Spyware / Malware / Virus Removal

[Resolved] VirusRL2009 infection

9 min read

Looking for the outcome? Ask AI

OfficialDom Topic Starter

Post #1October 6, 2008, 2:56 PM UTC

I was reading your response to Jash172001's problem and was so impressed that I felt I had to join up!

This computer has been infected with a virus that runs VirusRL2009.exe at start up

It also came up with the networm-i.virus@fp warning box in the systray but i do not know if this is connected or a different virus.

I downloaded and ran SDFix in Safe Mode, but when I rebooted a second time in normal mode the Virus RL209 started up again. I haven't seen the networm-i.virus@fp warning box since running SDFix though.

I can't say that I have noticed any appreciable slowing, but it is a pretty slow machine to start with

Oh and Norton 360 (and the Norton Security Scanner) both say that there is nothing wrong! (Although to give it some due, Norton 360 did report at first that it had found a trojan with a name that had 'FakeAV' and 'Virus' in its name but although it told me that it had fixed the problem, it clearly hasn't and now says everything is fine!)

The Hijack This report is:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:46:23, on 06/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Kontiki\KService.exe
C:\WINDOWS\system32\NWDLS.exe
C:\WINDOWS\system32\RioMSC.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\EzButton\CPLDFL10.EXE
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\WINDOWS\twain_32\S6U12BX\WATCH.exe
C:\WINDOWS\system32\taskmgr.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://windiwsfsearch.com
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://windiwsfsearch.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://windiwsfsearch.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://windiwsfsearch.com/ie6.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://windiwsfsearch.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: VRLWarningBHO Class - {0DCD4F35-9FD5-420b-A9AA-FED0E2AECEE0} - C:\Program Files\VirusRL2009\AVLWarning.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O2 - BHO: 590075 helper - {AFC8A14F-B50A-4F0F-8FB7-77982092D81D} - C:\WINDOWS\system32\590075\590075.dll
O2 - BHO: (no name) - {CFEE97A3-4911-444D-8BE8-E243A23D3DE2} - C:\Program Files\Applications\iebt.dll (file missing)
O3 - Toolbar: Internet Service - {144A6B24-0EBC-4D89-BF09-A06A718E57B5} - C:\Program Files\Applications\iebr.dll (file missing)
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [CPLDFL10] C:\PROGRA~1\EzButton\CPLDFL10.EXE
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [VirusRL2009] "C:\Program Files\VirusRL2009\VirusRL2009.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O4 - Global Startup: Watch.lnk = C:\WINDOWS\twain_32\S6U12BX\WATCH.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file:///C:\Program Files\TOSHIBA\Free Update Service\splash.html
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/haphazard/raptisoftgameloader.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Netgear Wireless Domain Login Service (NWDLS) - Unknown owner - C:\WINDOWS\system32\NWDLS.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O24 - Desktop Component 0: (no name) - file:///C:/Program%20Files/CASIO/Photo%20Loader/Image%20Library/20041118/CIMG0660.JPG

–
End of file - 11760 bytes

Thanks in anticipation of your help!

Dom

Rorschach112

Post #2October 6, 2008, 3:19 PM UTC

Hello

Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.

Please download SmitfraudFix (by S!Ri) to your Desktop.

Next, please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

Once in Safe Mode, double-click on SmitfraudFix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.

Also post a new HJT log

OfficialDom

Post #3October 6, 2008, 4:43 PM UTC

Hi Rorschach112

Thanks for you quick response.

Here is the Rapport.txt file

SmitFraudFix v2.356

Scan done at 17:12:10.29, 06/10/2008
Run from C:\Documents and Settings\Sarah\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\algg.exe Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

C:\Program Files\VirusRL2009\AVLWarning.dll deleted.

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
C:\WINDOWS\system32\590075\590075.dll deleted.
C:\WINDOWS\system32\590075\ deleted.

»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{EA231102-C6B2-40AD-A917-6E7589DB4A19}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{EC0A9D6C-DB1C-45C0-8A2F-13FD94C9B1CC}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\..\{EA231102-C6B2-40AD-A917-6E7589DB4A19}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{EA231102-C6B2-40AD-A917-6E7589DB4A19}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

NOTE: Wininet.dll was apparantly NOT infected.

However the VirusRL2009 file started running again at start up.

Here is the hijck this report

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:41:52, on 06/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Kontiki\KService.exe
C:\WINDOWS\system32\NWDLS.exe
C:\WINDOWS\system32\RioMSC.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\EzButton\CPLDFL10.EXE
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe
C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\WINDOWS\twain_32\S6U12BX\WATCH.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\WINDOWS\system32\taskmgr.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [CPLDFL10] C:\PROGRA~1\EzButton\CPLDFL10.EXE
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [VirusRL2009] "C:\Program Files\VirusRL2009\VirusRL2009.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O4 - Global Startup: Watch.lnk = C:\WINDOWS\twain_32\S6U12BX\WATCH.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file:///C:\Program Files\TOSHIBA\Free Update Service\splash.html
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/haphazard/raptisoftgameloader.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Netgear Wireless Domain Login Service (NWDLS) - Unknown owner - C:\WINDOWS\system32\NWDLS.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

–
End of file - 10330 bytes

Thanks

Rorschach112

Post #4October 6, 2008, 4:49 PM UTC

Hello

Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

OfficialDom

Post #5October 6, 2008, 6:26 PM UTC

Thanks

Here is the combofix log

ComboFix 08-10-06.01 - Sarah 2008-10-06 18:43:43.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.173 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Programs\Uninstall.lnk
C:\WINDOWS\Downloaded Program Files\setup.inf

.
((((((((((((((((((((((((( Files Created from 2008-09-06 to 2008-10-06 )))))))))))))))))))))))))))))))
.

2008-10-06 18:38 . 2008-10-06 18:38 6,736 –a—— C:\WINDOWS\system32\drivers\PROCEXP90.SYS
2008-10-06 17:12 . 2008-10-06 17:12 3,816 –a—— C:\WINDOWS\system32\tmp.reg
2008-10-06 15:45 . 2008-10-06 15:45 d——– C:\Program Files\Trend Micro
2008-10-06 14:06 . 2008-10-06 14:06 d——– C:\WINDOWS\ERUNT
2008-10-06 14:05 . 2008-10-06 14:29 d——– C:\SDFix
2008-10-06 10:36 . 2008-10-06 10:37 d——– C:\nss
2008-10-05 23:41 . 2008-06-23 17:57 6,066,176 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll
2008-10-05 23:41 . 2007-04-17 10:32 2,455,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-10-05 23:41 . 2007-03-08 06:10 991,232 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-10-05 23:41 . 2008-06-23 17:57 459,264 —–c— C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-10-05 23:41 . 2008-06-23 17:57 383,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-10-05 23:41 . 2008-06-23 17:57 267,776 —–c— C:\WINDOWS\system32\dllcache\iertutil.dll
2008-10-05 23:41 . 2008-06-23 17:57 63,488 —–c— C:\WINDOWS\system32\dllcache\icardie.dll
2008-10-05 23:41 . 2008-06-23 17:57 52,224 —–c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-10-05 23:41 . 2008-06-23 10:20 13,824 —–c— C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-10-05 20:27 . 2008-10-05 20:27 d——– C:\Program Files\Windows Sidebar
2008-10-05 20:26 . 2008-10-05 23:03 d——– C:\Program Files\Norton 360
2008-10-05 20:22 . 2008-10-05 20:30 123,952 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-10-05 20:22 . 2008-10-05 20:30 60,800 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2008-10-05 20:22 . 2008-10-05 20:30 10,563 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-10-05 20:22 . 2008-10-05 20:30 805 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-10-05 17:43 . 2008-10-05 17:43 d——– C:\Documents and Settings\All Users\Symantec Temporary Files
2008-10-05 17:11 . 2008-10-06 17:14 d——– C:\Program Files\VirusRL2009
2008-10-05 17:11 . 2008-10-06 17:28 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-06 17:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kontiki
2008-10-06 17:36 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-10-06 14:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-05 22:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-10-05 21:13 ——— d—–w C:\Documents and Settings\Sarah\Application Data\Symantec
2008-10-05 19:30 ——— d—–w C:\Program Files\Symantec
2008-08-30 00:30 ——— d—–w C:\Program Files\Oberon Media
2008-08-28 19:43 ——— d—–w C:\Documents and Settings\Sarah\Application Data\Sibelius Software
2008-07-18 21:10 94,920 —-a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 21:10 53,448 —-a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 21:10 45,768 —-a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 21:10 36,552 —-a-w C:\WINDOWS\system32\wups.dll
2008-07-18 21:09 563,912 —-a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 21:09 325,832 —-a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 21:09 205,000 —-a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 21:09 1,811,656 —-a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 21:07 270,880 —-a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 21:07 210,976 —-a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:32 253,952 —-a-w C:\WINDOWS\system32\es.dll
2007-07-03 20:30 525,624 -c–a-w C:\Documents and Settings\Sarah\WindowsXP-KB922120-v5-x86-ENU-lltd.exe
2006-03-07 15:04 32 -c–a-r C:\Documents and Settings\All Users\hash.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
2008-02-26 09:34 576352 –a—— C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
2008-02-26 09:34 576352 –a—— C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
2008-02-26 09:34 576352 –a—— C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2003-09-05 65536]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2004-11-24 880640]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-06 68856]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 1032640]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"VirusRL2009"="C:\Program Files\VirusRL2009\VirusRL2009.exe" [2008-09-27 1810432]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-10-28 335872]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2003-06-18 151552]
"CeEPOWER"="C:\Program Files\TOSHIBA\Power Management\CePMTray.exe" [2003-11-03 135168]
"CPLDFL10"="C:\PROGRA~1\EzButton\CPLDFL10.EXE" [2003-11-19 294912]
"CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [2003-11-05 638976]
"TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [2003-04-28 49152]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 196608]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-04-13 69632]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-08 77824]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe" [2004-11-25 143360]
"DataLayer"="C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE" [2004-12-09 1068032]
"AS00_Gear511"="C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe" [2006-10-13 1130496]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"4oD"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 1032640]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-02 185896]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-18 51048]
"osCheck"="C:\Program Files\Norton 360\osCheck.exe" [2008-02-26 988512]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 C:\WINDOWS\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2003-11-19 C:\WINDOWS\agrsmmsg.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Symantec NetDriver Warning"="C:\PROGRA~1\SYMNET~1\SNDWarn.exe" [2004-10-29 218232]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2003-08-25 614536]
KODAK Software Updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2003-06-08 16432]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
Script execution time was exceeded on script "C:\ComboFix\lnkread.vbs".
Script execution was terminated.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\VirusRL2009\\VirusRL2009.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13364:UDP"= 13364:UDP:Print Server Utility
"13107:UDP"= 13107:UDP:Print Server Utility
"69:UDP"= 69:UDP:Print Server Utility

