Here you go ...thx kjd
ComboFix 08-04-03.3 - Kevin 2008-04-06 14:33:19.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1568 [GMT -5:00]
Running from: C:\Documents and Settings\Kevin\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Kevin\Desktop\CFScript.txt.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\kaka.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\kaka.exe
.
((((((((((((((((((((((((( Files Created from 2008-03-06 to 2008-04-06 )))))))))))))))))))))))))))))))
.
2008-04-06 13:57 . 2008-04-06 13:57 <DIR> d-------- C:\Program Files\ViewAhead
2008-04-04 16:06 . 2008-04-04 16:06 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-04-04 16:06 . 2008-04-04 16:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-04-02 17:31 . 2008-04-02 17:31 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-30 13:00 . 2008-03-30 13:00 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\CyberLink
2008-03-19 11:58 . 2008-04-06 14:01 <DIR> d-------- C:\Program Files\ABBYY FineReader 5.0 Sprint
2008-03-19 11:57 . 2008-03-19 11:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BVRP Software
2008-03-19 11:56 . 2003-09-23 00:42 303,104 --a------ C:\WINDOWS\system32\LEXBCES.EXE
2008-03-19 11:56 . 2003-09-23 00:55 286,720 --a------ C:\WINDOWS\system32\lxbfcomm.dll
2008-03-19 11:56 . 2003-09-23 00:36 201,216 --a------ C:\WINDOWS\system32\LEXP2P32.DLL
2008-03-19 11:56 . 2003-09-23 00:45 196,096 --a------ C:\WINDOWS\system32\LEX2KUSB.DLL
2008-03-19 11:56 . 2003-09-23 00:37 192,512 --a------ C:\WINDOWS\system32\lexlmpm.dll
2008-03-19 11:56 . 2003-09-23 00:37 174,592 --a------ C:\WINDOWS\system32\LEXPPS.EXE
2008-03-19 11:56 . 2003-09-23 00:39 147,456 --a------ C:\WINDOWS\system32\LEXBCE.DLL
2008-03-19 11:56 . 2003-09-23 00:36 73,728 --a------ C:\WINDOWS\system32\lxbfpwr.dll
2008-03-19 11:56 . 2002-11-13 14:40 40,960 --a------ C:\WINDOWS\system32\lxbfvs.dll
2008-03-19 11:55 . 2008-03-27 16:16 <DIR> d-------- C:\Program Files\Lexmark X6100 Series
2008-03-19 11:16 . 2008-03-19 11:16 <DIR> d-------- C:\Lxk6100
2008-03-08 11:31 . 2001-05-30 09:53 1,044,480 --a------ C:\WINDOWS\system32\ROBOEX32.DLL
2008-03-07 16:35 . 2004-08-04 00:08 26,496 --a------ C:\WINDOWS\system32\dllcache\usbstor.sys
2008-03-07 12:05 . 2008-03-07 12:05 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-03-07 12:05 . 2008-03-07 12:05 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-03-07 10:55 . 2008-03-07 10:55 <DIR> d-------- C:\Program Files\ABBYY FineReader 6.0
2008-03-07 10:47 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-03-07 10:47 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys
2008-03-07 10:46 . 1997-04-08 20:08 299,520 --a------ C:\WINDOWS\uninst.exe
2008-03-07 10:14 . 2004-08-04 00:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-03-07 10:14 . 2004-08-04 00:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys
2008-03-07 10:13 . 2004-08-04 00:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-03-07 10:13 . 2004-08-04 00:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-03-07 02:58 . 2008-03-10 18:17 <DIR> d-------- C:\Program Files\Windows Desktop Search
2008-03-07 02:57 . 2006-09-15 07:36 192,000 --------- C:\WINDOWS\system32\dllcache\offfilt.dll
2008-03-07 02:57 . 2006-09-15 07:36 98,304 --------- C:\WINDOWS\system32\dllcache\nlhtml.dll
2008-03-07 02:57 . 2006-09-15 07:36 29,696 --------- C:\WINDOWS\system32\dllcache\mimefilt.dll
2008-03-07 00:39 . 2008-02-22 03:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-06 23:28 . 2008-03-06 23:28 <DIR> d-------- C:\Documents and Settings\Kevin\WINDOWS
2008-03-06 23:28 . 2008-03-06 23:28 <DIR> d-------- C:\Documents and Settings\Kevin\viewone
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\Sony Corporation
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\Share-to-Web Upload Folder
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\Roxio
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\PC Tools
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\Palo Alto Software Inc
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\OfficeUpdate12
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\Netscape
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\Microsoft Web Folders
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\Leadertech
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\Lavasoft
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\IsolatedStorage
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\iPIX
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\Intuit
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\InterVideo
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\InterTrust
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\Interact Commerce
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\Intellisync Desktop
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\iambic
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\HP
2008-03-06 23:18 . 2008-03-08 11:14 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\Corel
2008-03-06 23:18 . 2008-03-06 23:18 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\AdobeUM
2008-03-06 22:37 . 2008-03-06 22:37 <DIR> d-------- C:\WINDOWS\873D68B3EDE54DFD85ACFFC430FB7EE2.TMP
2008-03-06 22:31 . 2008-03-06 22:31 <DIR> d-------- C:\Program Files\SSI
2008-03-06 22:31 . 2008-03-06 22:31 <DIR> d-------- C:\Program Files\Roguescanfix
2008-03-06 22:31 . 2008-03-06 22:31 <DIR> d-------- C:\Program Files\Quicken
2008-03-06 22:31 . 2008-03-06 22:31 <DIR> d-------- C:\Program Files\Project64 1.6
2008-03-06 22:30 . 2008-03-06 22:31 <DIR> d-------- C:\Program Files\Mplayer
2008-03-06 22:30 . 2008-03-06 22:30 <DIR> d-------- C:\Program Files\Microsoft SQL Server
2008-03-06 22:30 . 2008-03-06 22:30 <DIR> d-------- C:\Program Files\Microprose
2008-03-06 22:30 . 2008-03-06 22:30 <DIR> d-------- C:\Program Files\Eidos Interactive
2008-03-06 22:30 . 2008-03-06 22:30 <DIR> d-------- C:\Program Files\Common Files\Palo Alto Software
2008-03-06 22:28 . 2008-03-06 22:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Intuit
2008-03-06 20:12 . 2008-03-06 20:12 <DIR> d-------- C:\usr
2008-03-06 20:12 . 2008-03-06 20:12 <DIR> d--h----- C:\system.sav
2008-03-06 19:52 . 2008-03-06 22:43 <DIR> d-a------ C:\SwSetup
2008-03-06 19:52 . 2008-03-06 19:52 <DIR> d-------- C:\spoolerlogs
2008-03-06 19:52 . 2008-03-06 19:52 <DIR> d-------- C:\SIERRA
2008-03-06 19:51 . 2008-03-06 19:52 <DIR> d-------- C:\REALEST
2008-03-06 19:51 . 2008-03-06 19:51 <DIR> d-------- C:\My Download Files
2008-03-06 19:51 . 2008-03-06 19:51 <DIR> d-------- C:\cpqs
2008-03-06 19:42 . 2008-03-06 19:42 <DIR> d-------- C:\WINDOWS\Windows Update Setup Files
2008-03-06 19:42 . 2008-03-06 19:42 <DIR> d-------- C:\WINDOWS\VerizonOnline
2008-03-06 19:42 . 2008-03-06 19:42 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-03-06 19:42 . 2008-03-06 19:42 <DIR> d-------- C:\WINDOWS\Sun
2008-03-06 19:42 . 2008-03-06 19:42 <DIR> d-------- C:\WINDOWS\SQLHotfix
2008-03-06 19:42 . 2008-03-06 19:42 <DIR> d-------- C:\WINDOWS\solcache
2008-03-06 19:42 . 2008-03-06 19:42 <DIR> d--h----- C:\WINDOWS\PIF
2008-03-06 19:41 . 2008-03-06 19:41 <DIR> d--h----- C:\WINDOWS\msdownld.tmp
2008-03-06 19:39 . 2008-03-06 19:39 <DIR> d-------- C:\WINDOWS\Corel
2008-03-06 19:39 . 2008-03-06 19:39 <DIR> d-------- C:\WINDOWS\Cache
2008-03-06 19:39 . 2008-03-06 19:39 <DIR> d-------- C:\WINDOWS\BBSTORE
2008-03-06 19:35 . 2008-03-06 19:35 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-03-06 19:35 . 2008-03-06 19:35 <DIR> d-------- C:\Program Files\Web Publish
2008-03-06 19:34 . 2008-03-06 19:34 <DIR> d-------- C:\Program Files\TaxMaster
2008-03-06 19:34 . 2008-03-06 19:34 <DIR> d-------- C:\Program Files\TaxEstimator353
2008-03-06 19:34 . 2008-03-06 19:34 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-03-06 19:32 . 2008-03-06 19:34 <DIR> d-------- C:\Program Files\Sony Handheld
2008-03-06 19:32 . 2008-03-06 19:32 <DIR> d-------- C:\Program Files\Sony
2008-03-06 19:32 . 2008-03-06 19:32 <DIR> d-------- C:\Program Files\REFN
2008-03-06 19:32 . 2008-03-06 19:32 <DIR> d-------- C:\Program Files\Real
2008-03-06 19:32 . 2008-03-06 19:32 <DIR> d-------- C:\Program Files\Pocket Tanks
2008-03-06 19:32 . 2008-03-06 19:32 <DIR> d-------- C:\Program Files\Netflix
2008-03-06 19:32 . 2008-03-06 19:32 <DIR> d-------- C:\Program Files\MSXML 4.0
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-06 19:37 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-06 19:18 3,932 ----a-w C:\Documents and Settings\Kevin\Application Data\LMLayout.dat
2008-04-06 19:18 268 ----a-w C:\Documents and Settings\Kevin\Application Data\LMCPaper.dat
2008-04-06 18:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-06 17:01 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-04-06 17:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-03-16 22:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-03-07 23:25 --------- d-----w C:\Program Files\Google
2008-03-07 23:23 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-07 06:12 --------- d-----w C:\Program Files\Microsoft Works
2008-03-07 05:39 --------- d-----w C:\Program Files\Java
2008-03-07 04:19 --------- d-----w C:\Documents and Settings\Kevin\Application Data\Symantec
2008-03-07 03:30 --------- d-----w C:\Program Files\CONEXANT
2008-03-07 02:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-07 02:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-07 02:32 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-03-06 23:29 --------- d-----w C:\Program Files\Common Files\Roxio Shared
2008-03-06 23:28 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-03-06 23:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-03-06 23:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\InstallShield
2008-03-05 03:23 --------- d--h--w C:\Documents and Settings\Kevin\Application Data\GTek
2008-03-04 13:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-03-04 04:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Dell
2008-03-04 03:44 --------- d-----w C:\Documents and Settings\Kevin\Application Data\Spearit
2008-03-04 03:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spearit
2008-03-04 03:44 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Spearit
2008-03-04 03:43 --------- d-----w C:\Program Files\Laplink
2008-03-04 03:43 --------- d-----w C:\Program Files\Common Files\Laplink
2008-03-04 02:53 --------- d-----w C:\Program Files\Norton Internet Security
2008-03-04 02:48 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-03-04 02:48 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-03-04 02:48 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-03-04 02:48 --------- d-----w C:\Program Files\Symantec
2008-03-04 02:29 --------- d-----w C:\Documents and Settings\Kevin\Application Data\Dell
2008-02-26 16:38 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Symantec
2008-02-26 16:37 --------- d-----w C:\Program Files\Windows Sidebar
2008-02-26 16:35 --------- d--h--w C:\Documents and Settings\Administrator\Application Data\GTek
2008-02-26 16:35 --------- d-----w C:\Program Files\DellAutomatedPCTuneUp
2008-02-26 16:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Gtek
2008-02-26 16:34 --------- d-----w C:\Program Files\MSECache
2008-02-26 16:32 --------- d-----w C:\Program Files\Dell Support Center
2008-02-26 16:32 --------- d-----w C:\Program Files\Dell
2008-02-26 16:32 --------- d-----w C:\Program Files\CyberLink
2008-02-26 16:32 --------- d-----w C:\Program Files\Common Files\supportsoft
2008-02-26 16:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-02-26 16:31 --------- d-----w C:\Program Files\Dell Network Assistant
2008-02-26 16:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\SingleClick Systems
2008-02-26 16:29 --------- d-----w C:\Program Files\Microsoft.NET
2008-02-26 16:26 --------- d-----w C:\Program Files\Roxio
2008-02-26 16:26 --------- d-----w C:\Program Files\Common Files\SureThing Shared
2008-02-26 16:26 --------- d-----w C:\Program Files\Common Files\Sonic Shared
2008-02-26 16:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sonic
2008-02-26 16:25 --------- d-----w C:\Program Files\Sigmatel
2008-02-26 16:21 --------- d-----w C:\Program Files\WIDCOMM
2008-02-26 16:21 --------- d-----w C:\Program Files\NetWaiting
2008-02-26 16:21 --------- d-----w C:\Program Files\Modem Diagnostic Tool
2008-02-26 16:21 --------- d-----w C:\Program Files\Digital Line Detect
2008-02-26 16:21 --------- d-----w C:\Program Files\Broadcom
2008-02-26 16:21 --------- d-----w C:\Documents and Settings\Kevin\Application Data\InstallShield
2008-02-26 16:21 --------- d-----w C:\Documents and Settings\Administrator\Application Data\InstallShield
2008-02-26 16:20 --------- d-----w C:\Program Files\SetPoint
2008-02-26 16:20 --------- d-----w C:\Program Files\Common Files\Logitech
2008-02-26 16:20 --------- d-----w C:\Documents and Settings\Kevin\Application Data\Logitech
2008-02-26 16:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
2008-02-26 16:20 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Logitech
2008-02-26 16:17 --------- d-----w C:\Program Files\Common Files\Java
2008-02-26 16:16 --------- d-----w C:\Program Files\MSXML 6.0
2008-02-26 16:00 --------- d-----w C:\Program Files\Synaptics
2008-02-26 15:52 7,411 ----a-w C:\WINDOWS\system32\drivers\1028_Dell_VOS_1500.mrk
2008-02-19 19:44 96,432 ----a-w C:\WINDOWS\system32\drivers\symfw.sys
2008-02-19 19:44 41,008 ----a-w C:\WINDOWS\system32\drivers\symndisv.sys
2008-02-19 19:44 38,576 ----a-w C:\WINDOWS\system32\drivers\symids.sys
2008-02-19 19:44 37,424 ----a-w C:\WINDOWS\system32\drivers\symndis.sys
2008-02-19 19:44 31,408 ----a-w C:\WINDOWS\system32\drivers\SymIM.sys
2008-02-19 19:44 22,320 ----a-w C:\WINDOWS\system32\drivers\symredrv.sys
2008-02-19 19:44 188,464 ----a-w C:\WINDOWS\system32\drivers\symtdi.sys
2008-02-19 19:44 13,616 ----a-w C:\WINDOWS\system32\drivers\symdns.sys
2008-02-19 19:44 13,021 ----a-w C:\WINDOWS\system32\drivers\SymRedir.cat
2008-02-19 19:44 1,612 ----a-w C:\WINDOWS\system32\drivers\SymRedir.inf
2004-07-27 15:41 632 ----a-w C:\Program Files\Shortcut to TaxEstimator35.lnk
2002-01-18 14:52 3,932 ----a-w C:\Documents and Settings\LocalService\Application Data\LMLayout.dat
2006-07-27 00:37 56 --sha-r C:\WINDOWS\system32\CB5678212A.sys
2006-11-01 15:11 1,786 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((( snapshot@2008-04-03_13.51.57.34 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-05-24 17:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 20:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 20:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
- 2002-07-11 14:34:14 77,824 ----a-r C:\WINDOWS\system32\LMBGlay.dll
+ 2002-07-11 19:34:14 77,824 ----a-w C:\WINDOWS\system32\LMBGlay.dll
- 2002-07-11 14:34:02 57,344 ----a-r C:\WINDOWS\system32\LMBGmnt.dll
+ 2002-07-11 19:34:02 57,344 ----a-w C:\WINDOWS\system32\LMBGmnt.dll
- 2002-07-11 14:34:24 57,344 ----a-r C:\WINDOWS\system32\LMBGpapr.dll
+ 2002-07-11 19:34:24 57,344 ----a-w C:\WINDOWS\system32\LMBGpapr.dll
- 2002-07-11 14:34:34 28,672 ----a-r C:\WINDOWS\system32\LMBGqlty.dll
+ 2002-07-11 19:34:34 28,672 ----a-w C:\WINDOWS\system32\LMBGqlty.dll
- 2002-07-11 14:33:20 147,456 ----a-r C:\WINDOWS\system32\LMBGSHEX.DLL
+ 2002-07-11 19:33:20 147,456 ----a-w C:\WINDOWS\system32\LMBGSHEX.DLL
- 2002-07-11 14:34:42 40,960 ----a-r C:\WINDOWS\system32\LMBGsts.dll
+ 2002-07-11 19:34:42 40,960 ----a-w C:\WINDOWS\system32\LMBGsts.dll
- 2002-07-11 14:32:46 32,768 ----a-r C:\WINDOWS\system32\LMGetSt.dll
+ 2002-07-11 19:32:46 32,768 ----a-w C:\WINDOWS\system32\LMGetSt.dll
- 2002-07-11 14:32:04 167,936 ----a-r C:\WINDOWS\system32\LMInkUtl.dll
+ 2002-07-11 19:32:04 167,936 ----a-w C:\WINDOWS\system32\LMInkUtl.dll
- 2002-01-18 07:52:12 3,932 ----a-r C:\WINDOWS\system32\LMLayout.dat
+ 2002-01-18 12:52:12 3,932 ----a-w C:\WINDOWS\system32\LMLayout.dat
- 2002-07-11 14:31:36 81,920 ----a-r C:\WINDOWS\system32\LMLayout.dll
+ 2002-07-11 19:31:36 81,920 ----a-w C:\WINDOWS\system32\LMLayout.dll
- 2002-07-11 14:31:48 65,536 ----a-r C:\WINDOWS\system32\LMPDPMON.DLL
+ 2002-07-11 19:31:48 65,536 ----a-w C:\WINDOWS\system32\LMPDPMON.DLL
- 2002-07-11 14:33:44 98,304 ----a-r C:\WINDOWS\system32\LMPdpStr.DLL
+ 2002-07-11 19:33:44 98,304 ----a-w C:\WINDOWS\system32\LMPdpStr.DLL
- 2002-07-11 14:33:56 53,248 ----a-r C:\WINDOWS\system32\LMPDPUI.exe
+ 2002-07-11 19:33:56 53,248 ----a-w C:\WINDOWS\system32\LMPDPUI.exe
- 2002-05-03 09:59:58 14,508 ----a-r C:\WINDOWS\system32\LXBGUSB.DLL
+ 2002-05-03 14:59:58 14,508 ----a-w C:\WINDOWS\system32\LXBGUSB.DLL
- 2008-04-02 04:14:46 27,335 ----a-w C:\WINDOWS\system32\nvModes.dat
+ 2008-04-06 03:08:36 27,335 ----a-w C:\WINDOWS\system32\nvModes.dat
- 2008-04-02 22:30:45 54,682 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-06 19:16:33 54,682 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-04-02 22:30:45 385,164 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-06 19:16:33 385,164 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2002-07-11 14:32:40 57,344 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGCc32.dll
+ 2002-07-11 19:32:40 57,344 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGCc32.dll
- 2002-07-11 14:34:14 77,824 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGlay.dll
+ 2002-07-11 19:34:14 77,824 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGlay.dll
- 2002-07-11 14:34:02 57,344 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGmnt.dll
+ 2002-07-11 19:34:02 57,344 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGmnt.dll
- 2002-07-11 14:34:24 57,344 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGpapr.dll
+ 2002-07-11 19:34:24 57,344 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGpapr.dll
- 2002-07-11 14:34:34 28,672 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGqlty.dll
+ 2002-07-11 19:34:34 28,672 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGqlty.dll
- 2002-07-11 14:32:26 1,167,360 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGres.dll
+ 2002-07-11 19:32:26 1,167,360 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGres.dll
- 2002-07-11 14:33:20 147,456 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGSHEX.DLL
+ 2002-07-11 19:33:20 147,456 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGSHEX.DLL
- 2002-07-11 14:34:42 40,960 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGsts.dll
+ 2002-07-11 19:34:42 40,960 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMBGsts.dll
- 2002-07-11 14:32:46 32,768 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMGetSt.dll
+ 2002-07-11 19:32:46 32,768 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMGetSt.dll
- 2002-07-11 14:32:56 53,248 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMGrxNT.DLL
+ 2002-07-11 19:32:56 53,248 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMGrxNT.DLL
- 2002-07-11 14:32:04 167,936 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMInkUtl.dll
+ 2002-07-11 19:32:04 167,936 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMInkUtl.dll
- 2002-01-18 07:52:12 3,932 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMLayout.dat
+ 2002-01-18 12:52:12 3,932 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMLayout.dat
- 2002-07-11 14:31:36 81,920 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMLayout.dll
+ 2002-07-11 19:31:36 81,920 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMLayout.dll
- 2002-07-11 14:31:48 65,536 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPDPMON.DLL
+ 2002-07-11 19:31:48 65,536 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPDPMON.DLL
- 2002-07-11 14:31:56 45,056 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMpdpsrv.exe
+ 2002-07-11 19:31:56 45,056 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMpdpsrv.exe
- 2002-07-11 14:33:44 98,304 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPdpStr.DLL
+ 2002-07-11 19:33:44 98,304 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPdpStr.DLL
- 2002-07-11 14:33:56 53,248 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPDPUI.exe
+ 2002-07-11 19:33:56 53,248 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPDPUI.exe
- 2002-07-11 14:33:14 176,128 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPriNT.dll
+ 2002-07-11 19:33:14 176,128 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMPriNT.dll
- 2002-07-11 14:33:42 143,360 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMUiNT.DLL
+ 2002-07-11 19:33:42 143,360 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LMUiNT.DLL
- 2002-02-26 12:48:44 1,667,072 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\lxbgclr.dll
+ 2002-02-26 17:48:44 1,667,072 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\lxbgclr.dll
- 2002-02-26 12:48:42 57,344 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\lxbgfc5c.dll
+ 2002-02-26 17:48:42 57,344 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\lxbgfc5c.dll
- 2002-02-26 12:48:46 290,816 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\lxbgicur.dll
+ 2002-02-26 17:48:46 290,816 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\lxbgicur.dll
- 2002-02-22 08:21:48 86,016 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LXBGMDM.DLL
+ 2002-02-22 13:21:48 86,016 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LXBGMDM.DLL
- 2002-05-03 09:59:58 14,508 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LXBGUSB.DLL
+ 2002-05-03 14:59:58 14,508 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\LXBGUSB.DLL
- 2001-05-30 09:53:46 1,044,480 ----a-r C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\ROBOEX32.DLL
+ 2001-05-30 14:53:46 1,044,480 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\lexmarkx1258974\ROBOEX32.DLL
- 2002-07-11 14:33:14 176,128 ----a-r C:\WINDOWS\system32\spool\prtprocs\w32x86\LMPriNT.dll
+ 2002-07-11 19:33:14 176,128 ----a-w C:\WINDOWS\system32\spool\prtprocs\w32x86\LMPriNT.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
2008-01-07 12:47 316784 --a------ C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-03-03 21:47 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= "C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll" [2008-01-07 12:47 316784]
[HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-03 15:20 851968]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-01-29 16:14 8491008]
"nwiz"="nwiz.exe" [2008-01-29 16:14 1626112 C:\WINDOWS\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2008-01-29 16:14 86016 C:\WINDOWS\system32\nvhotkey.dll]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-01-29 16:14 81920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"Logitech Hardware Abstraction Layer"="C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE" [2007-10-09 09:09 100888]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2007-03-16 04:10 1392640]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2007-05-14 15:23 1191936]
"SigmatelSysTrayApp"="stsystra.exe" [2007-06-06 16:28 405504 C:\WINDOWS\stsystra.exe]
"KADxMain"="C:\WINDOWS\system32\KADxMain.exe" [2006-11-02 15:05 282624]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 17:50 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 17:50 81920]
"RoxioDragToDisc"="C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 10:00 1116920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 19:57 16384]
"PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" [2007-11-01 16:39 189736]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-14 12:01 51048]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2008-01-07 12:49 714608]
"Intellisync Handheld Launcher"="C:\Program Files\Intellisync Corporation\Intellisync Handheld Edition\ishhlauncher.exe" [2006-12-18 01:49 1558224]
"CARPService"="carpserv.exe" [2003-05-21 15:35 4608 C:\WINDOWS\system32\carpserv.exe]
"PreloadApp"="c:\hp\drivers\printers\photosmart\hphprld.exe" [ ]
"srmclean"="C:\Cpqs\Scom\srmclean.exe" [2001-07-24 16:34 36864]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [ ]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-10-09 09:09 100888 C:\WINDOWS\KHALMNPR.Exe]
"Lexmark X6100 Series"="C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe" [2003-09-23 01:01 57344]
"LMPDPSRV"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE" [2002-07-11 14:31 45056]
C:\Documents and Settings\Kevin\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2008-03-09 12:22:59 256000]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-05-17 16:43:18 568176]
Dell Network Assistant.lnk - C:\WINDOWS\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe [2008-02-26 11:31:14 7168]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-02-26 11:21:18 50688]
HotSync Manager.lnk - C:\Program Files\Sony Handheld\HOTSYNC.EXE [2002-08-09 15:36:20 299008]
Lexmark X125 Settings Utility.lnk - C:\Program Files\Lexmark X125\LEX125SU.exe [2008-04-06 13:56:32 1810432]
SetPoint.lnk - C:\Program Files\SetPoint\SetPoint.exe [2008-02-26 11:20:23 679936]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
"C:\\Program Files\\Dell Network Assistant\\ezi_hnm2.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC
R1 DLARTL_M;DLARTL_M;C:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2006-08-11 11:35]
R2 datunidr;DellAutomatedPCTuneUp UniDriver;C:\WINDOWS\system32\DRIVERS\datunidr.sys [2007-08-23 19:29]
R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon []
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-10-09 19:56]
R3 DXEC02;DXEC02;C:\WINDOWS\system32\drivers\dxec02.sys [2006-11-02 13:31]
R3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-02-19 14:44]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-03-06 21:32]
S3 DellAMBrokerService;DellAMBrokerService;"C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe" [2007-10-11 10:49]
S3 LLUSBFLT;LLUSBFLT;C:\WINDOWS\system32\drivers\llusbflt.sys [2005-08-03 16:59]
S3 PLUsbbc2;High-Speed USB Bridge Cable Driver;C:\WINDOWS\system32\Drivers\usbbc2.sys [2005-08-03 16:59]
S3 PTproct;PTproct;C:\Program Files\DellAutomatedPCTuneUp\GTAction\triggers\PTproct.sys [2006-10-05 17:07]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-02-19 14:44]
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-03-11 01:55:41 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Kevin.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-04-06 14:37:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\DLAAPI_W.DLL
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\DOCUME~1\Kevin\LOCALS~1\Temp\InstallShieldClean.0001
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
C:\\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2008-04-06 14:41:01 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-06 19:40:57
ComboFix2.txt 2008-04-04 20:59:25
ComboFix3.txt 2008-04-03 18:52:14
Pre-Run: 90,340,864,000 bytes free
Post-Run: 90,340,364,288 bytes free
.
2008-03-14 16:21:44 --- E O F ---
Malwarebytes' Anti-Malware 1.10
Database version: 597
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 122329
Time elapsed: 44 minute(s), 7 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 21
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorertoolbar (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\stfngdvw.bovp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\stfngdvw.ToolBar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:35:48 PM, on 04/06/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\KADxMain.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Intellisync Corporation\Intellisync Handheld Edition\ishhlauncher.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\Kevin\LOCALS~1\Temp\InstallShieldClean.0001
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Sony Handheld\HOTSYNC.EXE
C:\Program Files\Lexmark X125\LEX125SU.exe
C:\Program Files\SetPoint\SetPoint.exe
C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\WINDOWS\explorer.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.cnn.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://www.cnn.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [KADxMain] C:\WINDOWS\system32\KADxMain.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Intellisync Handheld Launcher] "C:\Program Files\Intellisync Corporation\Intellisync Handheld Edition\ishhlauncher.exe" /logon
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Lexmark X6100 Series] "C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe"
O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Dell Network Assistant.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe
O4 - Global Startup: SetPoint.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01118F00-3E00-11D2-8470-0060089874ED} (SupportSoft RemoteControl Class) -
http://symantec.atgn...wnload/ssrc.cab
O16 - DPF: {01119400-3E00-11D2-8470-0060089874ED} (SupportSoft Listener Control) -
http://symantec.atgn...d/sprtctlln.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
http://www.kaspersky...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft....k/?linkid=39204
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} -
http://www.symantec....rl/LSSupCtl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} -
http://www.symantec....rl/SymAData.cab
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: DellAMBrokerService - Unknown owner - C:\Program Files\DellAutomatedPCTuneUp\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe
O23 - Service: InstallShield Licensing Service - Macrovision - C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
--
End of file - 11222 bytes