SYSTEM32\atmenuxx.hlp
2008-03-07 20:16 . 2008-03-07 20:49 10,842 –ah—– C:\WINDOWS\SYSTEM32\ATMenuxx.GID
2008-03-07 00:35 . 2008-03-08 01:03 d——– C:\WINDOWS\CAVTemp
2008-03-06 20:57 . 2008-03-08 21:38 257,654 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k0
2008-03-06 20:57 . 2008-03-08 21:38 64 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k7
2008-03-06 20:57 . 2008-03-08 21:38 64 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k6
2008-03-06 20:57 . 2008-03-08 21:38 64 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k5
2008-03-06 20:57 . 2008-03-08 21:38 64 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k4
2008-03-06 20:57 . 2008-03-08 21:38 64 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k3
2008-03-06 20:57 . 2008-03-08 21:38 64 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k2
2008-03-06 20:57 . 2008-03-08 21:38 64 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k1
2008-03-06 20:20 . 2008-03-06 20:20 d——– C:\Program Files\Common Files\Scanner
2008-03-06 20:20 . 2007-11-23 11:48 879,784 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\vetefile.sys
2008-03-06 20:20 . 2007-11-22 15:37 250,544 –a—— C:\WINDOWS\SYSTEM32\KeyHelp.ocx
2008-03-06 20:20 . 2007-11-23 11:48 108,312 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\veteboot.sys
2008-03-06 20:20 . 2008-03-06 20:24 99,592 –a—— C:\WINDOWS\SYSTEM32\isafeif.dll
2008-03-06 20:20 . 2008-03-06 20:24 91,400 –a—— C:\WINDOWS\SYSTEM32\isafprod.dll
2008-03-06 20:20 . 2008-03-06 20:24 83,256 –a—— C:\WINDOWS\SYSTEM32\vetredir.dll
2008-03-06 20:20 . 2008-03-06 20:24 32,264 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\vetmonnt.sys
2008-03-06 20:20 . 2008-03-06 20:24 26,376 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\vet-filt.sys
2008-03-06 20:20 . 2008-03-06 20:24 21,512 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\vetfddnt.sys
2008-03-06 20:20 . 2008-03-06 20:24 21,128 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\vet-rec.sys
2008-03-06 20:11 . 2008-03-08 21:52 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-03-06 20:11 . 2008-03-06 20:11 1,409 –a—— C:\WINDOWS\QTFont.for
2008-03-06 19:25 . 2001-08-17 13:48 12,160 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mouhid.sys
2008-02-24 21:45 . 2008-02-24 21:45 d——– C:\Documents and Settings\Michael\Application Data\Sammsoft
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-08 23:01 ——— d—–w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-03-07 14:48 ——— d—–w C:\Documents and Settings\Ellen Turturro\Application Data\Lavasoft
2008-03-07 02:36 ——— d—–w C:\Program Files\Common Files\Motive
2008-03-07 02:13 ——— d—–w C:\Documents and Settings\Michael\Application Data\Lycos
2008-03-07 02:13 ——— d—–w C:\Documents and Settings\Ellen\Application Data\Lycos
2008-03-07 01:33 ——— d—–w C:\Documents and Settings\All Users\Application Data\CA
2008-03-07 01:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-03-04 21:24 ——— d—–w C:\Documents and Settings\Michael\Application Data\AdobeUM
2008-01-28 19:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\Dell
2008-01-23 20:37 ——— d—–w C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-01-23 20:34 ——— d—–w C:\Program Files\Common Files\supportsoft
2008-01-11 21:35 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-01-11 21:28 ——— d—–w C:\Documents and Settings\Michael\Application Data\GetRightToGo
2008-01-11 05:53 44,544 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll
2007-12-20 13:10 499,712 —-a-w C:\WINDOWS\SYSTEM32\msvcp71.dll
2007-12-20 13:10 348,160 —-a-w C:\WINDOWS\SYSTEM32\msvcr71.dll
2007-12-19 23:01 347,136 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll
2007-12-18 09:51 179,584 —-a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mrxdav.sys
1601-01-01 00:00 0 ——w C:\Program Files\
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2005-10-19 07:59 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2005-10-19 07:59 126976]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-12-17 12:28 684032]
"CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2008-03-06 20:24 234760]
"cafw"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [2008-03-06 20:24 771336]