R2 DPortIO;Dritek Port I/O Driver;C:\WINDOWS\system32\Drivers\DPortIO.sys [2001-04-12 3674]
R3 AWINDIS5;AWINDIS5 Protocol Driver;C:\WINDOWS\system32\AWINDIS5.SYS [2006-02-25 16194]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 23888]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ad2b4176-17e5-11da-ada4-00095b98be2c}]
\Shell\AutoRun\command - E:\setupSNK.exe

*Newly Created Service* - COMHOST
*Newly Created Service* - PROCEXP90
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{144A6B24-0EBC-4D89-BF09-A06A718E57B5} - (no file)

.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\Sarah\Application Data\Mozilla\Firefox\Profiles\1aapah2q.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-06 18:50:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2008-10-06 18:55:33
ComboFix-quarantined-files.txt 2008-10-06 17:54:27

Pre-Run: 1,551,667,200 bytes free
Post-Run: 1,557,696,512 bytes free

168 — E O F — 2008-10-05 22:49:16

and here is the hijack this log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:25:29, on 06/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [CPLDFL10] C:\PROGRA~1\EzButton\CPLDFL10.EXE
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [VirusRL2009] "C:\Program Files\VirusRL2009\VirusRL2009.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O4 - Global Startup: Watch.lnk = C:\WINDOWS\twain_32\S6U12BX\WATCH.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file:///C:\Program Files\TOSHIBA\Free Update Service\splash.html
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/haphazard/raptisoftgameloader.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Netgear Wireless Domain Login Service (NWDLS) - Unknown owner - C:\WINDOWS\system32\NWDLS.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

–
End of file - 8243 bytes

Thanks for your help

Rorschach112

Post #6October 6, 2008, 6:37 PM UTC

Hello

Open notepad and copy/paste the text in the quotebox below into it:

http://forums.whatthetech.com/VirusRL2009_infection_t95897.html#entry490801

Collect::[12]
C:\Program Files\VirusRL2009

DirLook::
C:\nss

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ad2b4176-17e5-11da-ada4-00095b98be2c}]

Sysrst::

Suspect::

Save this as CFScript.txt

[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.
A browser will open.
Simply follow the instructions to copy/paste/send the requested file.

OfficialDom

Post #7October 6, 2008, 7:24 PM UTC

Hi again

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

* Ensure you are connected to the internet and click OK on the message box.
* A browser will open.
* Simply follow the instructions to copy/paste/send the requested file.

Unfortunately it didn't! It produced the log and is now sitting there with a blank screen - no pop up boxes or anything. Should I restart? (I am sending this from another computer)

I ran the Combofix in safe mode with network support so i could gain access to the internet. Was that wrong?

Here is the combofix log

ComboFix 08-10-06.01 - Sarah 2008-10-06 19:41:37.2 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.268 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Sarah\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-09-06 to 2008-10-06 )))))))))))))))))))))))))))))))
.

2008-10-06 17:12 . 2008-10-06 17:12 3,816 –a—— C:\WINDOWS\system32\tmp.reg
2008-10-06 15:45 . 2008-10-06 15:45 d——– C:\Program Files\Trend Micro
2008-10-06 14:06 . 2008-10-06 14:06 d——– C:\WINDOWS\ERUNT
2008-10-06 14:05 . 2008-10-06 14:29 d——– C:\SDFix
2008-10-06 10:36 . 2008-10-06 10:37 d——– C:\nss
2008-10-05 23:41 . 2008-06-23 17:57 6,066,176 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll
2008-10-05 23:41 . 2007-04-17 10:32 2,455,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-10-05 23:41 . 2007-03-08 06:10 991,232 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-10-05 23:41 . 2008-06-23 17:57 459,264 —–c— C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-10-05 23:41 . 2008-06-23 17:57 383,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-10-05 23:41 . 2008-06-23 17:57 267,776 —–c— C:\WINDOWS\system32\dllcache\iertutil.dll
2008-10-05 23:41 . 2008-06-23 17:57 63,488 —–c— C:\WINDOWS\system32\dllcache\icardie.dll
2008-10-05 23:41 . 2008-06-23 17:57 52,224 —–c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-10-05 23:41 . 2008-06-23 10:20 13,824 —–c— C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-10-05 20:27 . 2008-10-05 20:27 d——– C:\Program Files\Windows Sidebar
2008-10-05 20:26 . 2008-10-05 23:03 d——– C:\Program Files\Norton 360
2008-10-05 20:22 . 2008-10-05 20:30 123,952 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-10-05 20:22 . 2008-10-05 20:30 60,800 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2008-10-05 20:22 . 2008-10-05 20:30 10,563 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-10-05 20:22 . 2008-10-05 20:30 805 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-10-05 17:43 . 2008-10-05 17:43 d——– C:\Documents and Settings\All Users\Symantec Temporary Files
2008-10-05 17:11 . 2008-10-06 17:14 d——– C:\Program Files\VirusRL2009
2008-10-05 17:11 . 2008-10-06 17:28 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-06 18:11 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kontiki
2008-10-06 17:36 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-10-06 14:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-05 22:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-10-05 21:13 ——— d—–w C:\Documents and Settings\Sarah\Application Data\Symantec
2008-10-05 19:30 ——— d—–w C:\Program Files\Symantec
2008-08-30 00:30 ——— d—–w C:\Program Files\Oberon Media
2008-08-28 19:43 ——— d—–w C:\Documents and Settings\Sarah\Application Data\Sibelius Software
2008-07-18 21:10 94,920 —-a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 21:10 53,448 —-a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 21:10 45,768 —-a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 21:10 36,552 —-a-w C:\WINDOWS\system32\wups.dll
2008-07-18 21:09 563,912 —-a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 21:09 325,832 —-a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 21:09 205,000 —-a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 21:09 1,811,656 —-a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 21:07 270,880 —-a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 21:07 210,976 —-a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:32 253,952 —-a-w C:\WINDOWS\system32\es.dll
2007-07-03 20:30 525,624 -c–a-w C:\Documents and Settings\Sarah\WindowsXP-KB922120-v5-x86-ENU-lltd.exe
2006-03-07 15:04 32 -c–a-r C:\Documents and Settings\All Users\hash.dat
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

—- Directory of C:\nss —-

2008-07-18 02:57 45424 –a—— C:\nss\SKURes.dll
2008-02-28 21:59 592240 –a—— C:\nss\Nss.exe
2008-02-28 21:59 109424 –a—— C:\nss\ScanRes.dll
2008-02-28 21:55 913240 –a—— C:\nss\SAUpdt.dll
2008-02-28 21:55 626688 –a—— C:\nss\msvcr80.dll
2008-02-28 21:55 548864 –a—— C:\nss\msvcp80.dll
2008-02-28 21:55 26782 –a—— C:\nss\help.hta
2008-02-28 21:55 266584 –a—— C:\nss\ScanCore.dll
2008-02-28 21:55 1869 –a—— C:\nss\Microsoft.VC80.CRT.manifest
2008-02-28 21:54 632184 –a—— C:\nss\DefUtDCD.dll
2008-02-28 21:54 43176 –a—— C:\nss\ecmldr32.dll
2008-02-28 21:54 39808 –a—— C:\nss\patch25d.dll
2008-02-28 21:54 321152 –a—— C:\nss\msl.dll
2008-02-28 21:54 1291616 –a—— C:\nss\dec_abi.dll
2007-08-24 22:14 616808 –a—— C:\nss\ccL70U.dll
2007-08-24 22:07 369512 –a—— C:\nss\ccScanw.dll
2007-08-24 22:07 120680 –a—— C:\nss\ccVrTrst.dll

((((((((((((((((((((((((((((((((((((((( System Restore )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Symantec\COHLU.reg
2008-07-30 18:54 403 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208755.reg

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Updt716\setup.exe
2008-06-13 14:46 119176 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211055.exe

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Updt716\SymNet\Drivers\symdns.sys
2008-06-13 14:13 13616 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211056.sys

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Updt716\SymNet\Drivers\symfw.sys
2008-06-13 14:13 96432 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211057.sys

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Updt716\SymNet\Drivers\symids.sys
2008-06-13 14:13 38576 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211058.sys

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Updt716\SymNet\Drivers\SymIM.sys
2008-06-13 14:14 31280 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211060.sys

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Updt716\SymNet\Drivers\SymIMv.sys
2008-06-13 14:14 24112 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211063.sys

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Updt716\SymNet\Drivers\symndis.sys
2008-06-13 14:13 37424 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211066.sys

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Updt716\SymNet\Drivers\symndisv.sys
2008-06-13 14:13 41008 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211067.sys

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Updt716\SymNet\Drivers\symredrv.sys
2008-06-13 14:13 22320 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211070.sys

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Updt716\SymNet\Drivers\symtdi.sys
2008-06-13 14:13 184240 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211071.sys

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Updt716\SymNet\SNDSvc.dll
2008-06-13 14:45 226184 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211073.dll

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Updt716\SymNet\SNDunin.dll
2008-06-13 14:45 115080 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211074.dll

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Updt716\SymNet\SymNeti.dll
2008-06-13 14:45 579464 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211075.dll

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\Downloads\Updt716\SymNet\SymRedir.dll
2008-06-13 14:45 207240 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211076.dll

2008-09-29 06:09 1290584 C:\Documents and Settings\All Users\Application Data\Symantec\SyKnAppS\SyKnAppS.dll
2008-02-22 21:18 1314648 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208770.dll

C:\Documents and Settings\Sarah\Application Data\Mozilla\Firefox\Profiles\1aapah2q.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}-trash\components\googletoolbar.dll
2007-05-25 16:52 351232 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211121.dll

C:\Documents and Settings\Sarah\Application Data\Mozilla\Firefox\Profiles\1aapah2q.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}-trash\components\metrics.dll
2007-05-25 16:52 139264 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211122.dll

2008-10-05 17:43 525232 C:\Documents and Settings\Sarah\Desktop\setup.exe
2008-10-05 17:43 525232 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211293.exe

2002-03-13 07:57 24576 C:\Documents and Settings\Sarah\Local Settings\TempIadHide3.dll
2002-03-13 07:57 24576 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208743.dll
2002-03-13 07:57 24576 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211342.dll

C:\Program Files\Applications\iebr.dll
2008-10-05 17:11 15872 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211143.dll

C:\Program Files\Applications\iebt.dll
2008-10-05 17:11 8192 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208734.dll
2008-10-06 09:55 8192 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211144.dll

C:\Program Files\Applications\iebtm.exe
2008-10-05 17:11 18944 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211145.exe

C:\Program Files\Applications\iebtmm.exe
2008-10-05 17:11 5632 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208735.exe
2008-10-06 09:55 5632 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211146.exe

C:\Program Files\Applications\iebtu.exe
2008-10-05 17:11 6656 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211147.exe

C:\Program Files\Applications\iebu.exe
2008-10-05 17:11 5632 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211148.exe

C:\Program Files\Applications\wcm.exe
2008-10-05 17:11 5632 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208733.exe
2008-10-06 10:21 5632 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211155.exe

C:\Program Files\Applications\wcs.exe
2008-10-05 17:11 17920 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211156.exe

C:\Program Files\Applications\wcu.exe
2008-10-05 17:11 6656 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211157.exe

2007-08-13 18:54 765952 C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll
2007-06-26 16:13 851968 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210999.dll

2008-10-06 18:28 3091128 C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll
2008-08-31 21:38 3071622 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207790.dll
2008-10-06 16:09 3091128 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211349.dll

2008-07-30 17:42 649040 C:\Program Files\Common Files\Symantec Shared\COH\AHS.dll
2008-01-19 02:43 1131872 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208750.dll

2008-07-30 17:42 1227600 C:\Program Files\Common Files\Symantec Shared\COH\COH32.exe
2008-01-19 02:43 1250656 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208751.exe

2008-07-30 17:42 158544 C:\Program Files\Common Files\Symantec Shared\COH\COHClean.dll
2008-01-19 02:43 148832 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208749.dll

2008-07-30 17:42 283984 C:\Program Files\Common Files\Symantec Shared\COH\sesHlp.dll
2008-01-19 02:43 296288 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208752.dll
2008-01-19 02:43 296288 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208753.dll

C:\Program Files\Common Files\Symantec Shared\COH\sh0000.dll
2008-01-19 02:43 431456 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208754.dll

2008-06-30 13:44 148848 C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coCoreFW.dll
2008-02-24 03:08 148848 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208757.dll

2008-06-30 13:44 324976 C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coFFPlgn.dll
2008-02-24 03:08 324976 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208758.dll

2008-06-30 13:44 349552 C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
2008-02-24 03:08 349552 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208759.dll

2008-06-30 13:44 62320 C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coRegMon.dll
2008-02-24 03:08 62320 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208760.dll

2008-05-29 14:04 397688 C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\PackMgr.dll
2008-02-05 22:54 397688 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208761.dll

2008-06-30 13:44 1429360 C:\Program Files\Common Files\Symantec Shared\coShared\CIM\2.6\AcctMgr.dll
2008-02-24 03:08 1420656 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208762.dll

2008-06-30 13:44 494960 C:\Program Files\Common Files\Symantec Shared\coShared\CIM\2.6\IVPlugin.dll
2008-02-24 03:08 494960 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208763.dll

2008-06-30 13:44 1193408 C:\Program Files\Common Files\Symantec Shared\coShared\CIM\2.6\rf.dll
2008-02-24 03:08 1516992 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208764.dll

2008-06-30 13:44 521648 C:\Program Files\Common Files\Symantec Shared\coShared\CIM\2.6\rfpxy.dll
2008-02-24 03:08 509360 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208765.dll

2008-06-30 13:44 550256 C:\Program Files\Common Files\Symantec Shared\coShared\CIM\2.6\rfpxy3.dll
2008-02-24 03:08 542064 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208766.dll

2008-06-30 13:44 206192 C:\Program Files\Common Files\Symantec Shared\coShared\WP\2.6\coWCID.dll
2008-02-24 03:08 206192 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208767.dll

2008-05-29 14:40 628600 C:\Program Files\Common Files\Symantec Shared\coShared\WP\2.6\nppw.dll
2008-02-05 23:33 628600 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208768.dll

2008-05-29 15:01 689528 C:\Program Files\Common Files\Symantec Shared\coShared\WP\2.6\nppwff.dll
2008-02-05 23:54 689528 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208769.dll

2008-09-17 10:57 371248 C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
2008-09-17 09:00 371248 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211138.sys

C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI7.sys
2008-09-17 09:00 99376 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208724.sys

2008-09-26 19:00 368688 C:\Program Files\Common Files\Symantec Shared\SymcData\ipsdefs\BinHub\IDSvia64.sys
2008-02-14 01:18 359472 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208774.sys

2008-09-26 19:00 270384 C:\Program Files\Common Files\Symantec Shared\SymcData\ipsdefs\BinHub\IDSvix86.sys
2008-02-14 01:18 261680 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208777.sys

2008-09-26 19:00 685424 C:\Program Files\Common Files\Symantec Shared\SymcData\ipsdefs\BinHub\idsxpx86.dll
2008-02-14 01:18 685424 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208778.dll

2008-09-26 19:00 439664 C:\Program Files\Common Files\Symantec Shared\SymcData\ipsdefs\BinHub\scxpx86.dll
2008-02-14 09:03 439664 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208779.dll

2008-09-26 19:00 250224 C:\Program Files\Common Files\Symantec Shared\SymcData\ipsdefs\BinHub\symidsco.sys
2008-02-14 01:18 240496 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208780.sys

2008-09-26 19:00 173424 C:\Program Files\Common Files\Symantec Shared\SymcData\ipsdefs\BinHub\SymIDSI.dll
2008-02-14 01:18 173424 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208781.dll

C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080213.036\CCERASER.DLL
2008-02-13 10:00 2561072 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211080.DLL

C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080213.036\ECMSVR32.DLL
2008-02-13 10:00 284016 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211082.DLL

C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080213.036\EECTRL.SYS
2008-02-13 10:00 385072 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211083.SYS

C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080213.036\ERASER.SYS
2008-02-13 10:00 109616 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211085.SYS

C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080213.036\NAVENG.SYS
2008-02-13 10:00 82256 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211086.SYS

C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080213.036\NAVENG32.DLL
2008-02-13 10:00 128368 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211088.DLL

C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080213.036\NAVEX15.SYS
2008-02-13 10:00 895312 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211089.SYS

C:\Program Files\Common Files\Symantec Shared\VirusDefs\20080213.036\NAVEX32A.DLL
2008-02-13 10:00 943472 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211091.DLL

2007-08-13 18:18 60416 C:\Program Files\Internet Explorer\hmmapi.dll
2004-08-04 08:56 38912 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210996.dll

2007-08-13 18:44 69120 C:\Program Files\Internet Explorer\iedw.exe
2008-06-23 10:49 18432 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210997.exe

2008-06-23 10:20 625664 C:\Program Files\Internet Explorer\iexplore.exe
2004-08-04 08:56 93184 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210825.exe

2008-10-06 14:44 13952 C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll
2006-10-11 09:04 8320 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211216.dll

2008-06-30 13:44 324976 C:\Program Files\Mozilla Firefox\components\coFFPlgn.dll
2008-02-24 03:08 324976 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208728.dll
2008-06-30 13:44 324976 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP711\A0211387.dll

2008-10-06 14:44 67696 C:\Program Files\Mozilla Firefox\components\jar50.dll
2006-10-11 09:04 61036 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211225.dll

2008-10-06 14:44 54376 C:\Program Files\Mozilla Firefox\components\jsd3250.dll
2006-10-11 09:04 48742 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211226.dll

2008-10-06 14:44 34952 C:\Program Files\Mozilla Firefox\components\myspell.dll
2006-10-11 09:05 29313 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211227.dll

2008-10-06 14:44 46720 C:\Program Files\Mozilla Firefox\components\spellchk.dll
2006-10-11 09:05 41082 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211228.dll

2008-10-06 14:44 172144 C:\Program Files\Mozilla Firefox\components\xpinstal.dll
2006-10-11 09:04 166510 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211229.dll

2008-10-06 14:44 99840 C:\Program Files\Mozilla Firefox\extensions\[removed]\components\BrandRes.dll
2006-10-11 09:05 94208 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211231.dll

2008-10-06 14:44 156544 C:\Program Files\Mozilla Firefox\extensions\[removed]\components\fullsoft.dll
2006-10-11 09:05 150912 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211232.dll

2008-10-06 14:44 14456 C:\Program Files\Mozilla Firefox\extensions\[removed]\components\qfaservices.dll
2006-10-11 09:05 8820 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211234.dll

2008-10-06 14:44 407040 C:\Program Files\Mozilla Firefox\extensions\[removed]\components\talkback.exe
2006-10-11 09:05 401408 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211237.exe

2008-10-06 14:44 7666288 C:\Program Files\Mozilla Firefox\firefox.exe
2006-10-11 09:04 7604331 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211239.exe

2008-10-06 14:44 200829 C:\Program Files\Mozilla Firefox\freebl3.dll
2006-10-11 09:05 200829 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211240.dll

2008-10-06 14:44 458856 C:\Program Files\Mozilla Firefox\js3250.dll
2006-10-11 09:04 451685 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211241.dll

2008-10-06 14:44 161392 C:\Program Files\Mozilla Firefox\nspr4.dll
2006-10-11 09:04 155756 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211242.dll

2008-10-06 14:44 382568 C:\Program Files\Mozilla Firefox\nss3.dll
2006-10-11 09:05 372836 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211243.dll

2008-10-06 14:44 276080 C:\Program Files\Mozilla Firefox\nssckbi.dll
2006-10-11 09:05 254059 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211244.dll

2008-10-06 14:44 34424 C:\Program Files\Mozilla Firefox\plc4.dll
2006-10-11 09:04 28785 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211245.dll

2008-10-06 14:44 30320 C:\Program Files\Mozilla Firefox\plds4.dll
2006-10-11 09:04 24684 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211246.dll

2008-10-06 14:44 22664 C:\Program Files\Mozilla Firefox\plugins\npnul32.dll
2006-10-11 09:04 17030 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211247.dll

2008-10-06 14:44 112232 C:\Program Files\Mozilla Firefox\smime3.dll
2006-10-11 09:05 106600 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211270.dll

2008-10-06 14:44 254060 C:\Program Files\Mozilla Firefox\softokn3.dll
2006-10-11 09:05 254060 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211271.dll

2008-10-06 14:44 136808 C:\Program Files\Mozilla Firefox\ssl3.dll
2006-10-11 09:05 122980 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211272.dll

C:\Program Files\Mozilla Firefox\uninstall\uninst.exe
2006-10-11 09:05 331678 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211280.exe

2008-10-06 14:44 132232 C:\Program Files\Mozilla Firefox\updater.exe
2006-10-11 09:05 123522 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211273.exe

2008-10-06 14:44 13416 C:\Program Files\Mozilla Firefox\xpcom.dll
2006-10-11 09:04 7784 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211275.dll

2008-10-06 14:44 73848 C:\Program Files\Mozilla Firefox\xpcom_compat.dll
2006-10-11 09:04 68211 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211276.dll

2008-10-06 14:44 422000 C:\Program Files\Mozilla Firefox\xpcom_core.dll
2006-10-11 09:04 415342 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211277.dll

2008-10-06 14:44 73336 C:\Program Files\Mozilla Firefox\xpicleanup.exe
2006-10-11 09:04 67700 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211278.exe

2008-10-06 14:44 12400 C:\Program Files\Mozilla Firefox\xpistub.dll
2006-10-11 09:04 6766 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211279.dll

2008-02-21 23:02 152952 C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
2006-09-03 01:36 100032 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207751.EXE

C:\Program Files\Symantec\LiveUpdate\ALUNOTIFYRES.DLL
2006-09-03 01:36 54976 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207752.DLL

2008-02-21 23:02 238968 C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
2006-09-03 01:36 198336 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207753.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvcRes.dll
2006-09-03 01:36 12992 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207754.dll

2008-02-21 23:02 308600 C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
2006-09-03 01:36 243392 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207755.EXE

C:\Program Files\Symantec\LiveUpdate\AUPDATERES.DLL
2006-09-03 01:36 8896 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207756.DLL

2008-02-21 23:03 181624 C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE
2006-09-03 01:36 186048 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207757.EXE

2008-09-05 11:52 873848 C:\Program Files\Symantec\LiveUpdate\LUALL.EXE
2006-09-03 01:36 1287872 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207758.EXE

C:\Program Files\Symantec\LiveUpdate\LUALLRES.DLL
2006-09-03 01:36 759488 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207759.DLL

2008-02-21 23:02 62840 C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
2006-09-03 01:36 128704 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207760.exe

C:\Program Files\Symantec\LiveUpdate\LuComServer_3_1.EXE
2006-09-03 01:36 2528960 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207761.EXE

C:\Program Files\Symantec\LiveUpdate\LUInit.exe
2006-09-03 01:36 83648 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207763.exe

2008-02-21 23:03 10104 C:\Program Files\Symantec\LiveUpdate\LUinsDll.dll
2006-09-03 01:36 648896 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207765.DLL

C:\Program Files\Symantec\LiveUpdate\LuInsRes.dll
2006-09-03 01:36 23232 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207766.dll

2008-02-21 23:02 173432 C:\Program Files\Symantec\LiveUpdate\LuPreCon.DLL
2006-09-03 01:36 194240 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207767.DLL

C:\Program Files\Symantec\LiveUpdate\ResLuComServer_3_1.DLL
2006-09-03 01:36 63168 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207768.DLL

2008-02-21 23:02 456056 C:\Program Files\Symantec\LiveUpdate\S32LIVE1.DLL
2006-09-03 01:36 337600 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207769.DLL

C:\Program Files\Symantec\LiveUpdate\S32LUCP1RES.DLL
2006-09-03 01:36 8384 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207770.DLL

2008-02-21 23:03 157048 C:\Program Files\Symantec\LiveUpdate\S32LUIS1.DLL
2006-09-03 01:36 149184 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207772.DLL

2008-02-21 23:03 152952 C:\Program Files\Symantec\LiveUpdate\S32LUWI1.DLL
2006-09-03 01:36 149184 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207773.DLL

C:\Program Files\Symantec\LiveUpdate\SETUPRES.DLL
2006-09-03 01:36 10432 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207774.DLL

C:\Program Files\Symantec\LiveUpdate\SymantecRootInstaller.exe
2006-09-03 01:36 75456 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207775.exe

C:\Program Files\Symantec\LiveUpdate\SymantecRootInstallerRes.dll
2006-09-03 01:36 11456 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207776.dll

2008-02-21 22:46 169304 C:\Program Files\Symantec\LiveUpdate\UNRAR.DLL
2006-09-03 01:36 159744 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207777.DLL

C:\Program Files\VirusRL2009\AVLWarning.dll
2008-09-26 13:06 73728 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211327.dll

C:\Program Files\VirusRL2009\uninst.exe
2008-10-05 17:11 37744 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210798.exe

C:\SDFix\apps\CSweg.exe
2008-08-07 16:27 278016 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211207.exe

C:\SDFix\attrib.exe
2003-03-31 13:00 11264 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211205.exe

C:\SDFix\backupreg\AppInit_DLLs.reg
2008-10-06 14:07 624 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211175.reg

C:\SDFix\backupreg\bat_shell_open.reg
2008-10-06 14:07 204 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211176.reg

C:\SDFix\backupreg\BHO.reg
2008-10-06 14:07 3704 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211177.reg

C:\SDFix\backupreg\com_shell_open.reg
2008-10-06 14:07 204 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211178.reg

C:\SDFix\backupreg\ControlPanel_Load.reg
2008-10-06 14:07 30708 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211179.reg

C:\SDFix\backupreg\Drivers32.reg
2008-10-06 14:07 3018 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211180.reg

C:\SDFix\backupreg\exe_shell_open.reg
2008-10-06 14:07 204 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211181.reg

C:\SDFix\backupreg\HKCU_SOFTWARE_Policy.reg
2008-10-06 14:07 3118 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211184.reg

C:\SDFix\backupreg\HKCU_WINDOWS_Policy.reg
2008-10-06 14:07 462 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211185.reg

C:\SDFix\backupreg\HKCURun.reg
2008-10-06 14:07 1270 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211182.reg

C:\SDFix\backupreg\HKCURunServices.reg
2008-10-06 14:07 74 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211183.reg

C:\SDFix\backupreg\HKLM_SOFTWARE_Policy.reg
2008-10-06 14:07 117430 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211188.reg

C:\SDFix\backupreg\HKLM_WINDOWS_Policy.reg
2008-10-06 14:07 2022 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211189.reg

C:\SDFix\backupreg\HKLMRun.reg
2008-10-06 14:07 3828 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211186.reg

C:\SDFix\backupreg\HKLMRunServices.reg
2008-10-06 14:07 74 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211187.reg

C:\SDFix\backupreg\IEDesktop.reg
2008-10-06 14:07 7036 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211190.reg

C:\SDFix\backupreg\IEMain.reg
2008-10-06 14:07 5558 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211191.reg

C:\SDFix\backupreg\Installed_Components.reg
2008-10-06 14:07 31508 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211192.reg

C:\SDFix\backupreg\pif_shell_open.reg
2008-10-06 14:07 204 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211193.reg

C:\SDFix\backupreg\reg_shell_open.reg
2008-10-06 14:07 222 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211194.reg

C:\SDFix\backupreg\SecurityProviders.reg
2008-10-06 14:07 8002 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211195.reg

C:\SDFix\backupreg\SharedTaskScheduler.reg
2008-10-06 14:07 546 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211196.reg

C:\SDFix\backupreg\ShellServiceObjectDelayLoad.reg
2008-10-06 14:07 928 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211197.reg

C:\SDFix\backupreg\SubSystems.reg
2008-10-06 14:07 5282 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211198.reg

C:\SDFix\backupreg\txt_shell_open.reg
2008-10-06 14:07 668 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211199.reg

C:\SDFix\backupreg\Winlogon.reg
2008-10-06 14:07 23094 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211200.reg

C:\SDFix\backupreg\WinlogonNotify.reg
2008-10-06 14:07 12296 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211201.reg

C:\SDFix\backups\iebr.dll
2008-10-05 17:11 15872 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211160.dll

C:\SDFix\backups\iebt.dll
2008-10-06 09:55 8192 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211161.dll

C:\SDFix\backups\iebtm.exe
2008-10-05 17:11 18944 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211162.exe

C:\SDFix\backups\iebtmm.exe
2008-10-06 09:55 5632 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211163.exe

C:\SDFix\backups\iebtu.exe
2008-10-05 17:11 6656 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211164.exe

C:\SDFix\backups\iebu.exe
2008-10-05 17:11 5632 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211165.exe

C:\SDFix\backups\wcm.exe
2008-10-06 10:21 5632 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211172.exe

C:\SDFix\backups\wcs.exe
2008-10-05 17:11 17920 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211173.exe

C:\SDFix\backups\wcu.exe
2008-10-05 17:11 6656 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211174.exe

C:\SDFix\dnif.exe
2003-03-31 13:00 9216 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211203.exe

C:\SDFix\dummy.exe
2008-08-07 16:27 6656 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211202.exe

C:\SDFix\editreg.exe
2004-08-04 08:56 146432 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211206.exe

C:\SDFix\rtsdnif.exe
2004-08-04 08:56 27136 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211204.exe

C:\SDFix\userinfix.reg
2008-10-06 14:12 169 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211208.reg

C:\WINDOWS\_000002_.tmp.dll
2006-06-28 18:00 8420 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210799.dll
2006-06-29 08:11 10181 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210800.dll

C:\WINDOWS\_000003_.tmp.dll
2006-07-14 16:55 10337 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210797.dll

C:\WINDOWS\_000004_.tmp.dll
2006-03-24 06:11 10337 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210791.dll
2006-10-11 07:28 9200 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210794.dll

C:\WINDOWS\_000057_.tmp.dll
2008-06-26 19:16 32215 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210804.dll

C:\WINDOWS\_000893_.tmp.dll
2007-08-13 18:54 44978 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210801.dll

C:\WINDOWS\inf\_000000_.tmp.dll
2008-04-15 19:01 871 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210790.dll
2006-07-14 16:52 705 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210803.dll

C:\WINDOWS\LastGood.Tmp\system32\DRIVERS\SymIM.sys
2008-02-06 22:43 31408 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211033.sys

C:\WINDOWS\system32\590075\590075.dll
2008-10-05 17:11 15360 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211328.dll

2007-08-13 18:39 71680 C:\WINDOWS\system32\admparse.dll
2004-08-04 08:56 61440 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211000.dll

2008-06-23 17:57 124928 C:\WINDOWS\system32\advpack.dll
2004-08-04 08:56 99840 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210824.dll
2004-08-04 08:56 99840 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211001.dll

C:\WINDOWS\system32\algg.exe
2008-10-05 17:11 20480 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211326.exe

2007-08-13 18:39 71680 C:\WINDOWS\system32\dllcache\admparse.dll
2004-08-04 08:56 61440 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210986.dll

2007-08-13 18:54 33792 C:\WINDOWS\system32\dllcache\custsat.dll
2004-09-22 19:45 28672 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210985.dll

2008-06-23 17:57 347136 C:\WINDOWS\system32\dllcache\dxtmsft.dll
2008-06-23 16:38 357888 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210841.dll

2008-06-23 17:57 214528 C:\WINDOWS\system32\dllcache\dxtrans.dll
2008-06-23 16:38 205312 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210840.dll

2008-06-23 17:57 133120 C:\WINDOWS\system32\dllcache\extmgr.dll
2008-06-23 16:38 55808 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210839.dll

2008-06-23 17:57 153088 C:\WINDOWS\system32\dllcache\ieakeng.dll
2004-08-04 08:56 139264 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210838.dll

2008-06-23 17:57 230400 C:\WINDOWS\system32\dllcache\ieaksie.dll
2004-08-04 08:56 216576 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210837.dll

2008-06-21 06:23 161792 C:\WINDOWS\system32\dllcache\ieakui.dll
2003-03-31 13:00 221184 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210836.dll

2007-08-13 18:44 69120 C:\WINDOWS\system32\dllcache\iedw.exe
2008-06-23 10:49 18432 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210987.exe

2007-08-13 18:54 191488 C:\WINDOWS\system32\dllcache\iepeers.dll
2008-06-23 16:38 251392 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210988.dll

2008-06-23 17:57 44544 C:\WINDOWS\system32\dllcache\iernonce.dll
2004-08-04 08:56 48640 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210835.dll

2007-08-13 18:39 55296 C:\WINDOWS\system32\dllcache\iesetup.dll
2004-08-04 08:56 62976 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210989.dll

2007-08-13 18:39 92672 C:\WINDOWS\system32\dllcache\inseng.dll
2008-06-23 16:38 96256 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210990.dll

2007-08-13 18:38 491520 C:\WINDOWS\system32\dllcache\jscript.dll
2007-12-18 15:40 450560 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210991.dll

2008-06-23 17:57 27648 C:\WINDOWS\system32\dllcache\jsproxy.dll
2008-06-23 16:38 16384 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210834.dll

2007-08-13 18:44 40960 C:\WINDOWS\system32\dllcache\licmgr10.dll
2004-08-04 08:56 22016 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210992.dll

2008-06-24 10:57 3592192 C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 16:38 3059712 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210833.dll

2008-06-23 17:57 477696 C:\WINDOWS\system32\dllcache\mshtmled.dll
2008-06-23 16:38 449024 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210832.dll

2008-06-23 17:57 193024 C:\WINDOWS\system32\dllcache\msrating.dll
2008-06-23 16:38 146432 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210831.dll

2008-06-23 17:57 671232 C:\WINDOWS\system32\dllcache\mstime.dll
2008-06-23 16:38 532480 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210830.dll

2008-06-23 17:57 44544 C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-06-23 16:38 39424 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210829.dll

2008-06-23 17:57 1159680 C:\WINDOWS\system32\dllcache\urlmon.dll
2008-06-23 16:38 615936 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210828.dll

2007-08-13 18:54 413696 C:\WINDOWS\system32\dllcache\vbscript.dll
2007-12-18 15:40 417792 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210994.dll

2007-08-13 18:54 765952 C:\WINDOWS\system32\dllcache\VGX.dll
2007-06-26 16:13 851968 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210995.dll

2008-06-23 17:57 826368 C:\WINDOWS\system32\dllcache\wininet.dll
2008-06-23 16:38 659456 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210827.dll

2008-07-30 17:42 23888 C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-01-13 03:32 23904 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0208746.sys

C:\WINDOWS\system32\drivers\PROCEXP90.SYS
2008-10-06 18:38 6736 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP711\A0211443.SYS

C:\WINDOWS\system32\drivers\SymIM.sys
2008-02-06 22:43 31408 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210843.sys

2008-06-23 17:57 347136 C:\WINDOWS\system32\dxtmsft.dll
2008-06-23 16:38 357888 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210823.dll

2008-06-23 17:57 214528 C:\WINDOWS\system32\dxtrans.dll
2008-06-23 16:38 205312 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210822.dll

2008-06-23 17:57 133120 C:\WINDOWS\system32\extmgr.dll
2008-06-23 16:38 55808 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210826.dll

2008-06-23 17:57 63488 C:\WINDOWS\system32\icardie.dll
2007-08-13 18:36 61952 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211026.dll

2008-06-23 10:20 70656 C:\WINDOWS\system32\ie4uinit.exe
2004-08-04 08:56 34304 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210821.exe

2008-06-23 17:57 153088 C:\WINDOWS\system32\ieakeng.dll
2004-08-04 08:56 139264 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210820.dll

2008-06-23 17:57 230400 C:\WINDOWS\system32\ieaksie.dll
2004-08-04 08:56 216576 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210819.dll

2008-06-21 06:23 161792 C:\WINDOWS\system32\ieakui.dll
2003-03-31 13:00 221184 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210818.dll

2008-06-23 17:57 383488 C:\WINDOWS\system32\ieapfltr.dll
2007-07-11 12:27 383488 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211025.dll

2008-06-23 17:57 384512 C:\WINDOWS\system32\iedkcs32.dll
2004-08-04 08:56 323584 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210817.dll

2007-08-13 18:45 78336 C:\WINDOWS\system32\ieencode.dll
2004-08-04 08:56 81920 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211002.dll

2008-06-23 17:57 6066176 C:\WINDOWS\system32\ieframe.dll
2007-08-13 18:54 6049280 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211024.dll

2007-08-13 18:54 191488 C:\WINDOWS\system32\iepeers.dll
2008-06-23 16:38 251392 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211003.dll

2008-06-23 17:57 44544 C:\WINDOWS\system32\iernonce.dll
2004-08-04 08:56 48640 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210816.dll

2008-06-23 17:57 267776 C:\WINDOWS\system32\iertutil.dll
2007-08-13 18:34 266752 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211023.dll

2007-08-13 18:39 55296 C:\WINDOWS\system32\iesetup.dll
2004-08-04 08:56 62976 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211004.dll

2007-08-13 18:36 36352 C:\WINDOWS\system32\imgutil.dll
2004-08-04 08:56 35840 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211006.dll

2007-08-13 18:39 92672 C:\WINDOWS\system32\inseng.dll
2008-06-23 16:38 96256 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211007.dll

2007-08-13 18:38 491520 C:\WINDOWS\system32\jscript.dll
2007-12-18 15:40 450560 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211008.dll

2008-06-23 17:57 27648 C:\WINDOWS\system32\jsproxy.dll
2008-06-23 16:38 16384 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210814.dll

2007-08-13 18:44 40960 C:\WINDOWS\system32\licmgr10.dll
2004-08-04 08:56 22016 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211009.dll

2008-08-26 13:28 16208504 C:\WINDOWS\system32\MRT.exe
2008-05-30 00:35 17486968 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210795.exe

2008-06-23 17:57 459264 C:\WINDOWS\system32\msfeeds.dll
2007-08-13 18:54 458752 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211022.dll

2008-06-23 17:57 52224 C:\WINDOWS\system32\msfeedsbs.dll
2007-08-13 18:54 50688 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211021.dll

2007-08-13 18:32 45568 C:\WINDOWS\system32\mshta.exe
2004-08-04 08:56 29184 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211010.exe

2008-06-24 10:57 3592192 C:\WINDOWS\system32\mshtml.dll
2008-06-23 16:38 3059712 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211011.dll

2008-06-23 17:57 477696 C:\WINDOWS\system32\mshtmled.dll
2008-06-23 16:38 449024 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210813.dll

2007-08-13 18:01 48128 C:\WINDOWS\system32\mshtmler.dll
2004-08-04 08:56 56832 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211013.dll

2007-08-13 18:54 156160 C:\WINDOWS\system32\msls31.dll
2003-03-31 13:00 146432 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211014.dll

2008-06-23 17:57 193024 C:\WINDOWS\system32\msrating.dll
2008-06-23 16:38 146432 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210812.dll

2008-06-23 17:57 671232 C:\WINDOWS\system32\mstime.dll
2008-06-23 16:38 532480 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210811.dll

C:\WINDOWS\system32\oanlvs.dll
2008-10-05 14:07 15360 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP709\A0207791.dll

2008-06-23 17:57 102912 C:\WINDOWS\system32\occache.dll
2004-08-04 08:56 96256 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210810.dll

2008-06-23 17:57 44544 C:\WINDOWS\system32\pngfilt.dll
2008-06-23 16:38 39424 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210809.dll

2008-06-23 17:57 105984 C:\WINDOWS\system32\url.dll
2004-08-04 08:56 37888 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210808.dll
2004-08-04 08:56 37888 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211016.dll

2008-06-23 17:57 1159680 C:\WINDOWS\system32\urlmon.dll
2008-06-23 16:38 615936 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210807.dll
2008-06-23 16:38 615936 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211017.dll

2007-08-13 18:54 413696 C:\WINDOWS\system32\vbscript.dll
2007-12-18 15:40 417792 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211018.dll

2006-03-24 05:37 49152 C:\WINDOWS\system32\wdigest.dll
2004-08-04 08:56 49152 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210792.dll
2004-08-04 08:56 49152 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210984.dll

2008-06-23 17:57 233472 C:\WINDOWS\system32\webcheck.dll
2004-08-04 08:56 276480 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210806.dll
2004-08-04 08:56 276480 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211019.dll

2008-06-23 17:57 826368 C:\WINDOWS\system32\wininet.dll
2008-06-23 16:38 659456 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0210805.dll
2008-06-23 16:38 659456 {AA44CE33-7010-4C68-B56B-9B9DED47BBBC}\RP710\A0211020.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
2008-02-26 09:34 576352 –a—— C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
2008-02-26 09:34 576352 –a—— C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
2008-02-26 09:34 576352 –a—— C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2003-09-05 65536]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2004-11-24 880640]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-06 68856]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 1032640]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"VirusRL2009"="C:\Program Files\VirusRL2009\VirusRL2009.exe" [2008-09-27 1810432]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-10-28 335872]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2003-06-18 151552]
"CeEPOWER"="C:\Program Files\TOSHIBA\Power Management\CePMTray.exe" [2003-11-03 135168]
"CPLDFL10"="C:\PROGRA~1\EzButton\CPLDFL10.EXE" [2003-11-19 294912]
"CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [2003-11-05 638976]
"TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [2003-04-28 49152]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 196608]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-04-13 69632]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-08 77824]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe" [2004-11-25 143360]
"DataLayer"="C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE" [2004-12-09 1068032]
"AS00_Gear511"="C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe" [2006-10-13 1130496]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"4oD"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 1032640]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-02 185896]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-18 51048]
"osCheck"="C:\Program Files\Norton 360\osCheck.exe" [2008-02-26 988512]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 C:\WINDOWS\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2003-11-19 C:\WINDOWS\agrsmmsg.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Symantec NetDriver Warning"="C:\PROGRA~1\SYMNET~1\SNDWarn.exe" [2004-10-29 218232]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2003-08-25 614536]
KODAK Software Updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2003-06-08 16432]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
Photo Loader supervisory.lnk - C:\Program Files\CASIO\Photo Loader\Plauto.exe [2004-07-27 217088]
Watch.lnk - C:\WINDOWS\twain_32\S6U12BX\WATCH.exe [2007-02-03 356352]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\VirusRL2009\\VirusRL2009.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13364:UDP"= 13364:UDP:Print Server Utility
"13107:UDP"= 13107:UDP:Print Server Utility
"69:UDP"= 69:UDP:Print Server Utility

R3 NETGEAR_WG511_SERVICE;NETGEAR WG511T Wireless Adapter Service;C:\WINDOWS\system32\DRIVERS\wg511nd5.sys [2006-03-23 488992]
S2 DPortIO;Dritek Port I/O Driver;C:\WINDOWS\system32\Drivers\DPortIO.sys [2001-04-12 3674]
S2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-18 149352]
S3 AWINDIS5;AWINDIS5 Protocol Driver;C:\WINDOWS\system32\AWINDIS5.SYS [2006-02-25 16194]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 23888]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;C:\WINDOWS\system32\drivers\usbscan.sys [2004-08-04 15104]

*Newly Created Service* - COMHOST
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-06 19:46:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2008-10-06 19:51:57
ComboFix-quarantined-files.txt 2008-10-06 18:50:54
ComboFix2.txt 2008-10-06 17:55:36

Pre-Run: 2,046,496,768 bytes free
Post-Run: 2,032,472,064 bytes free

686 — E O F — 2008-10-05 22:49:16

Rorschach112

Post #8October 6, 2008, 7:28 PM UTC

Do these in normal mode if possible

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\Documents and Settings\Sarah\Desktop\setup.exe

Folder::
C:\Program Files\VirusRL2009

Registry::

Driver::

Save this as CFScript.txt, in the same location as ComboFix.exe

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Make sure to use Internet Explorer for this
Please go to VirSCAN.org FREE on-line scan service
Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:
- C:\WINDOWS\system32\wininet.dll
Click on the Upload button
Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
Paste the contents of the Clipboard in your next reply.

OfficialDom

Post #9October 6, 2008, 9:48 PM UTC

OK here is the Combo Fix log

ComboFix 08-10-06.03 - Sarah 2008-10-06 22:15:22.5 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Sarah\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\Sarah\Desktop\setup.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
C:\Documents and Settings\Sarah\Desktop\setup.exe
C:\Program Files\VirusRL2009
C:\Program Files\VirusRL2009\VirusRL2009.exe

.
((((((((((((((((((((((((( Files Created from 2008-09-06 to 2008-10-06 )))))))))))))))))))))))))))))))
.

2008-10-06 17:12 . 2008-10-06 17:12 3,816 –a—— C:\WINDOWS\system32\tmp.reg
2008-10-06 15:45 . 2008-10-06 15:45 d——– C:\Program Files\Trend Micro
2008-10-06 14:06 . 2008-10-06 14:06 d——– C:\WINDOWS\ERUNT
2008-10-06 14:05 . 2008-10-06 14:29 d——– C:\SDFix
2008-10-06 10:36 . 2008-10-06 10:37 d——– C:\nss
2008-10-05 23:41 . 2008-06-23 17:57 6,066,176 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll
2008-10-05 23:41 . 2007-04-17 10:32 2,455,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-10-05 23:41 . 2007-03-08 06:10 991,232 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-10-05 23:41 . 2008-06-23 17:57 459,264 —–c— C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-10-05 23:41 . 2008-06-23 17:57 383,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-10-05 23:41 . 2008-06-23 17:57 267,776 —–c— C:\WINDOWS\system32\dllcache\iertutil.dll
2008-10-05 23:41 . 2008-06-23 17:57 63,488 —–c— C:\WINDOWS\system32\dllcache\icardie.dll
2008-10-05 23:41 . 2008-06-23 17:57 52,224 —–c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-10-05 23:41 . 2008-06-23 10:20 13,824 —–c— C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-10-05 20:27 . 2008-10-05 20:27 d——– C:\Program Files\Windows Sidebar
2008-10-05 20:26 . 2008-10-05 23:03 d——– C:\Program Files\Norton 360
2008-10-05 20:22 . 2008-10-05 20:30 123,952 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-10-05 20:22 . 2008-10-05 20:30 60,800 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2008-10-05 20:22 . 2008-10-05 20:30 10,563 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-10-05 20:22 . 2008-10-05 20:30 805 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-10-05 17:43 . 2008-10-05 17:43 d——– C:\Documents and Settings\All Users\Symantec Temporary Files
2008-10-05 17:11 . 2008-10-06 20:43 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-06 21:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kontiki
2008-10-06 20:30 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-10-06 14:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-05 22:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-10-05 21:13 ——— d—–w C:\Documents and Settings\Sarah\Application Data\Symantec
2008-10-05 19:30 ——— d—–w C:\Program Files\Symantec
2008-08-30 00:30 ——— d—–w C:\Program Files\Oberon Media
2008-08-28 19:43 ——— d—–w C:\Documents and Settings\Sarah\Application Data\Sibelius Software
2008-07-18 21:10 94,920 —-a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 21:10 53,448 —-a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 21:10 45,768 —-a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 21:10 36,552 —-a-w C:\WINDOWS\system32\wups.dll
2008-07-18 21:09 563,912 —-a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 21:09 325,832 —-a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 21:09 205,000 —-a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 21:09 1,811,656 —-a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 21:07 270,880 —-a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 21:07 210,976 —-a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:32 253,952 —-a-w C:\WINDOWS\system32\es.dll
2007-07-03 20:30 525,624 -c–a-w C:\Documents and Settings\Sarah\WindowsXP-KB922120-v5-x86-ENU-lltd.exe
2006-03-07 15:04 32 -c–a-r C:\Documents and Settings\All Users\hash.dat
.

((((((((((((((((((((((((((((( snapshot@2008-10-06_18.53.06.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-03-06 01:22:41 213,216 -c—-w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c—-w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\updspapi.dll
+ 2007-08-13 17:54:10 765,952 -c—-w C:\WINDOWS\ie7updates\KB938127-IE7\vgx.dll
+ 2007-03-06 01:22:39 213,216 -c—-w C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:47 371,424 -c—-w C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\updspapi.dll
+ 2007-07-12 23:31:54 765,952 -c—-w C:\WINDOWS\ie7updates\KB938127-v2-IE7\vgx.dll
+ 2008-02-26 11:59:50 294,912 -c—-w C:\WINDOWS\system32\dllcache\msctf.dll
- 2007-08-13 17:54:10 765,952 -c–a-w C:\WINDOWS\system32\dllcache\VGX.dll
+ 2008-05-27 17:23:58 765,952 -c–a-w C:\WINDOWS\system32\dllcache\vgx.dll
- 2004-08-04 07:56:42 294,400 —-a-w C:\WINDOWS\system32\msctf.dll
+ 2008-02-26 11:59:50 294,912 —-a-w C:\WINDOWS\system32\msctf.dll
+ 2008-10-06 20:21:50 16,384 —-atw C:\WINDOWS\temp\Perflib_Perfdata_1e0.dat
+ 2008-10-06 20:21:36 16,384 —-atw C:\WINDOWS\temp\Perflib_Perfdata_614.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
2008-02-26 09:34 576352 –a—— C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
2008-02-26 09:34 576352 –a—— C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
2008-02-26 09:34 576352 –a—— C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2003-09-05 65536]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2004-11-24 880640]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-06 68856]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 1032640]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"VirusRL2009"="C:\Program Files\VirusRL2009\VirusRL2009.exe" [BU]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-10-28 335872]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2003-06-18 151552]
"CeEPOWER"="C:\Program Files\TOSHIBA\Power Management\CePMTray.exe" [2003-11-03 135168]
"CPLDFL10"="C:\PROGRA~1\EzButton\CPLDFL10.EXE" [2003-11-19 294912]
"CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [2003-11-05 638976]
"TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [2003-04-28 49152]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 196608]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-04-13 69632]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-08 77824]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe" [2004-11-25 143360]
"DataLayer"="C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE" [2004-12-09 1068032]
"AS00_Gear511"="C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe" [2006-10-13 1130496]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"4oD"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 1032640]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-02 185896]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-18 51048]
"osCheck"="C:\Program Files\Norton 360\osCheck.exe" [2008-02-26 988512]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 C:\WINDOWS\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2003-11-19 C:\WINDOWS\agrsmmsg.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Symantec NetDriver Warning"="C:\PROGRA~1\SYMNET~1\SNDWarn.exe" [2004-10-29 218232]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2003-08-25 614536]
KODAK Software Updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2003-06-08 16432]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
Photo Loader supervisory.lnk - C:\Program Files\CASIO\Photo Loader\Plauto.exe [2004-07-27 217088]
Watch.lnk - C:\WINDOWS\twain_32\S6U12BX\WATCH.exe [2007-02-03 356352]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13364:UDP"= 13364:UDP:Print Server Utility
"13107:UDP"= 13107:UDP:Print Server Utility
"69:UDP"= 69:UDP:Print Server Utility

R2 DPortIO;Dritek Port I/O Driver;C:\WINDOWS\system32\Drivers\DPortIO.sys [2001-04-12 3674]
R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-18 149352]
R3 AWINDIS5;AWINDIS5 Protocol Driver;C:\WINDOWS\system32\AWINDIS5.SYS [2006-02-25 16194]
R3 NETGEAR_WG511_SERVICE;NETGEAR WG511T Wireless Adapter Service;C:\WINDOWS\system32\DRIVERS\wg511nd5.sys [2006-03-23 488992]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 23888]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;C:\WINDOWS\system32\drivers\usbscan.sys [2004-08-04 15104]

*Newly Created Service* - COMHOST
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-06 22:20:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2008-10-06 22:26:50
ComboFix-quarantined-files.txt 2008-10-06 21:25:24
ComboFix2.txt 2008-10-06 18:51:59
ComboFix3.txt 2008-10-06 17:55:36

Pre-Run: 1,392,857,088 bytes free
Post-Run: 1,370,157,056 bytes free

181 — E O F — 2008-10-06 19:52:48

and here is the virscan.org report

VirSCAN.org Scanned Report :
Scanned time : 2008/10/06 22:41:28 (BST)
Scanner results: All Scanners reported not find malware!
File Name : wininet.dll
File Size : 826368 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : 8c13d4a7479fa0a026eda8abce82c0ed
SHA1 : 4d75f0c62498f819b1141611770e182b23bf796d
Online report : http://virscan.org/report/59bbb4c21cc6b936…d51eea1dd5.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.0.0.16 2008.10.05 2008-10-05 1.47 -
AhnLab V3 2008.10.07.00 2008.10.07 2008-10-07 0.91 -
AntiVir 7.8.1.34 7.0.7.1 2008-10-06 2.35 -
Arcavir 1.0.5 200810061612 2008-10-06 1.22 -
Authentium 5.1.1 200810012118 2008-10-01 1.03 -
AVAST! 3.0.1 081006-0 2008-10-06 0.73 -
AVG 7.5.52.442 270.7.6/1711 2008-10-06 1.64 -
BitDefender 7.60825.1839875 7.21184 2008-10-06 3.12 -
CA (VET) 9.0.0.143 31.6.6131 2008-10-06 5.17 -
ClamAV 0.94 8379 2008-10-07 0.19 -
Comodo 2.11 2.0.0.668 2008-10-06 0.45 -
CP Secure 1.1.0.715 2008.10.07 2008-10-07 6.09 -
Dr.Web 4.44.0.9170 2008.10.06 2008-10-06 3.28 -
ewido 4.0.0.2 2008.10.06 2008-10-06 3.15 -
F-Prot 4.4.4.56 20081006 2008-10-06 1.02 -
F-Secure 5.51.6100 2008.10.06.06 2008-10-06 3.53 -
Fortinet 2.81-3.113 9.619 2008-10-06 0.20 -
ViRobot 20081006 2008.10.06 2008-10-06 0.41 -
Ikarus T3.1.01.34 2008.10.06.71590 2008-10-06 3.49 -
JiangMin 11.0.706 2008.10.06 2008-10-06 1.22 -
Kaspersky 5.5.10 2008.10.06 2008-10-06 0.06 -
KingSoft 2008.9.8.18 2008.10.6.17 2008-10-06 0.70 -
McAfee 5.3.00 5398 2008-10-03 2.03 -
Microsoft 1.4005 2008.10.06 2008-10-06 3.84 -
mks_vir 2.01 2008.10.07 2008-10-07 2.36 -
Norman 5.93.01 5.93.00 2008-10-05 5.08 -
Panda 9.05.01 2008.10.06 2008-10-06 2.27 -
Trend Micro 8.700-1004 5.580.06 2008-10-06 0.03 -
Quick Heal 9.50 2008.10.06 2008-10-06 2.01 -
Rising 20.0 20.64.50.00 2008-10-04 0.80 -
Sophos 2.79.0 4.34 2008-10-07 1.74 -
Sunbelt 3.1.1706.1 2285 2008-10-06 0.44 -
Symantec 1.3.0.24 20081006.006 2008-10-06 0.07 -
nProtect 2008-10-06.00 1501742 2008-10-06 3.48 -
The Hacker [removed] v00102 2008-10-06 0.45 -
VBA32 3.12.8.6 20081005.1035 2008-10-05 1.45 -
VirusBuster 4.5.11.10 10.89.9/633969 2008-10-06 1.35 -

There was no sign of the virus at the last reboot which was great!

Rorschach112

Post #10October 6, 2008, 10:10 PM UTC

Hello

Please download SmitfraudFix (by S!Ri) to your Desktop.

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

**If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc…processutil.htm

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please do an online scan with Kaspersky WebScanner

Make sure you are using Internet Explorer for this. Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
- Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
- Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.

OfficialDom

Post #11October 7, 2008, 12:53 PM UTC

Thanks for your continuing help!!

Results of the Smitfraudscan search

ComboFix 08-10-06.03 - Sarah 2008-10-06 22:15:22.5 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Sarah\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Documents and Settings\Sarah\Desktop\setup.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Previous Run ——-
.
C:\Documents and Settings\Sarah\Desktop\setup.exe
C:\Program Files\VirusRL2009
C:\Program Files\VirusRL2009\VirusRL2009.exe

.
((((((((((((((((((((((((( Files Created from 2008-09-06 to 2008-10-06 )))))))))))))))))))))))))))))))
.

2008-10-06 17:12 . 2008-10-06 17:12 3,816 –a—— C:\WINDOWS\system32\tmp.reg
2008-10-06 15:45 . 2008-10-06 15:45 d——– C:\Program Files\Trend Micro
2008-10-06 14:06 . 2008-10-06 14:06 d——– C:\WINDOWS\ERUNT
2008-10-06 14:05 . 2008-10-06 14:29 d——– C:\SDFix
2008-10-06 10:36 . 2008-10-06 10:37 d——– C:\nss
2008-10-05 23:41 . 2008-06-23 17:57 6,066,176 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll
2008-10-05 23:41 . 2007-04-17 10:32 2,455,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-10-05 23:41 . 2007-03-08 06:10 991,232 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-10-05 23:41 . 2008-06-23 17:57 459,264 —–c— C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-10-05 23:41 . 2008-06-23 17:57 383,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-10-05 23:41 . 2008-06-23 17:57 267,776 —–c— C:\WINDOWS\system32\dllcache\iertutil.dll
2008-10-05 23:41 . 2008-06-23 17:57 63,488 —–c— C:\WINDOWS\system32\dllcache\icardie.dll
2008-10-05 23:41 . 2008-06-23 17:57 52,224 —–c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-10-05 23:41 . 2008-06-23 10:20 13,824 —–c— C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-10-05 20:27 . 2008-10-05 20:27 d——– C:\Program Files\Windows Sidebar
2008-10-05 20:26 . 2008-10-05 23:03 d——– C:\Program Files\Norton 360
2008-10-05 20:22 . 2008-10-05 20:30 123,952 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-10-05 20:22 . 2008-10-05 20:30 60,800 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2008-10-05 20:22 . 2008-10-05 20:30 10,563 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-10-05 20:22 . 2008-10-05 20:30 805 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-10-05 17:43 . 2008-10-05 17:43 d——– C:\Documents and Settings\All Users\Symantec Temporary Files
2008-10-05 17:11 . 2008-10-06 20:43 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-06 21:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kontiki
2008-10-06 20:30 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-10-06 14:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-10-05 22:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-10-05 21:13 ——— d—–w C:\Documents and Settings\Sarah\Application Data\Symantec
2008-10-05 19:30 ——— d—–w C:\Program Files\Symantec
2008-08-30 00:30 ——— d—–w C:\Program Files\Oberon Media
2008-08-28 19:43 ——— d—–w C:\Documents and Settings\Sarah\Application Data\Sibelius Software
2008-07-18 21:10 94,920 —-a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 21:10 53,448 —-a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 21:10 45,768 —-a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 21:10 36,552 —-a-w C:\WINDOWS\system32\wups.dll
2008-07-18 21:09 563,912 —-a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 21:09 325,832 —-a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 21:09 205,000 —-a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 21:09 1,811,656 —-a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 21:07 270,880 —-a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 21:07 210,976 —-a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:32 253,952 —-a-w C:\WINDOWS\system32\es.dll
2007-07-03 20:30 525,624 -c–a-w C:\Documents and Settings\Sarah\WindowsXP-KB922120-v5-x86-ENU-lltd.exe
2006-03-07 15:04 32 -c–a-r C:\Documents and Settings\All Users\hash.dat
.

((((((((((((((((((((((((((((( snapshot@2008-10-06_18.53.06.56 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-03-06 01:22:41 213,216 -c—-w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:51 371,424 -c—-w C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\updspapi.dll
+ 2007-08-13 17:54:10 765,952 -c—-w C:\WINDOWS\ie7updates\KB938127-IE7\vgx.dll
+ 2007-03-06 01:22:39 213,216 -c—-w C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe
+ 2007-03-06 01:23:47 371,424 -c—-w C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\updspapi.dll
+ 2007-07-12 23:31:54 765,952 -c—-w C:\WINDOWS\ie7updates\KB938127-v2-IE7\vgx.dll
+ 2008-02-26 11:59:50 294,912 -c—-w C:\WINDOWS\system32\dllcache\msctf.dll
- 2007-08-13 17:54:10 765,952 -c–a-w C:\WINDOWS\system32\dllcache\VGX.dll
+ 2008-05-27 17:23:58 765,952 -c–a-w C:\WINDOWS\system32\dllcache\vgx.dll
- 2004-08-04 07:56:42 294,400 —-a-w C:\WINDOWS\system32\msctf.dll
+ 2008-02-26 11:59:50 294,912 —-a-w C:\WINDOWS\system32\msctf.dll
+ 2008-10-06 20:21:50 16,384 —-atw C:\WINDOWS\temp\Perflib_Perfdata_1e0.dat
+ 2008-10-06 20:21:36 16,384 —-atw C:\WINDOWS\temp\Perflib_Perfdata_614.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
2008-02-26 09:34 576352 –a—— C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
2008-02-26 09:34 576352 –a—— C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
2008-02-26 09:34 576352 –a—— C:\Program Files\Common Files\Symantec Shared\Backup\buShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2003-09-05 65536]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2004-11-24 880640]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-06 68856]
"kdx"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 1032640]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"VirusRL2009"="C:\Program Files\VirusRL2009\VirusRL2009.exe" [BU]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-10-28 335872]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2003-06-18 151552]
"CeEPOWER"="C:\Program Files\TOSHIBA\Power Management\CePMTray.exe" [2003-11-03 135168]
"CPLDFL10"="C:\PROGRA~1\EzButton\CPLDFL10.EXE" [2003-11-19 294912]
"CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [2003-11-05 638976]
"TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [2003-04-28 49152]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 196608]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-04-13 69632]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-08 77824]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe" [2004-11-25 143360]
"DataLayer"="C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE" [2004-12-09 1068032]
"AS00_Gear511"="C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe" [2006-10-13 1130496]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"4oD"="C:\Program Files\Kontiki\KHost.exe" [2007-04-23 1032640]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-02 185896]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-18 51048]
"osCheck"="C:\Program Files\Norton 360\osCheck.exe" [2008-02-26 988512]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 C:\WINDOWS\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2003-11-19 C:\WINDOWS\agrsmmsg.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Symantec NetDriver Warning"="C:\PROGRA~1\SYMNET~1\SNDWarn.exe" [2004-10-29 218232]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2003-08-25 614536]
KODAK Software Updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe [2003-06-08 16432]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]
Photo Loader supervisory.lnk - C:\Program Files\CASIO\Photo Loader\Plauto.exe [2004-07-27 217088]
Watch.lnk - C:\WINDOWS\twain_32\S6U12BX\WATCH.exe [2007-02-03 356352]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\backWeb-7288971.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"13364:UDP"= 13364:UDP:Print Server Utility
"13107:UDP"= 13107:UDP:Print Server Utility
"69:UDP"= 69:UDP:Print Server Utility

R2 DPortIO;Dritek Port I/O Driver;C:\WINDOWS\system32\Drivers\DPortIO.sys [2001-04-12 3674]
R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-02-18 149352]
R3 AWINDIS5;AWINDIS5 Protocol Driver;C:\WINDOWS\system32\AWINDIS5.SYS [2006-02-25 16194]
R3 NETGEAR_WG511_SERVICE;NETGEAR WG511T Wireless Adapter Service;C:\WINDOWS\system32\DRIVERS\wg511nd5.sys [2006-03-23 488992]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 23888]
S3 S6U12BScanner;MUSTEK 1200 UB Still Image Device Service;C:\WINDOWS\system32\drivers\usbscan.sys [2004-08-04 15104]

*Newly Created Service* - COMHOST
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-06 22:20:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2008-10-06 22:26:50
ComboFix-quarantined-files.txt 2008-10-06 21:25:24
ComboFix2.txt 2008-10-06 18:51:59
ComboFix3.txt 2008-10-06 17:55:36

Pre-Run: 1,392,857,088 bytes free
Post-Run: 1,370,157,056 bytes free

181 — E O F — 2008-10-06 19:52:48

Here is the MBAM Log

Malwarebytes' Anti-Malware 1.28
Database version: 1235
Windows 5.1.2600 Service Pack 2

06/10/2008 23:47:03
mbam-log-2008-10-06 (23-47-02).txt

Scan type: Quick Scan
Objects scanned: 51850
Time elapsed: 9 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 13
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\retro64_loader.r64loader (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\retro64_loader.r64loader.1 (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\w123.w123mgr (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\w123.w123mgr.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{450b9e4d-4014-4de3-b34e-014a81468293} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{F5734812-E6A1-8833-ECA9-949B5B8A88BF} (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{c7f00a9a-f1bc-436e-82c7-e8cae6fd67f7} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VirusRL2009 (Rogue.AVLab) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\virusrl2009 (Rogue.AVLab) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\virusrl2009 (Rogue.AVLab) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll (Adware.Minibug) -> Quarantined and deleted successfully.

Finally, here is the Kaspersky log[\b]

——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, October 7, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, October 07, 2008 07:09:36
Records in database: 1296706
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 81554
Threat name: 4
Infected objects: 4
Suspicious objects: 3
Duration of the scan: 02:32:20

File name / Threat name / Threats count
C:\Documents and Settings\Sarah\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
C:\Documents and Settings\Sarah\Desktop\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
C:\Documents and Settings\Sarah\My Documents\e-mails\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 3
C:\Documents and Settings\Sarah\My Documents\e-mails\Deleted Items.dbx Infected: Email-Worm.Win32.Zhelatin.r 1
C:\Documents and Settings\Sarah\My Documents\e-mails\Sarah.dbx Infected: Email-Worm.Win32.NetSky.q 1

The selected area was scanned.

I presume the e-mail virus identified by Kaspersky are still there? I haven't clicked on anything other than save the log.

Thanks

Rorschach112

Post #12October 7, 2008, 1:11 PM UTC

Yes delete these emails C:\Documents and Settings\Sarah\My Documents\e-mails\Deleted Items.dbx C:\Documents and Settings\Sarah\My Documents\e-mails\Deleted Items.dbx C:\Documents and Settings\Sarah\My Documents\e-mails\Sarah.dbx You didn't post the SmitfraudFix log, that was the ComboFix log. Could you post that and a new HijackThis log

OfficialDom

Post #13October 7, 2008, 1:59 PM UTC

Sorry! I got confused

Just to check … If I delete the Sarah.dbx file, does this mean that Sarah loses all the e-mails in her inbox? Is there no way to isolate the individual infected file?

Here if the Smitfraudfix log (I re-ran Smitfraudfix because I couldn't work out where I had saved the old one. Hope that's ok)

SmitFraudFix v2.356

Scan done at 14:49:36.00, 07/10/2008
Run from C:\Documents and Settings\Sarah\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Kontiki\KService.exe
C:\WINDOWS\system32\NWDLS.exe
C:\WINDOWS\system32\RioMSC.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
C:\PROGRA~1\EzButton\CPLDFL10.EXE
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\WINDOWS\twain_32\S6U12BX\WATCH.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Sarah\Local Settings\Temp\jkos-Sarah\binaries\ScanningProcess.exe
C:\Documents and Settings\Sarah\Desktop\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sarah

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sarah\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Sarah\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» RK

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NETGEAR 108 Mbps Wireless PC Card WG511T - Packet Scheduler Miniport
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{EA231102-C6B2-40AD-A917-6E7589DB4A19}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{EC0A9D6C-DB1C-45C0-8A2F-13FD94C9B1CC}: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\..\{EA231102-C6B2-40AD-A917-6E7589DB4A19}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{EA231102-C6B2-40AD-A917-6E7589DB4A19}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=[removed] [removed]
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

and the HIjack this report too

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:59:06, on 07/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Kontiki\KService.exe
C:\WINDOWS\system32\NWDLS.exe
C:\WINDOWS\system32\RioMSC.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
C:\PROGRA~1\EzButton\CPLDFL10.EXE
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe
C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
C:\Program Files\CASIO\Photo Loader\Plauto.exe
C:\WINDOWS\twain_32\S6U12BX\WATCH.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Sarah\Local Settings\Temp\jkos-Sarah\binaries\ScanningProcess.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
O4 - HKLM\..\Run: [CPLDFL10] C:\PROGRA~1\EzButton\CPLDFL10.EXE
O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\Launch Application 2.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
O4 - HKLM\..\Run: [AS00_Gear511] C:\Program Files\NETGEAR\WG511SCU\Utility\Gear511.exe -hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [4oD] "C:\Program Files\Kontiki\KHost.exe" -all
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Symantec NetDriver Warning] C:\PROGRA~1\SYMNET~1\SNDWarn.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Photo Loader supervisory.lnk = C:\Program Files\CASIO\Photo Loader\Plauto.exe
O4 - Global Startup: Watch.lnk = C:\WINDOWS\twain_32\S6U12BX\WATCH.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file:///C:\Program Files\TOSHIBA\Free Update Service\splash.html
O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/haphazard/raptisoftgameloader.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Netgear Wireless Domain Login Service (NWDLS) - Unknown owner - C:\WINDOWS\system32\NWDLS.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

–
End of file - 10509 bytes

Hope this is ok

Rorschach112

Post #14October 7, 2008, 2:10 PM UTC

No way to narrow it down, tell the user not to open any attachments in their emails as some of them have malware

Follow these steps to uninstall Combofix and tools used in the removal of malware

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

Make sure you have an Internet Connection.
Download OTCleanIt to your desktop and run it
A list of tool components used in the Cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OTCleanUp to reach the Internet, please allow the application to do so.
Click Yes to beging the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

Your using an old version of Adobe Acrobat Reader, this can leave your pc open to vulnerabilities, you can update it here :
http://www.adobe.com/products/acrobat/readstep2.html

Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:

SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict.

Make Internet Explorer more secure

Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.

*ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

*NoScript - Addon for Firefox that stops all scripts from running on websites. Stops malicious software from invading via flash, java, javascript, and many other entry points.

*Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.

OfficialDom

Post #15October 7, 2008, 5:52 PM UTC

Thanks so much … you're a star!!! *scurries off to recommend this site to all his friends* One last question. If I copy the Sarah.dbx e-mail file to DVD before deleting it, do I run the risk of triggering its infection?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] VirusRL2009 infection

✨ Ask AI

Ask AI