"capfasem"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe" [2008-03-06 20:24 173320]
"capfupgrade"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2008-03-06 20:24 259336]
"QOELOADER"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.32\QOELoader.exe" [2008-03-06 20:24 14088]
"AtiPTA"="atiptaxx.exe" [2001-09-26 22:39 245760 C:\WINDOWS\SYSTEM32\atiptaxx.exe]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2003-04-09 05:56:24 598150]
KODAK Software Updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2002-03-13 04:08:34 16384]
Office Startup.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE [1997-08-01 51984]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
UmxWnp.Dll 2007-05-18 13:30 79368 C:\WINDOWS\SYSTEM32\UmxWNP.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
–a—— 2007-01-19 11:54 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
–a—— 2003-08-27 09:18 26112 C:\Program Files\Real\RealPlayer\RealPlay.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\CA Personal Firewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\MSN\\MSNCoreFiles\\msn.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
R0 KmxStart;KmxStart;C:\WINDOWS\system32\DRIVERS\kmxstart.sys [2007-10-18 10:24]
R1 KmxAgent;KmxAgent;C:\WINDOWS\system32\DRIVERS\kmxagent.sys [2007-05-18 13:30]
R1 KmxFile;KmxFile;C:\WINDOWS\system32\DRIVERS\KmxFile.sys [2007-05-18 13:30]
R1 KmxFw;KmxFw;C:\WINDOWS\system32\DRIVERS\kmxfw.sys [2007-10-18 14:21]
R2 FileSaver_Service;FileSaver_Service;"C:\Program Files\Energizer FileSaver\UPSMON_Service.Exe" [2003-07-20 16:03]
R2 KmxCF;KmxCF;C:\WINDOWS\system32\DRIVERS\KmxCF.sys [2007-10-18 10:24]
R2 KmxSbx;KmxSbx;C:\WINDOWS\system32\DRIVERS\KmxSbx.sys [2007-11-02 12:09]
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 09:23]
R2 UmxAgent;HIPS Event Manager;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe" [2007-10-18 10:24]
R2 UmxCfg;HIPS Configuration Interpreter;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe" [2007-10-18 10:24]
R2 UmxPol;HIPS Policy Manager;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe" [2007-05-18 13:30]
R3 ati2mtaa;ati2mtaa;C:\WINDOWS\system32\DRIVERS\ati2mtaa.sys [2004-08-04 00:29]
R3 KmxCfg;KmxCfg;C:\WINDOWS\system32\DRIVERS\kmxcfg.sys [2007-09-13 15:15]
S3 PPCtlPriv;PPCtlPriv;"C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe" [2008-03-06 20:24]
.
Contents of the 'Scheduled Tasks' folder
"2008-03-08 14:11:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-08 02:21:00 C:\WINDOWS\Tasks\CAAntiSpywareScan_Daily as Michael Turturro at 8 21 PM.job"
- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-08 22:19:13
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-03-08 22:22:19
ComboFix2.txt 2008-03-09 00:57:18
.
2008-03-08 02:20:15 — E O F —
LDTate
I only see this one.
Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a checkmark/tick in the box on the left side on these:
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
Close ALL windows and browsers except HijackThis and click "Fix checked"
Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a checkmark/tick in the box on the left side on these:
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
Close ALL windows and browsers except HijackThis and click "Fix checked"
metman
OK worked great pop up blocker is back. Last problem is that all users still are denied access to "program files" folder
LDTate
See if either of these help.
How to Take Ownership of a File or Folder in Windows XP
http://support.microsoft.com/kb/308421
How to disable simplified sharing & set permissions
on a shared folder in Windows XP
http://support.microsoft.com/kb/307874
How to Take Ownership of a File or Folder in Windows XP
http://support.microsoft.com/kb/308421
How to disable simplified sharing & set permissions
on a shared folder in Windows XP
http://support.microsoft.com/kb/307874
metman
Also something still has a hold on the CA Anti-Spyware real time protection. I click to enable it and it says will take after a reboot however it wont stay on for real-time protection.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI