Ad sites come up when clicking search links. At The End Of My Rope - C |
Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!
|
|
|
  |
 Apr 2 2009, 06:58 PM
Post
#1
|
|
|
Member  Posts: 19 OS: Windows XP  |
Hello
My computer has taken on a life of it's on. I have an HP Pavillion 7965 on Windows XP. Whenever we do searches on Google or Yahoo and click on the links we get all sorts of different ad sites. Plus our computer will start playing all sorts of weird sounds at random times. Last one was a Howie Mandell ad for buy.com and it just started playing at 3am. Scared the crap outta me  Using the instructions on the FAQ I have done the ATF cleaner, The Erunt and then downloaded and installed Malware Bytes and thats where I'm stuck. When I try to open the Malware Bytes program nothing happens. I think I have some bad stuff on my pc but am not sure where to go from here. I did the OTListlt2 thing and here is what's in the log. Can you help? OTListIt logfile created on: 4/2/2009 8:45:01 PM - Run 1 OTListIt2 by OldTimer - Version 2.0.9.1 Folder = C:\Documents and Settings\Owner\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 511.53 Mb Total Physical Memory | 118.90 Mb Available Physical Memory | 23.24% Memory free 1.22 Gb Paging File | 0.70 Gb Available in Paging File | 57.11% Paging File free Paging file location(s): C:\pagefile.sys 768 1536; %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 32.84 Gb Total Space | 5.53 Gb Free Space | 16.83% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: YOUR-ZE8CXVR8TT Current User Name: Owner Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Minimal File Age = 30 Days Company Name Whitelist: On ========== Processes (SafeList) ========== PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.) PRC - C:\Program Files\Embarq Online Security 8\Anti-Virus\fsgk32st.exe (F-Secure Corporation) PRC - C:\Program Files\Embarq Online Security 8\Common\FSMA32.EXE (F-Secure Corporation) PRC - C:\Program Files\Embarq Online Security 8\Anti-Virus\FSGK32.EXE (F-Secure Corp.) PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.) PRC - C:\Program Files\Embarq Online Security 8\Common\FSMB32.EXE (F-Secure Corporation) PRC - C:\Program Files\SpywareDetector\SDService.exe (Max Secure Software ) PRC - C:\Program Files\Embarq Online Security 8\Common\FCH32.EXE (F-Secure Corporation) PRC - C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation) PRC - C:\Program Files\Embarq Online Security 8\Common\FAMEH32.EXE (F-Secure Corporation) PRC - C:\Program Files\Embarq Online Security 8\Anti-Virus\fsqh.exe (F-Secure Corporation) PRC - C:\Program Files\Embarq Online Security 8\FSPC\fspc.exe (F-Secure Corporation) PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation) PRC - C:\windows\system\hpsysdrv.exe (Hewlett-Packard Company) PRC - C:\HP\KBD\KBD.EXE (Hewlett-Packard Company) PRC - C:\Program Files\Microsoft IntelliPoint\point32.exe (Microsoft Corporation) PRC - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.) PRC - C:\Program Files\Embarq Online Security 8\FSAUA\program\fsaua.exe (F-Secure Corporation) PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) PRC - C:\Program Files\Embarq Online Security 8\Common\FSM32.EXE (F-Secure Corporation) PRC - C:\Program Files\Embarq Online Security 8\Anti-Virus\fssm32.exe (F-Secure Corp.) PRC - C:\Program Files\Max Registry Cleaner\MaxRCSystemTray.exe (Max Secure Software www.maxpcsecure.com) PRC - C:\Program Files\Embarq Online Security 8\ORSP Client\fsorsp.exe (F-Secure Corporation) PRC - C:\Program Files\Embarq Online Security 8\FSGUI\fsguidll.exe (F-Secure Corporation) PRC - C:\Program Files\Embarq Online Security 8\FWES\Program\fsdfwd.exe (F-Secure Corporation) PRC - C:\Program Files\Embarq Online Security 8\FSAUA\program\fsus.exe (F-Secure Corporation) PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.) PRC - C:\Program Files\Embarq Online Security 8\Anti-Virus\fsav32.exe (F-Secure Corporation) PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Documents and Settings\Owner\Desktop\OTListIt2.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (Apple Mobile Device [Auto | Running]) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.) SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation) SRV - (Bonjour Service [Auto | Running]) -- C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.) SRV - (F-Secure Gatekeeper Handler Starter [Auto | Running]) -- C:\Program Files\Embarq Online Security 8\Anti-Virus\fsgk32st.exe (F-Secure Corporation) SRV - (FSAUA [On_Demand | Running]) -- C:\Program Files\Embarq Online Security 8\FSAUA\program\fsaua.exe (F-Secure Corporation) SRV - (FSDFWD [On_Demand | Running]) -- C:\Program Files\Embarq Online Security 8\FWES\Program\fsdfwd.exe (F-Secure Corporation) SRV - (FSMA [Auto | Running]) -- C:\Program Files\Embarq Online Security 8\Common\FSMA32.EXE (F-Secure Corporation) SRV - (FSORSPClient [On_Demand | Running]) -- C:\Program Files\Embarq Online Security 8\ORSP Client\fsorsp.exe (F-Secure Corporation) SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation) SRV - (IDriverT [On_Demand | Stopped]) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation) SRV - (iPod Service [On_Demand | Running]) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.) SRV - (Irmon [Auto | Running]) -- C:\WINDOWS\System32\irmon.dll (Microsoft Corporation) SRV - (JavaQuickStarterService [Auto | Running]) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.) SRV - (KodakCCS [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\KodakCCS.exe (Eastman Kodak Company) SRV - (McShield [On_Demand | Stopped]) -- C:\Program Files\McAfee.com\VSO\mcshield.exe () SRV - (MSCSPTISRV [On_Demand | Stopped]) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation) SRV - (PACSPTISVR [On_Demand | Stopped]) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe (Sony Corporation) SRV - (SDService [Auto | Running]) -- C:\Program Files\SpywareDetector\SDService.exe (Max Secure Software ) SRV - (SPTISRV [On_Demand | Stopped]) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation) SRV - (UMWdf [Auto | Running]) -- C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (ac97intc [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation) DRV - (amdagp [Boot | Running]) -- C:\WINDOWS\System32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.) DRV - (Aspi32 [Auto | Running]) -- C:\WINDOWS\System32\drivers\ASPI32.SYS (Adaptec) DRV - (DCamUSBSvis [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\svstream.sys (Sound Vision Inc.) DRV - (DcCam [System | Running]) -- C:\WINDOWS\system32\DRIVERS\DcCam.sys (Eastman Kodak Company) DRV - (DcFpoint [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\DcFpoint.sys (Eastman Kodak Company) DRV - (DCFS2K [Auto | Running]) -- C:\WINDOWS\system32\drivers\dcfs2k.sys (Eastman Kodak Company) DRV - (DcLps [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\DcLps.sys (Eastman Kodak Company) DRV - (DcPTP [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\DcPTP.sys (Eastman Kodak Company) DRV - (E100B [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\e100b325.sys (Intel Corporation) DRV - (Exportit [System | Stopped]) -- C:\WINDOWS\system32\DRIVERS\exportit.sys (Eastman Kodak Company) DRV - (F-Secure Filter [Disabled | Stopped]) -- C:\Program Files\Embarq Online Security 8\Anti-Virus\Win2K\FSfilter.sys () DRV - (F-Secure Gatekeeper [On_Demand | Running]) -- C:\Program Files\Embarq Online Security 8\Anti-Virus\minifilter\fsgk.sys () DRV - (F-Secure HIPS [System | Running]) -- C:\Program Files\Embarq Online Security 8\HIPS\drivers\fshs.sys (F-Secure Corporation) DRV - (F-Secure Recognizer [Disabled | Stopped]) -- C:\Program Files\Embarq Online Security 8\Anti-Virus\Win2K\FSrec.sys () DRV - (fsbts [Boot | Running]) -- C:\WINDOWS\system32\Drivers\fsbts.sys () DRV - (FSFW [Boot | Running]) -- C:\WINDOWS\System32\drivers\fsdfw.sys (F-Secure Corporation) DRV - (gameenum [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\gameenum.sys (Microsoft Corporation) DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV - (i81x [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\i81xnt5.sys (Intel® Corporation) DRV - (iAimFP0 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\wADV01nt.sys (Intel® Corporation) DRV - (iAimFP1 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\wADV02NT.sys (Intel® Corporation) DRV - (iAimFP2 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\wADV05NT.sys (Intel® Corporation) DRV - (iAimFP3 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\wSiINTxx.sys (Intel® Corporation) DRV - (iAimFP4 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\wVchNTxx.sys (Intel® Corporation) DRV - (iAimTV0 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\wATV01nt.sys (Intel® Corporation) DRV - (iAimTV1 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\wATV02NT.sys (Intel® Corporation) DRV - (iAimTV3 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\wATV04nt.sys (Intel® Corporation) DRV - (iAimTV4 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\wCh7xxNT.sys (Intel® Corporation) DRV - (IPSECEXT [Auto | Stopped]) -- C:\WINDOWS\System32\DRIVERS\ipsecw2k.sys (Nortel Networks) DRV - (IPSECSHM [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ipsecw2k.sys (Nortel Networks) DRV - (irsir [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\irsir.sys (Microsoft Corporation) DRV - (ltmodem5 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ltmdmnt.sys (LT) DRV - (MASPINT [Auto | Running]) -- C:\WINDOWS\System32\drivers\MASPINT.SYS (MicroStaff Co.,Ltd.) DRV - (mrtRate [Auto | Running]) -- C:\WINDOWS\System32\drivers\MrtRate.sys (Marimba, Inc.) DRV - (ms_mpu401 [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation) DRV - (NaiFiltr [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\NaiFiltr.sys () DRV - (NETMDUSB [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\NETMDUSB.sys (Sony Corporation) DRV - (nv [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation) DRV - (nv4 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation) DRV - (PcdrNt [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\PcdrNt.sys (PC-Doctor Inc.) DRV - (PIXMCV [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\pixmcvc.sys (Pixela) DRV - (PIXMCVA [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\pixmcva.sys (Pixela) DRV - (PIXMCVV [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\pixmcvv.sys (Pixela) DRV - (Point32 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\point32.sys (Microsoft Corporation) DRV - (Ps2 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\PS2.sys (Hewlett-Packard Company) DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.) DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\DRIVERS\PxHelp20.sys (Sonic Solutions) DRV - (rtl8139 [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\RTL8139.SYS (Realtek Semiconductor Corporation) DRV - (S3SavageNB [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\s3gnbm.sys (S3 Graphics, Inc.) DRV - (SDActMon [On_Demand | Stopped]) -- C:\Program Files\SpywareDetector\SDActMon.sys (Max Secure Software Pvt. Ltd.) DRV - (SDManager [System | Running]) -- C:\Program Files\SpywareDetector\SDManager.sys (Max Secure Software Pvt. Ltd.) DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - (StillCam [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\serscan.sys (Microsoft Corporation) DRV - (USBAAPL [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\usbaapl.sys (Apple, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_srch-us3_URL = http://srch-us3.hpwis.com/ IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,srch-us3 Page = http://srch-us3.hpwis.com/ IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://red.clientapps.yahoo.com/customize/...rch/search.html IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,srch-us3 Page = http://srch-us3.hpwis.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost;*.local ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "http://www.myembarq.com/index.php" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.0.1 FF - prefs.js..extensions.enabledItems: firefox@ghostery.com:1.3.9 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.8 FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/03/21 12:52:29 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/02 17:24:41 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.8\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/04/02 17:24:38 | 00,000,000 | ---D | M] [2008/09/15 20:12:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\mozilla\Extensions [2008/09/15 20:12:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/04/02 17:40:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\rfkbtxb2.default\extensions [2009/04/02 17:40:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\rfkbtxb2.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2009/04/02 17:40:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\mozilla\Firefox\Profiles\rfkbtxb2.default\extensions\firefox@ghostery.com [2009/04/02 17:24:38 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2009/04/02 17:24:38 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/03/26 15:11:21 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009/03/26 15:11:22 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2009/03/26 14:56:22 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml [2009/03/26 14:56:22 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml [2009/03/26 14:56:22 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml [2009/03/26 14:56:22 | 00,002,343 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml [2009/03/26 14:56:22 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2009/03/26 14:56:22 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml [2009/03/26 14:56:22 | 00,000,792 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml O1 HOSTS File: (734 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (MYPOINTS) - {A057A204-BACC-4D26-CEC4-75A487FD6484} - C:\Program Files\mypoints\mypoints.dll (Infospace ) O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll (Microsoft Corp.) O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll (Microsoft Corp.) O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll () O3 - HKLM\..\Toolbar: (MYPOINTS) - {A057A204-BACC-4D26-CEC4-75A487FD6484} - C:\Program Files\mypoints\mypoints.dll (Infospace ) O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Reg Error: Key error. File not found O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - Reg Error: Key error. File not found O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - Reg Error: Key error. File not found O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-CEC4-75A487FD6484} - C:\Program Files\mypoints\mypoints.dll (Infospace ) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {C7768536-96F8-4001-B1A2-90EE21279187} - Reg Error: Key error. File not found O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.) O4 - HKLM..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" (Adobe Systems Incorporated) O4 - HKLM..\Run: [F-Secure Manager] "C:\Program Files\Embarq Online Security 8\Common\FSM32.EXE" /splash (F-Secure Corporation) O4 - HKLM..\Run: [F-Secure TNB] "C:\Program Files\Embarq Online Security 8\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW (F-Secure Corporation) O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe (Intel Corporation) O4 - HKLM..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe (Intel Corporation) O4 - HKLM..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" (Microsoft Corporation) O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Inc.) O4 - HKLM..\Run: [KBD] C:\HP\KBD\KBD.EXE (Hewlett-Packard Company) O4 - HKLM..\Run: [PS2] C:\WINDOWS\system32\ps2.exe (Hewlett-Packard Company) O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime (Apple Inc.) O4 - HKLM..\Run: [RCAutoLiveUpdate] C:\Program Files\Max Registry Cleaner\MaxLURC.exe -AUTO (Max Secure Software) O4 - HKLM..\Run: [RCSystemTray] C:\Program Files\Max Registry Cleaner\MaxRCSystemTray.exe (Max Secure Software www.maxpcsecure.com) O4 - HKLM..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE () O4 - HKLM..\Run: [SDActiveMonitor] C:\Program Files\SpywareDetector\SDActiveMonitor.exe -AUTO (Max Secure Software Pvt. Ltd.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra Button: Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\Embarq Online Security 8\FSPC\fspcmsie.dll (F-Secure Corporation) O9 - Extra 'Tools' menuitem : Parental... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\Embarq Online Security 8\FSPC\fspcmsie.dll (F-Secure Corporation) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000025 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000026 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\Program Files\Embarq Online Security 8\FSPS\program\fslsp.dll (F-Secure Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {00000075-0000-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/voxmsdec.CAB (Reg Error: Key error.) O16 - DPF: {038E2507-7A48-41E2-94AD-7F23D199AF4E} http://www.worldwinner.com/games/v54/zengems/zengems.cab (ZenGems Control) O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} http://download.mcafee.com/molbin/Shared/MGBrwFld.cab (BrowseFolderPopup Class) O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/2008.1...toUploader5.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} http://www.ipix.com/viewers/ipixx.cab (iPIX ActiveX Control) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} http://mypoints.worldwinner.com/games/v47/...GamesLoader.cab (FunGamesLoader Object) O16 - DPF: {1D082E71-DF20-4AAF-863B-596428C49874} http://www.worldwinner.com/games/v50/tpir/tpir.cab (TPIR Control) O16 - DPF: {1DF36010-E276-11D4-A7C0-00C04F0453DD} https://secure.stamps.com/download/us/regis...55/sdcregie.cab (Stamps.com Secure Postal Account Registration) O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} http://us.dl1.yimg.com/download.yahoo.com/...s/yinst0401.cab (YInstStarter Class) O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www2.snapfish.com/SnapfishActivia.cab (Snapfish Activia) O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://bin.mcafee.com/molbin/shared/mcinsc...,9/mcinsctl.cab (McAfee.com Operating System Class) O16 - DPF: {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} http://www.infospace.com/mypoints.main/tba...pointsSetup.exe (Reg Error: Key error.) O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/...lscbase5483.cab (Windows Live Safety Center Base Module) O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab (Bejeweled Control) O16 - DPF: {61900274-3323-4446-BDCD-91548D32AF1B} http://www.worldwinner.com/games/v56/spide...ersolitaire.cab (SpiderSolitaire Control) O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} https://webdl.symantec.com/activex/symdlmgr.cab (Symantec Download Manager) O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} http://www.worldwinner.com/games/v41/freecell/freecell.cab (FreeCell Control) O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {94299420-321F-4FF9-A247-62A23EBB640B} http://www.worldwinner.com/games/v46/wordmojo/wordmojo.cab (WordMojo Control) O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} http://web1.shutterfly.com/downloads/Uploader.cab (Shutterfly Picture Upload Plugin) O16 - DPF: {97438FE9-D361-4279-BA82-98CC0877A717} http://www.worldwinner.com/games/v57/cubis/cubis.cab (Cubis Control) O16 - DPF: {A52FBD2B-7AB3-4F6B-90E3-91C772C5D00F} http://www.worldwinner.com/games/v57/wof/wof.cab (WoF Control) O16 - DPF: {A91FB93D-7561-4524-8484-5C27C8FA8D42} http://www.worldwinner.com/games/v49/luxor/luxor.cab (WwLuxor Control) O16 - DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} http://www.worldwinner.com/games/v67/swapit/swapit.cab (SwapIt Control) O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} http://www.worldwinner.com/games/v41/hangman/hangman.cab (Hangman Control) O16 - DPF: {BE5431D2-0F30-11D4-89D9-00C04F509C0A} http://www.stamps.com/download/us/cab/stam...file=stamps.cab (SDCInstaller Class) O16 - DPF: {C5326A4D-E9AA-40AD-A09A-E74304D86B47} http://www.worldwinner.com/games/v50/dinerdash/dinerdash.cab (DinerDash Control) O16 - DPF: {C82BB209-F528-46F9-96D5-69DEF7260916} http://www.worldwinner.com/games/v45/mysterypi/mysterypi.cab (MysteryPI Control) O16 - DPF: {C93C1C34-CEA9-49B1-9046-040F59E0E0D8} http://www.worldwinner.com/games/v43/paint/paint.cab (Paint Control) O16 - DPF: {CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA} http://java.sun.com/products/plugin/1.3.1/...all-131-win.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} http://www.worldwinner.com/games/v47/famil.../familyfeud.cab (FamilyFeud Control) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa...ash/swflash.cab (Shockwave Flash Object) O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe (Virtools WebPlayer Class) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\SDNotify: DllName - C:\Program Files\SpywareDetector\SDNotify.dll - C:\Program Files\SpywareDetector\SDNotify.dll (Max Secure Software) O24 - Desktop Components:0 (My Current Home Page) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ] O34 - HKLM BootExecute: (SDEarlyDelete) - C:\WINDOWS\System32\SDEarlyDelete.exe () O34 - HKLM BootExecute: (autocheck autochk *) - File not found ========== Files/Folders - Created Within 30 Days ========== [2 C:\WINDOWS\System32\*.tmp files] [3 C:\WINDOWS\*.tmp files] [2009/04/02 20:44:25 | 00,499,712 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTListIt2.exe [2009/04/02 19:57:23 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009/04/02 19:57:23 | 00,000,707 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2009/04/02 19:57:14 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009/04/02 19:57:12 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009/04/02 19:57:12 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2009/04/02 19:55:35 | 02,906,232 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mblah.exe [2009/04/02 19:28:05 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2009/04/02 19:27:24 | 00,000,622 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\NTREGOPT.lnk [2009/04/02 19:27:24 | 00,000,603 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\ERUNT.lnk [2009/04/02 19:27:24 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT [2009/04/02 18:45:04 | 00,009,334 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\SysRestorePoint_v13.zip [2009/04/02 17:24:42 | 00,001,613 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk [2009/03/31 15:26:49 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Live Safety Center [2009/03/20 21:19:30 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\CVS [2009/03/18 18:14:09 | 00,001,353 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Shortcut to 100_1765.jpg.lnk [2009/03/18 18:13:54 | 00,001,353 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Shortcut to 100_1764.jpg.lnk [2009/03/18 18:13:47 | 00,001,353 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Shortcut to 100_1763.jpg.lnk [2009/03/15 21:23:22 | 00,194,560 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\myles1.doc [2009/03/15 18:16:08 | 00,014,848 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Bills.xls [2009/03/13 16:11:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\IsolatedStorage [2009/03/13 16:10:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\ApplicationHistory [2009/03/13 16:09:22 | 00,000,000 | ---D | C] -- C:\Program Files\DrawMusic [2009/03/13 16:02:23 | 00,000,000 | R-SD | C] -- C:\WINDOWS\assembly [2009/03/13 16:02:09 | 00,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET [2009/03/13 16:01:52 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\URTTemp ========== Files - Modified Within 30 Days ========== [4 C:\*.tmp files] [2 C:\WINDOWS\System32\*.tmp files] [3 C:\WINDOWS\*.tmp files] [1 C:\Documents and Settings\Owner\My Documents\*.tmp files] [2009/04/02 20:44:25 | 00,499,712 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTListIt2.exe [2009/04/02 20:25:24 | 00,000,247 | ---- | M] () -- C:\WINDOWS\System\HPSYSDRV.DAT [2009/04/02 20:25:18 | 00,001,170 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009/04/02 20:24:43 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009/04/02 20:24:38 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009/04/02 20:24:36 | 53,644,9024 | -HS- | M] () -- C:\hiberfil.sys [2009/04/02 20:00:41 | 00,000,508 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled scanning task.job [2009/04/02 19:57:23 | 00,000,707 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2009/04/02 19:55:47 | 02,906,232 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mblah.exe [2009/04/02 19:27:24 | 00,000,622 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\NTREGOPT.lnk [2009/04/02 19:27:24 | 00,000,603 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\ERUNT.lnk [2009/04/02 18:46:14 | 00,021,504 | ---- | M] (Doug Knox) -- C:\Documents and Settings\Owner\Desktop\SysRestorePoint.exe [2009/04/02 18:45:11 | 00,009,334 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\SysRestorePoint_v13.zip [2009/04/02 17:24:42 | 00,001,613 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk [2009/04/02 09:41:44 | 00,000,123 | ---- | M] () -- C:\WINDOWS\System\SysSD.dll [2009/03/31 14:34:16 | 00,001,270 | ---- | M] () -- C:\WINDOWS\win.ini [2009/03/30 21:04:04 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk [2009/03/29 10:48:39 | 00,001,744 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2009/03/26 23:57:04 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2009/03/26 16:49:56 | 00,038,496 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009/03/26 16:49:50 | 00,015,504 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009/03/22 09:04:35 | 00,202,072 | R--- | M] (Coupons, Inc.) -- C:\WINDOWS\System32\cpnprt2.cid [2009/03/21 20:51:25 | 05,445,632 | R--- | M] () -- C:\Documents and Settings\All Users\Documents\ESBK.mbb [2009/03/21 20:51:21 | 03,905,536 | R--- | M] () -- C:\Documents and Settings\All Users\Documents\ESBK.mb [2009/03/18 18:14:09 | 00,001,353 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Shortcut to 100_1765.jpg.lnk [2009/03/18 18:13:54 | 00,001,353 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Shortcut to 100_1764.jpg.lnk [2009/03/18 18:13:47 | 00,001,353 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Shortcut to 100_1763.jpg.lnk [2009/03/15 21:23:23 | 00,194,560 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\myles1.doc [2009/03/15 18:16:08 | 00,014,848 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Bills.xls [2009/03/15 03:02:59 | 00,449,008 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/03/15 03:02:59 | 00,394,052 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009/03/15 03:02:59 | 00,059,108 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2009/03/11 03:09:02 | 00,336,256 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009/03/11 03:01:53 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK < End of report > OTListIt Extras logfile created on: 4/2/2009 8:45:01 PM - Run 1 OTListIt2 by OldTimer - Version 2.0.9.1 Folder = C:\Documents and Settings\Owner\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 511.53 Mb Total Physical Memory | 118.90 Mb Available Physical Memory | 23.24% Memory free 1.22 Gb Paging File | 0.70 Gb Available in Paging File | 57.11% Paging File free Paging file location(s): C:\pagefile.sys 768 1536; %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 32.84 Gb Total Space | 5.53 Gb Free Space | 16.83% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: YOUR-ZE8CXVR8TT Current User Name: Owner Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Minimal File Age = 30 Days Company Name Whitelist: On ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile "EnableFirewall" = 0 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List "8097:TCP" = 8097:TCP:*:Enabled:EarthLink UHP Modem Support ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] C:\Program Files\Yahoo!\Messenger\YPager.exe:*:Enabled:Yahoo! Messenger File not found C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server File not found C:\Program Files\Yahoo!\Yahoo! Music Engine\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Engine File not found C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare () C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent File not found C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype File not found %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation) C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour (Apple Inc.) C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes (Apple Inc.) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{00030409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Small Business "{00040409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Disc 2 "{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}" = Notifier "{00170409-78E1-11D2-B60F-006097C998E7}" = Microsoft Word 2000 "{0413C01D-638A-496B-AD24-56309C8775D7}" = War Games Virtual Warfare Demo "{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}" = WD Diagnostics "{0DB93918-2A77-11D3-805A-00C04FA329AA}" = Word in Works Suite add-in "{109AB81D-9732-40B3-9C1F-113A86CE6F93}" = Canon MP Navigator 1.0 "{10C69612-017B-45F5-B986-7D113D5A2EA3}" = MSN Toolbar "{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD "{154508C0-07C5-4659-A7A0-E49968750D21}" = HLPPDOCK "{18A5DFF2-8A95-49F3-873F-743CB5549F3D}" = Canon ScanGearStarter "{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 12 "{2B5DDB2C-0807-47FD-9C11-80EA761902C0}" = Easy Internet Sign-up "{2F151B50-B434-4838-B51D-70442EBA093E}" = OpenMG Secure Module 4.1.00 "{2F20ADFD-5679-11D5-A8E1-00A0CC663B7C}" = PigPen "{318AB667-3230-41B5-A617-CB3BF748D371}" = iTunes "{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11 "{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3 "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{38441BE7-79B0-42B8-8297-833704F949FE}" = HLPIndex "{3B24B725-D81F-442D-8CE5-2AF05A4A4CC9}" = Music Visualizer Library 1.4.00 "{3CA39B0C-BA85-4D42-AC0F-1FF5F60C3353}" = OTtBPSDK "{3FF3DD04-F386-46B0-97FC-B86238B65487}" = Canon MP Drivers 6.0 "{42977380-5628-11D5-A8E1-00A0CC53785B}" = Speedway "{432C3720-37BF-4BD7-8E49-F38E090246D0}" = CR2 "{48C82F7A-F100-4DAB-A310-8E18BF2159E1}" = ESSvpot "{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0 "{4C23837C-993E-11D4-9DE0-0060085C158A}" = KODAK Picture CD "{4F677FC7-7AA8-412B-A957-F13CBE1C7331}" = ESSSONIC "{4FD84C01-F268-4E99-A7D5-533D04722C4B}" = SabreWing 2 "{54C8FE84-89C4-40E8-976C-439EB0729BD6}" = CardRd81 "{56364334-9530-11D2-BFFC-00C04FA329AA}" = Microsoft Works 2000 "{5AA18C57-381C-4C99-8FE6-5EB1CB0A5BC0}" = ImageMixer "{5BE42A03-E7B8-42A9-B1BB-FC48B03D58B8}" = Presto! PageManager 6.03 "{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA "{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0 "{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr "{64635543-70E7-436D-8D6D-4A721595029E}" = Microsoft IntelliPoint 5.2 "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{6A6FF26C-34A4-11D5-A8E0-00A0CC663B7C}" = DarkOrbit "{6E4D4E0B-02F6-46C1-BAE5-1B6B2E486A7B}" = Microsoft Office Live Meeting 2007 "{71D6CE84-B7DC-4166-8E0D-56C1C37BFB5A}" = SonicStage "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}" = OmniPage SE 2.0 "{8214CC02-6271-4DC8-B8DD-779933450264}" = HP RecordNow "{84AACA70-EEC3-419D-B8BA-518F4F6EDAEA}" = QBMobile "{87843A41-7808-4F2E-B13F-25C1E67CF2FD}" = ESShelp "{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}" = Bonjour "{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS "{8BB4B58A-A402-4DE8-8FCD-287E60B88DD8}" = ESSCT "{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini "{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui "{93AC2663-6946-490E-B4A4-FD126F318084}" = Atomic Pop "{95F9D960-C571-11D0-90F0-00001B1EFBA8}" = QuickBooks Pro 2001 "{9944aa9e-362d-11d3-81ab-00c04fb932ba}" = Microsoft Home Publishing 2000 "{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL "{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}" = ESScore "{A586D09E-1D2C-11D3-9A6B-00105A98B681}" = Microsoft Picture It! Express 2000 "{A5B3EB8A-4071-42F0-8E8E-7A8342AA8E69}" = ESSvpaht "{AADAC983-FDE9-42FA-8FD9-7BB324155593}" = HLPRFO "{AC4732F4-665D-4E6B-8E50-74D6B6FBE5A9}" = PassAlong Software "{AC76BA86-7AD7-1033-7B44-A71000000002}" = Adobe Reader 7.1.0 "{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK "{B40514BB-56EC-11D5-A8E1-00A0CC663B7C}" = GemMaster "{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore "{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser "{C1939820-A945-11D4-86F6-0001031E5712}" = InterVideo WinDVD "{CA60320D-6A16-49C8-A34F-84EEF4799567}" = ESSTUTOR "{CACE0C9D-9EF7-4F3B-9C64-88FBA245BA9C}" = Symnet Redirector Updater "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{D085A1B6-90A4-11D3-82B7-00C04FA309DE}" = Microsoft Money 2001 "{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software "{D9F4A9F8-92C5-4289-9D04-F0F8F02D580A}" = iPod for Windows 2005-10-12 "{DA9F6EF5-E48A-4E45-BC57-AA16193763B7}" = Detto Migration Kit "{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR "{DC1D7AD2-583A-4024-9041-387E8FFA5D8C}" = MediaFACE II "{E80D3B3D-86EE-4B6B-831B-C5B0D30F71DE}" = Microsoft Office Live Meeting 2005 "{EC4455AB-F155-4CC1-A4C5-88F3777F9886}" = Apple Mobile Device Support "{EF964A78-078C-11D1-B7A7-0000C0134CE6}" = Nortel Networks Contivity VPN Client "{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK "{F71760CD-0F8B-4DCC-B7B7-6B223CC3843C}" = OTtBP "{F8D0829C-9C6F-11D3-8080-00C04FA329AA}" = Microsoft Works 6.0 "{F958CA02-BB40-4007-894B-258729456EE4}" = QuickTime "{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS "{FAF7F1D7-C0E7-47EA-8AAA-84E4F9EA3C94}" = Works Suite OS Pack "{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock "{FDF9943A-3D5C-46B3-9679-586BD237DDEE}" = SKIN0001 "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe PageMaker 7.0" = Adobe PageMaker 7.0 "Adobe Shockwave Player" = Adobe Shockwave Player 11 "ArcSoft PhotoImpression 2000" = ArcSoft PhotoImpression 2000 "BackWeb-137903 Uninstaller" = hp center "Corel Uninstaller" = Corel Uninstaller "Coupon Printer for Windows4.0" = Coupon Printer for Windows "Direct Audio Converter & CD Ripper_is1" = Direct Audio Converter & CD Ripper 1.7 "EarthLink 5.0" = EarthLink 5.0 "Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint "Easy-WebPrint" = Easy-WebPrint "ERUNT_is1" = ERUNT 1.1j "FP35DeinstKey" = Focalpoint "F-Secure Product 444" = EMBARQ® Online Security "HP Instant Support" = HP Instant Support "HP Photo Printing Software" = HP Photo Printing Software "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "Inactive HP Printer Drivers (Remove only)" = Inactive HP Printer Drivers (Remove only) "Inactive HP ScanJet Drivers (Remove only)" = Inactive HP ScanJet Drivers (Remove only) "InstallShield_{2F151B50-B434-4838-B51D-70442EBA093E}" = OpenMG Secure Module 4.1.00 "InstallShield_{D9F4A9F8-92C5-4289-9D04-F0F8F02D580A}" = iPod for Windows 2005-10-12 "JRE 1.3.1" = Java 2 Runtime Environment Standard Edition v1.3.1 "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Max Registry Cleaner_is1" = Max Registry Cleaner "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Mozilla Firefox (3.0.8)" = Mozilla Firefox (3.0.8) "MWASPI" = MicroStaff WINASPI "mypoints" = MyPoints Toolbar "NEATO MediaFACE" = NEATO MediaFACE "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "OpenMG HotFix4.1-05-13-31-01" = OpenMG Limited Patch 4.1-05-14-24-01 "PCDoctor" = PC-Doctor for Windows "PS2" = PS2 "Python 1.5 combined Win32 extensions" = Python 1.5 combined Win32 extensions "Python 1.5.2 (final)" = Python 1.5.2 (final) "Quicken 2001 New User Edition" = Quicken 2001 New User Edition "Quicken Financial Center" = Quicken Financial Center "RealPlayer 6.0" = RealOne Player "S3 Gamma" = S3 Gamma "S3switch2" = S3 Savage4 Family Display Switch2 Utility "Scriptwriter Plus" = Scriptwriter Plus "SpywareDetector_is1" = Spyware Detector "Tcl 8.0.5 for Windows" = Tcl 8.0.5 for Windows "tv_enua" = Lernout & Hauspie TruVoice American English TTS Engine "UnityWebPlayer" = Unity Web Player "Virtools3DLifePlayer" = Virtools 3D Life Player "Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner "Windows Media Format Runtime" = Windows Media Format Runtime "Windows XP Service Pack" = Windows XP Service Pack 3 "Works2001Setup" = Microsoft Works and Money 2001 Setup Launcher "Works2kSetup" = Microsoft Works 2000 Setup Launcher "Yahoo! Companion" = Yahoo! Toolbar "Yahoo! Internet Mail" = Yahoo! Internet Mail "Yahoo! Toolbar" = Yahoo! Toolbar ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Pilot Desktop" = Palm Desktop ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 3/29/2009 10:50:09 AM | Computer Name = YOUR-ZE8CXVR8TT | Source = Application Error | ID = 1000 Description = Faulting application iexplore.exe, version 7.0.6000.16791, faulting module unknown, version 0.0.0.0, fault address 0x6e657272. Error - 3/29/2009 11:07:33 AM | Computer Name = YOUR-ZE8CXVR8TT | Source = Application Hang | ID = 1002 Description = Hanging application iexplore.exe, version 7.0.6000.16791, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 3/29/2009 11:07:33 AM | Computer Name = YOUR-ZE8CXVR8TT | Source = Application Hang | ID = 1002 Description = Hanging application iexplore.exe, version 7.0.6000.16791, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 3/29/2009 7:20:28 PM | Computer Name = YOUR-ZE8CXVR8TT | Source = F-Secure Anti-Virus | ID = 103 Description = 3 2009-03-29 19:20:27-04:00 your-ze8cxvr8tt YOUR-ZE8CXVR8TT\Owner F-Secure Anti-Virus Required database file is invalid. The scanning engine cannot start. Error - 3/30/2009 8:38:02 AM | Computer Name = YOUR-ZE8CXVR8TT | Source = Application Error | ID = 1000 Description = Faulting application iexplore.exe, version 7.0.6000.16791, faulting module jscript.dll, version 5.7.0.18066, fault address 0x0001df98. Error - 3/31/2009 6:10:43 PM | Computer Name = YOUR-ZE8CXVR8TT | Source = Application Error | ID = 1000 Description = Faulting application iexplore.exe, version 7.0.6000.16791, faulting module jscript.dll, version 5.7.0.18066, fault address 0x0001e218. Error - 3/31/2009 10:54:41 PM | Computer Name = YOUR-ZE8CXVR8TT | Source = MsiInstaller | ID = 1002 Description = Unexpected or missing value (name: 'PackageName', value: '') in key 'HKU\S-1-5-21-2210005112-1017937101-1279371858-1003\Software\Microsoft\Installer\Products\7D1F7FAF7E0CAE74A8AA484E9FAEC349\SourceList' Error - 4/2/2009 9:36:30 AM | Computer Name = YOUR-ZE8CXVR8TT | Source = Application Error | ID = 1000 Description = Faulting application iexplore.exe, version 7.0.6000.16791, faulting module flash10a.ocx, version 10.0.12.36, fault address 0x00213522. Error - 4/2/2009 9:38:08 AM | Computer Name = YOUR-ZE8CXVR8TT | Source = Application Error | ID = 1000 Description = Faulting application iexplore.exe, version 7.0.6000.16791, faulting module ntdll.dll, version 5.1.2600.5512, fault address 0x000113a0. Error - 4/2/2009 6:39:47 PM | Computer Name = YOUR-ZE8CXVR8TT | Source = Application Hang | ID = 1002 Description = Hanging application ATF_Cleaner(2).exe, version 3.0.0.2, hang module hungapp, version 0.0.0.0, hang address 0x00000000. [ System Events ] Error - 4/2/2009 9:31:24 AM | Computer Name = YOUR-ZE8CXVR8TT | Source = Dhcp | ID = 1002 Description = The IP address lease 192.168.2.2 for the Network Card with network address 00E0183B57ED has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message). Error - 4/2/2009 9:39:03 AM | Computer Name = YOUR-ZE8CXVR8TT | Source = E100B | ID = 262148 Description = Adapter Intel® PRO/100 VE Network Connection: Adapter Link Down Error - 4/2/2009 9:42:32 AM | Computer Name = YOUR-ZE8CXVR8TT | Source = Service Control Manager | ID = 7026 Description = The following boot-start or system-start driver(s) failed to load: Beep Error - 4/2/2009 9:45:13 AM | Computer Name = YOUR-ZE8CXVR8TT | Source = E100B | ID = 262148 Description = Adapter Intel® PRO/100 VE Network Connection: Adapter Link Down Error - 4/2/2009 9:45:29 AM | Computer Name = YOUR-ZE8CXVR8TT | Source = Dhcp | ID = 1002 Description = The IP address lease 192.168.2.2 for the Network Card with network address 00E0183B57ED has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message). Error - 4/2/2009 10:50:41 AM | Computer Name = YOUR-ZE8CXVR8TT | Source = E100B | ID = 262148 Description = Adapter Intel® PRO/100 VE Network Connection: Adapter Link Down Error - 4/2/2009 11:21:49 AM | Computer Name = YOUR-ZE8CXVR8TT | Source = E100B | ID = 262148 Description = Adapter Intel® PRO/100 VE Network Connection: Adapter Link Down Error - 4/2/2009 11:22:07 AM | Computer Name = YOUR-ZE8CXVR8TT | Source = Dhcp | ID = 1002 Description = The IP address lease 192.168.2.2 for the Network Card with network address 00E0183B57ED has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message). Error - 4/2/2009 7:40:17 PM | Computer Name = YOUR-ZE8CXVR8TT | Source = Service Control Manager | ID = 7026 Description = The following boot-start or system-start driver(s) failed to load: Beep Error - 4/2/2009 8:26:33 PM | Computer Name = YOUR-ZE8CXVR8TT | Source = Service Control Manager | ID = 7026 Description = The following boot-start or system-start driver(s) failed to load: Beep < End of report > This post has been edited by Enchantd1: Apr 2 2009, 07:03 PM |
 |
 
|
|
Apr 7 2009, 04:53 PM
Post
#2
|
|
 Trusted Helper  Posts: 3,969 From: The United States OS: Windows XP SP3 & Windows Vista SP1 |
Hi Enchantd1,
Welcome to Geeks to Go! My name is SpySentinel and I will be helping you fix your computer problem. Sorry for the delay, we have been very busy lately, and I apologize for your wait. Download ComboFix from one of these locations: Link 1 Link 2 Link 3 * IMPORTANT !!! Save ComboFix.exe to your Desktop
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. |
|
|
|
|
Apr 7 2009, 06:32 PM
Post
#3
|
|
|
Member Posts: 19 OS: Windows XP |
Hi
I downloaded Combofix and saved to my desktop per your instructions. I disabled my Embarq Fsecure antivirus, exited from Spywaredetector program. Then I clicked on the combofix icon to install it. I got a blue screen with a c;/command prompt icon and flashing cursor. I waited about 20 minutes to for it to install but nothing happened past the blue screen and c: command prompt icon? |
|
|
|
|
Apr 7 2009, 06:44 PM
Post
#4
|
|
|
Trusted Helper Posts: 3,969 From: The United States OS: Windows XP SP3 & Windows Vista SP1 |
Restart your computer, then go to C:\ComboFix and if there is a Log file please post it here, if not let me know.
|
|
|
|
|
Apr 8 2009, 03:30 PM
Post
#5
|
|
|
Member Posts: 19 OS: Windows XP |
Sorry for the delay. There's no log. I tried deleting and downloading Combofix again but still cant get it to install. When I click the ComboFix icon on my desktop I get the blue screen and it locks up my pc. Cant do anything else till I re-start.
Thanks Wendy |
|
|
|
|
Apr 8 2009, 03:45 PM
Post
#6
|
|
|
Trusted Helper Posts: 3,969 From: The United States OS: Windows XP SP3 & Windows Vista SP1 |
Hi Wendy, Please try running ComboFix in safe mode.
|
|
|
|
|
Apr 8 2009, 05:32 PM
Post
#7
|
|
|
Member Posts: 19 OS: Windows XP |
Took me a bit but that worked. Here's the log from Combofix:
ComboFix 09-04-04.01 - Administrator 2009-04-08 18:37:34.1 - NTFSx86 NETWORK Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.512.376 [GMT -4:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe AV: EMBARQ® Online Security 8.00 *On-access scanning disabled* (Updated) FW: EMBARQ® Online Security 8.00 *enabled* . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system\oeminfo.ini c:\windows\system32\uacinit.dll c:\windows\system32\UACpurjxoqh.db c:\windows\system32\UACrrmnesif.dat . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_UACd.sys ((((((((((((((((((((((((( Files Created from 2009-03-08 to 2009-04-08 ))))))))))))))))))))))))))))))) . 2009-04-08 17:15 . 2009-04-08 17:15 <DIR> d-------- C:\Combo-Fix 2009-04-03 18:26 . 2009-04-03 18:26 <DIR> d-------- c:\documents and settings\LocalService\Application Data\SACore 2009-04-03 18:26 . 2009-04-03 18:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\SiteAdvisor 2009-04-03 18:23 . 2009-04-03 18:23 <DIR> d-------- c:\program files\Common Files\McAfee 2009-04-03 18:21 . 2009-04-03 20:47 <DIR> d-------- c:\program files\McAfee 2009-04-03 18:21 . 2009-04-03 18:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\McAfee 2009-04-03 18:16 . 2009-04-03 18:16 59 --a------ c:\windows\einit.ini 2009-04-02 19:27 . 2009-04-02 19:27 <DIR> d-------- c:\program files\ERUNT 2009-03-31 15:26 . 2009-04-01 06:49 <DIR> d-------- c:\program files\Windows Live Safety Center 2009-03-23 10:06 . 2009-04-03 18:16 1,896,749 --a------ c:\windows\SYSTEM32\uactmp.db 2009-03-13 16:09 . 2009-03-13 16:09 <DIR> d-------- c:\program files\DrawMusic 2009-03-13 16:01 . 2009-03-13 16:05 <DIR> d-------- c:\windows\SYSTEM32\URTTemp . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-08 20:56 --------- d-----w c:\program files\Embarq Online Security 8 2009-04-07 14:16 --------- d-----w c:\program files\SpywareDetector 2009-04-03 22:16 --------- d-----w c:\program files\EarthLink 5.0 2009-03-21 16:49 --------- d-----w c:\program files\Java 2009-03-18 12:35 --------- d-----w c:\program files\Common Files\Adobe 2009-03-01 00:36 --------- d-----w c:\program files\Microsoft Home Publishing 2000 2009-02-26 16:06 --------- d-----w c:\program files\Max Registry Cleaner 2002-06-27 00:45 7,432 -c--a-w c:\program files\Ag1.exe 2008-04-14 00:12 413,696 --sha-w c:\windows\SYSTEM32\msvcp60.dll 2008-04-14 00:12 11,776 --sh--w c:\windows\SYSTEM32\regsvr32.exe 2008-09-04 07:08 32,768 --sha-w c:\windows\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090420080905\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-CEC4-75A487FD6484}] 2008-10-29 19:44 1909248 --a------ c:\progra~1\mypoints\mypoints.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{A057A204-BACC-4D26-CEC4-75A487FD6484}"= "c:\progra~1\mypoints\mypoints.dll" [2008-10-29 1909248] [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-cec4-75a487fd6484}] [HKEY_CLASSES_ROOT\mypoints.MYPOINTS] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{A057A204-BACC-4D26-CEC4-75A487FD6484}"= "c:\progra~1\mypoints\mypoints.dll" [2008-10-29 1909248] [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-cec4-75a487fd6484}] [HKEY_CLASSES_ROOT\mypoints.MYPOINTS] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736] "KBD"="c:\hp\KBD\KBD.EXE" [2001-07-06 61440] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2001-06-15 212992] "IgfxTray"="c:\windows\System32\igfxtray.exe" [2001-08-07 143360] "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2001-08-07 90112] "PS2"="c:\windows\system32\ps2.exe" [2001-07-03 81920] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "F-Secure Manager"="c:\program files\Embarq Online Security 8\Common\FSM32.EXE" [2008-09-23 182936] "F-Secure TNB"="c:\program files\Embarq Online Security 8\FSGUI\TNBUtil.exe" [2008-09-23 957024] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344] "RCAutoLiveUpdate"="c:\program files\Max Registry Cleaner\MaxLURC.exe" [2009-02-23 946048] "RCSystemTray"="c:\program files\Max Registry Cleaner\MaxRCSystemTray.exe" [2009-02-23 925568] "SDActiveMonitor"="c:\program files\SpywareDetector\SDActiveMonitor.exe" [2009-01-07 1364944] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "SRUUninstall"="c:\windows\System32\msiexec.exe" [2008-04-13 78848] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SDNotify] 2008-12-01 12:15 475136 c:\program files\SpywareDetector\SDNotify.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ SDEarlyDelete\0autocheck autochk * [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E6TaskPanel HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPGamesActiveMenu HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STOPzilla HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WT GameChannel [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-06 23:46 57344 c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-11-20 14:20 290088 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection] --------- 2000-08-15 20:25 28739 c:\program files\Microsoft Works\WkDetect.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE2] --a------ 2003-05-08 13:00 49152 c:\program files\ScanSoft\OmniPageSE2.0\opwareSE2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QAGENT] --a------ 2000-09-19 17:28 94208 c:\quickenw\qagent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer] --a------ 2006-05-31 19:54 1003520 c:\program files\Real\RealOne Player\realplay.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 01:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2003-04-12 16:20 151597 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8097:TCP"= 8097:TCP:EarthLink UHP Modem Support R0 fsbts;fsbts;c:\windows\SYSTEM32\drivers\fsbts.sys [2008-12-05 33408] R0 FSFW;F-Secure Firewall Driver;c:\windows\SYSTEM32\drivers\fsdfw.sys [2008-12-05 79904] R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\Embarq Online Security 8\HIPS\drivers\fshs.sys [2008-12-05 66720] R1 SDManager;SDManager;c:\program files\SpywareDetector\SDManager.sys [2009-01-25 13696] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-04-03 210216] R2 mrtRate;mrtRate;c:\windows\SYSTEM32\drivers\MrtRate.sys [2003-09-27 34712] R2 SDMainSvc;SDMainSvc;c:\program files\SpywareDetector\SDMainService.exe [2009-01-25 923088] R2 SDService;SDService;c:\program files\SpywareDetector\SDService.exe [2009-01-25 1713616] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\Embarq Online Security 8\Anti-Virus\minifilter\fsgk.sys [2008-12-05 84608] R3 FSORSPClient;F-Secure ORSP Client;c:\program files\Embarq Online Security 8\ORSP Client\fsorsp.exe [2008-12-05 55904] R3 SDActMon;SDActMon;c:\program files\SpywareDetector\SDActMon.sys [2009-01-25 21888] S2 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\SYSTEM32\drivers\ipsecw2k.sys [2003-04-19 113728] S3 BW2NDIS5;BW2NDIS5;c:\windows\system32\Drivers\BW2NDIS5.sys --> c:\windows\system32\Drivers\BW2NDIS5.sys [?] S3 DCamUSBSvis;Sound Vision Stream Driver;c:\windows\SYSTEM32\drivers\SvStream.sys [2002-07-05 74604] S3 NaiFiltr;NaiFiltr;c:\windows\SYSTEM32\drivers\NaiFiltr.sys [2002-06-26 23296] S3 PCDRDRV;Pcdr Helper Driver;c:\windows\system32\drivers\PCDRDRV.sys --> c:\windows\system32\drivers\PCDRDRV.sys [?] S3 PIXMCV;JVC Communication PIX-MCV Driver;c:\windows\SYSTEM32\drivers\pixmcvc.sys [2006-09-16 32000] S3 PIXMCVA;JVC PIX-MCV Audio Capture;c:\windows\SYSTEM32\drivers\pixmcva.sys [2006-09-16 28057] S3 PIXMCVV;JVC PIX-MCV Video Capture;c:\windows\SYSTEM32\drivers\pixmcvv.sys [2006-09-16 21081] S4 F-Secure Filter;F-Secure File System Filter;c:\program files\Embarq Online Security 8\Anti-Virus\win2k\fsfilter.sys [2008-12-05 39776] S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\Embarq Online Security 8\Anti-Virus\win2k\fsrec.sys [2008-12-05 25184] . Contents of the 'Scheduled Tasks' folder 2009-04-03 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] 2009-04-08 c:\windows\Tasks\Scheduled scanning task.job - c:\progra~1\EMBARQ~1\ANTI-V~1\fsav.exe [2008-09-23 09:35] . - - - - ORPHANS REMOVED - - - - WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file) MSConfigStartUp-ConMgr - c:\program files\EarthLink 5.0\ConMgr.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/yme/*http://www.yahoo.com/ext/search/search.html uInternet Settings,ProxyOverride = localhost;*.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html LSP: c:\program files\Embarq Online Security 8\FSPS\program\fslsp.dll DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\rfkbtxb2.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.myembarq.com/index.php FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-08 18:58:18 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-2210005112-1017937101-1279371858-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A8D84C33-F244-5152-3798-AFB515DE782D}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "iamfombcgkocfkddmh"=hex:64,61,68,64,6a,6f,6d,6e,00,60 "iaahggjdcaplklicmf"=hex:6a,61,68,64,69,6f,65,63,6f,6d,66,63,65,6f,64,6e,67,6b, 69,64,00,fd "hacgancdcijbpaoh"=hex:69,61,6c,64,70,62,67,6a,6f,62,69,70,68,6a,65,63,61,6e, 00,00 . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(888) c:\program files\SpywareDetector\SDNotify.dll c:\program files\Embarq Online Security 8\FWES\Program\fsdc32.dll - - - - - - - > 'lsass.exe'(944) c:\program files\Embarq Online Security 8\FWES\Program\fsdc32.dll - - - - - - - > 'csrss.exe'(864) c:\program files\Embarq Online Security 8\FWES\Program\fsdc32.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Embarq Online Security 8\Anti-Virus\fsgk32st.exe c:\program files\Embarq Online Security 8\Common\FSMA32.EXE c:\program files\Embarq Online Security 8\Anti-Virus\fsgk32.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Embarq Online Security 8\Common\FSMB32.EXE c:\program files\Embarq Online Security 8\Common\FCH32.EXE c:\windows\SYSTEM32\wdfmgr.exe c:\program files\Embarq Online Security 8\Common\FAMEH32.EXE c:\program files\Embarq Online Security 8\Anti-Virus\fsqh.exe c:\program files\Embarq Online Security 8\FSPC\fspc.exe c:\program files\Embarq Online Security 8\FSAUA\program\fsaua.exe c:\program files\Embarq Online Security 8\Anti-Virus\fssm32.exe c:\program files\Embarq Online Security 8\FWES\program\fsdfwd.exe c:\program files\Embarq Online Security 8\FSAUA\program\fsus.exe c:\progra~1\EMBARQ~1\ANTI-V~1\fsav32.exe c:\windows\SYSTEM32\wscntfy.exe c:\program files\Embarq Online Security 8\FSGUI\fsguidll.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2009-04-08 19:04:25 - machine was rebooted [Owner] ComboFix-quarantined-files.txt 2009-04-08 23:03:54 Pre-Run: 6,563,962,880 bytes free Post-Run: 5,965,230,080 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows Whistler Personal" /fastdetect /NoExecute=OptIn 247 --- E O F --- 2009-04-02 21:45:49 |
|
|
|
|
Apr 9 2009, 04:39 PM
Post
#8
|
|
|
Trusted Helper Posts: 3,969 From: The United States OS: Windows XP SP3 & Windows Vista SP1 |
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: QUOTE Collect:: c:\windows\SYSTEM32\uactmp.db RegNull:: [HKEY_USERS\S-1-5-21-2210005112-1017937101-1279371858-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A8D84C33-F244-5152-3798-AFB515DE782D}*] Save this as CFScript.txt, in the same location as ComboFix.exe  Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. |
|
|
|
|
Apr 9 2009, 05:40 PM
Post
#9
|
|
|
Member Posts: 19 OS: Windows XP |
Here ya go. Thanks again for your help. I really appreciate it!!
ComboFix 09-04-04.01 - Administrator 2009-04-09 19:18:21.2 - NTFSx86 NETWORK Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.512.373 [GMT -4:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt AV: EMBARQ® Online Security 8.00 *On-access scanning disabled* (Updated) FW: EMBARQ® Online Security 8.00 *enabled* . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\SYSTEM32\uactmp.db . ((((((((((((((((((((((((( Files Created from 2009-03-09 to 2009-04-09 ))))))))))))))))))))))))))))))) . 2009-04-09 19:08 . 2009-04-09 19:08 <DIR> d-------- C:\Combo-Fix 2009-04-03 18:26 . 2009-04-03 18:26 <DIR> d-------- c:\documents and settings\LocalService\Application Data\SACore 2009-04-03 18:26 . 2009-04-03 18:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\SiteAdvisor 2009-04-03 18:23 . 2009-04-03 18:23 <DIR> d-------- c:\program files\Common Files\McAfee 2009-04-03 18:21 . 2009-04-03 20:47 <DIR> d-------- c:\program files\McAfee 2009-04-03 18:21 . 2009-04-03 18:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\McAfee 2009-04-03 18:16 . 2009-04-03 18:16 59 --a------ c:\windows\einit.ini 2009-04-02 19:27 . 2009-04-02 19:27 <DIR> d-------- c:\program files\ERUNT 2009-03-31 15:26 . 2009-04-01 06:49 <DIR> d-------- c:\program files\Windows Live Safety Center 2009-03-13 16:09 . 2009-03-13 16:09 <DIR> d-------- c:\program files\DrawMusic 2009-03-13 16:01 . 2009-03-13 16:05 <DIR> d-------- c:\windows\SYSTEM32\URTTemp . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-09 20:49 --------- d-----w c:\program files\Embarq Online Security 8 2009-04-07 14:16 --------- d-----w c:\program files\SpywareDetector 2009-04-03 22:16 --------- d-----w c:\program files\EarthLink 5.0 2009-03-21 16:51 410,984 ----a-w c:\windows\SYSTEM32\deploytk.dll 2009-03-21 16:49 --------- d-----w c:\program files\Java 2009-03-18 12:35 --------- d-----w c:\program files\Common Files\Adobe 2009-03-01 00:36 --------- d-----w c:\program files\Microsoft Home Publishing 2000 2009-02-26 16:06 --------- d-----w c:\program files\Max Registry Cleaner 2009-02-09 11:13 1,846,784 ----a-w c:\windows\SYSTEM32\win32k.sys 2009-02-09 11:13 1,846,784 ------w c:\windows\SYSTEM32\dllcache\win32k.sys 2009-01-22 15:29 1,060,864 ----a-w c:\windows\SYSTEM32\CheckDll.dll 2009-01-17 02:35 3,594,752 ------w c:\windows\SYSTEM32\dllcache\mshtml.dll 2002-06-27 00:45 7,432 -c--a-w c:\program files\Ag1.exe 2008-04-14 00:12 413,696 --sha-w c:\windows\SYSTEM32\msvcp60.dll 2008-04-14 00:12 11,776 --sh--w c:\windows\SYSTEM32\regsvr32.exe 2008-09-04 07:08 32,768 --sha-w c:\windows\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008090420080905\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A057A204-BACC-4D26-CEC4-75A487FD6484}] 2008-10-29 19:44 1909248 --a------ c:\progra~1\mypoints\mypoints.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{A057A204-BACC-4D26-CEC4-75A487FD6484}"= "c:\progra~1\mypoints\mypoints.dll" [2008-10-29 1909248] [HKEY_CLASSES_ROOT\clsid\{a057a204-bacc-4d26-cec4-75a487fd6484}] [HKEY_CLASSES_ROOT\mypoints.MYPOINTS] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232] "MoneyStartUp"="c:\program files\Microsoft Money\System\Money Startup.exe" [2000-07-19 24625] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736] "KBD"="c:\hp\KBD\KBD.EXE" [2001-07-06 61440] "Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2001-06-15 212992] "IgfxTray"="c:\windows\System32\igfxtray.exe" [2001-08-07 143360] "HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2001-08-07 90112] "PS2"="c:\windows\system32\ps2.exe" [2001-07-03 81920] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "F-Secure Manager"="c:\program files\Embarq Online Security 8\Common\FSM32.EXE" [2008-09-23 182936] "F-Secure TNB"="c:\program files\Embarq Online Security 8\FSGUI\TNBUtil.exe" [2008-09-23 957024] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344] "RCAutoLiveUpdate"="c:\program files\Max Registry Cleaner\MaxLURC.exe" [2009-02-23 946048] "RCSystemTray"="c:\program files\Max Registry Cleaner\MaxRCSystemTray.exe" [2009-02-23 925568] "SDActiveMonitor"="c:\program files\SpywareDetector\SDActiveMonitor.exe" [2009-01-07 1364944] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "SRUUninstall"="c:\windows\System32\msiexec.exe" [2008-04-13 78848] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\SDNotify] 2008-12-01 12:15 475136 c:\program files\SpywareDetector\SDNotify.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ SDEarlyDelete\0autocheck autochk * [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] --a------ 2005-06-06 23:46 57344 c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-11-20 14:20 290088 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection] --------- 2000-08-15 20:25 28739 c:\program files\Microsoft Works\WkDetect.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE2] --a------ 2003-05-08 13:00 49152 c:\program files\ScanSoft\OmniPageSE2.0\opwareSE2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QAGENT] --a------ 2000-09-19 17:28 94208 c:\quickenw\qagent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealPlayer] --a------ 2006-05-31 19:54 1003520 c:\program files\Real\RealOne Player\realplay.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 01:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2003-04-12 16:20 151597 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "8097:TCP"= 8097:TCP:EarthLink UHP Modem Support R0 FSFW;F-Secure Firewall Driver;c:\windows\SYSTEM32\drivers\fsdfw.sys [2008-12-05 79904] R1 SDManager;SDManager;c:\program files\SpywareDetector\SDManager.sys [2009-01-25 13696] S0 fsbts;fsbts;c:\windows\SYSTEM32\drivers\fsbts.sys [2008-12-05 33408] S1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\Embarq Online Security 8\HIPS\drivers\fshs.sys [2008-12-05 66720] S2 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\SYSTEM32\drivers\ipsecw2k.sys [2003-04-19 113728] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-04-03 210216] S2 mrtRate;mrtRate;c:\windows\SYSTEM32\drivers\MrtRate.sys [2003-09-27 34712] S2 SDMainSvc;SDMainSvc;c:\program files\SpywareDetector\SDMainService.exe [2009-01-25 923088] S2 SDService;SDService;c:\program files\SpywareDetector\SDService.exe [2009-01-25 1713616] S3 BW2NDIS5;BW2NDIS5;c:\windows\system32\Drivers\BW2NDIS5.sys --> c:\windows\system32\Drivers\BW2NDIS5.sys [?] S3 DCamUSBSvis;Sound Vision Stream Driver;c:\windows\SYSTEM32\drivers\SvStream.sys [2002-07-05 74604] S3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\Embarq Online Security 8\Anti-Virus\minifilter\fsgk.sys [2008-12-05 84608] S3 FSORSPClient;F-Secure ORSP Client;c:\program files\Embarq Online Security 8\ORSP Client\fsorsp.exe [2008-12-05 55904] S3 NaiFiltr;NaiFiltr;c:\windows\SYSTEM32\drivers\NaiFiltr.sys [2002-06-26 23296] S3 PCDRDRV;Pcdr Helper Driver;c:\windows\system32\drivers\PCDRDRV.sys --> c:\windows\system32\drivers\PCDRDRV.sys [?] S3 PIXMCV;JVC Communication PIX-MCV Driver;c:\windows\SYSTEM32\drivers\pixmcvc.sys [2006-09-16 32000] S3 PIXMCVA;JVC PIX-MCV Audio Capture;c:\windows\SYSTEM32\drivers\pixmcva.sys [2006-09-16 28057] S3 PIXMCVV;JVC PIX-MCV Video Capture;c:\windows\SYSTEM32\drivers\pixmcvv.sys [2006-09-16 21081] S3 SDActMon;SDActMon;c:\program files\SpywareDetector\SDActMon.sys [2009-01-25 21888] S4 F-Secure Filter;F-Secure File System Filter;c:\program files\Embarq Online Security 8\Anti-Virus\win2k\fsfilter.sys [2008-12-05 39776] S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\Embarq Online Security 8\Anti-Virus\win2k\fsrec.sys [2008-12-05 25184] --- Other Services/Drivers In Memory --- *NewlyCreated* - DCFS2K . Contents of the 'Scheduled Tasks' folder 2009-04-03 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] 2009-04-09 c:\windows\Tasks\Scheduled scanning task.job - c:\progra~1\EMBARQ~1\ANTI-V~1\fsav.exe [2008-09-23 09:35] . . ------- Supplementary Scan ------- . uStart Page = file://C:/HP/REGION/start.html mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/yme/*http://www.yahoo.com/ext/search/search.html uInternet Connection Wizard,ShellNext = hxxp://securityresponse.symantec.com/avcenter/cgi-bin/virauto.cgi?vid=49030 LSP: c:\program files\Embarq Online Security 8\FSPS\program\fslsp.dll DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\yhg27n4m.default\ FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-09 19:21:40 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(780) c:\program files\SpywareDetector\SDNotify.dll . Completion time: 2009-04-09 19:23:54 ComboFix-quarantined-files.txt 2009-04-09 23:23:36 ComboFix2.txt 2009-04-08 23:04:27 Pre-Run: 6,515,277,824 bytes free Post-Run: 6,488,649,728 bytes free 184 --- E O F --- 2009-04-02 21:45:49 |
|
|
|
|
Apr 9 2009, 06:29 PM
Post
#10
|
|
|
Trusted Helper Posts: 3,969 From: The United States OS: Windows XP SP3 & Windows Vista SP1 |
You're welcome
 Launch Malwarebytes' Anti-Malware
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Please click here to download AVP Tool by Kaspersky.
After that click on Security level then choose Customize then click on the tab that says Heuristic Analyzer then choose Enable Deep rootkit search then choose ok. Then choose OK again then you are back to the main screen.
|
|
|
|
|
Apr 12 2009, 03:31 PM
Post
#11
|
|
|
Member Posts: 19 OS: Windows XP |
Hi There
Sorry for the delay I've been out of town for a few days. I have the MBAM log but couldn't get the Kapersky program to work. I downloaded it and then booted to safe mode to install. It installed but then the program wouldn't run. Got an error box that said there's a problem and Kapersky needs to close. Here's the MBAM log Malwarebytes' Anti-Malware 1.36 Database version: 1959 Windows 5.1.2600 Service Pack 3 2009-04-09 21:54:32 mbam-log-2009-04-09 (21-54-32).txt Scan type: Quick Scan Objects scanned: 75237 Time elapsed: 12 minute(s), 22 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\SYSTEM32\UACvetjqawf.log (Trojan.Agent) -> Quarantined and deleted successfully. |
|
|
|
|
Apr 13 2009, 12:35 PM
Post
#12
|
|
|
Trusted Helper Posts: 3,969 From: The United States OS: Windows XP SP3 & Windows Vista SP1 |
Hi Enchantd1,
QUOTE Sorry for the delay I've been out of town for a few days. No problem, I have been away for Easter as well. Download and scan with SUPERAntiSpyware Free for Home Users
|
|
|
|
|
Apr 14 2009, 03:19 PM
Post
#13
|
|
|
Member Posts: 19 OS: Windows XP |
Hi Spy Sentinel,
Hope you had a nice Easter . Here's the log from SuperAntiSpywareUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 04/13/2009 at 10:49 PM Application Version : 4.26.1000 Core Rules Database Version : 3841 Trace Rules Database Version: 1796 Scan type : Complete Scan Total Scan Time : 05:14:37 Memory items scanned : 515 Memory threats detected : 0 Registry items scanned : 6218 Registry threats detected : 0 File items scanned : 101794 File threats detected : 136 Adware.Tracking Cookie C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato@earthlink.net\Cookies\owner@insightexpressai[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@112.2o7[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@2o7[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ad.musicmatch[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@adcache.bargaintraderonline[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@adcache.boattraderonline[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@adcache.collectorcartraderonline[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@adcache.cycletrader[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@adcache.equipmenttraderonline[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@adcache.trucktraderonline[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@admarketplace[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@adopt.specificclick[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@adorigin[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@adrevolver[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ads.as4x.tmcs.ticketmaster[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ads.as4x.tmcs[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ads.businessweek[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ads.cdnow[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ads.traderonline[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ads.vnuemedia[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ads4.clearchannel[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@adultplatinum[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@adv.webmd[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@advertising[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@anad.tacoda[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@anat.tacoda[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@apmebf[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@bfast[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@bizrate[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@bravenet[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@burstnet[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@buycom.122.2o7[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@c5.zedo[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@casalemedia[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@cbs.112.2o7[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@chat.ticketsnow[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@clickability[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@clickbank[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@commission-junction[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@counter.hitslink[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@crossmediaservices[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@data.coremetrics[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@data1.perf.overture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@data3.perf.overture[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@data4.perf.overture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@dealtime[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wfk4qgdpmkp.stats.esomniture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wfkiumdjsaq.stats.esomniture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wfliehczwep.stats.esomniture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wflighcjobq.stats.esomniture[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wflookdjokq.stats.esomniture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wgkiwodzefo.stats.esomniture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wjkycpcpckp.stats.esomniture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wjkygpdjiep.stats.esomniture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wjl4enajsgo.stats.esomniture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wjl4unazsko.stats.esomniture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wjligndjcep.stats.esomniture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wjliwjczsbp.stats.esomniture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wjlykkdjafo.stats.esomniture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wjlywodjifo.stats.esomniture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wjmyaodzigp.stats.esomniture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wjmykjcjofo.stats.esomniture[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@e-2dj6wjnywmd5mdq.stats.esomniture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@edge.ru4[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-attworldnet.hitbox[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-babyuniverse.hitbox[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-bestbuy.hitbox[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-buytelco.hitbox[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-clearchannel.hitbox[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-dig.hitbox[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-directv.hitbox[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-etoys.hitbox[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-inforspaceinc.hitbox[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-melbourneit.hitbox[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-nissan.hitbox[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-theviptour.hitbox[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-traderelectronicmedia.hitbox[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-traderpublishing.hitbox[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-wachovia.hitbox[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-youtube.hitbox[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ehg-zentropypartners.hitbox[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@fastclick[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@find.intelius[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@findwhat[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@furniturefind[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@hc2.humanclick[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@hitbox[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@host-d.oddcast[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@icc.intellisrv[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@indextools[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@insightexpress[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@jbhumphreys.tripod[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@keywordmax[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@media.fastclick[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@media3.sitebrand[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@mediamgr.ugo[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@media[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@media[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@nextag[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@overture[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@perf.overture[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@phg.hitbox[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@pro-market[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@pt.crossmediaservices[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@qksrv[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@razorgator.122.2o7[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@realmedia[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@revsci[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@roiservice[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@sales.liveperson[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@servedby.advertising[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@server.iad.liveperson[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@stat.dealtime[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@stat.onestat[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@stats.crossmediaservices[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@stats.klsoft[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@statse.webtrendslive[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@tacoda[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@teens.real-top[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@test.coremetrics[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@ticketsnow[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@tracking.thunderdownloads[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@traffic[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@tribalfusion[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@tripod.lycos[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@tripod[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@web4.realtracker[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@windowsmedia[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@wTracker[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@www.buildersdiscount[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@www.clickmanage[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@www.ticketsnow1[1].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@www.ticketsnow2[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@www.ticketsnow[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato1@earthlink.net\Cookies\owner@zedo[2].txt C:\Documents and Settings\Owner\Application Data\Earthlink\6.0\mwcato@earthlink.net\Cookies\owner@advertising[1].txt |
|
|
|
|
Apr 15 2009, 01:44 PM
Post
#14
|
|
|
Trusted Helper Posts: 3,969 From: The United States OS: Windows XP SP3 & Windows Vista SP1 |
QUOTE Hi Spy Sentinel, Hope you had a nice Easter It was nice, thank you. How was yours? Looks like SUPER AntiSpyware only picked up tracking cookies. Here is a way to help prevent tracking cookies from installing on your computer. Disable Tracking Cookies
How is your computer running? Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only
Under Main choose: Select All Click the Empty Selected button.
Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. For Technical Support, double-click the e-mail address located at the bottom of each menu. Your Adobe Acrobat Reader is out of date. Older versions are vulnerable to attack. Please go to the link below to update. http://www.adobe.com/products/acrobat/readstep2.html |
|
|
|
|
Apr 15 2009, 03:15 PM
Post
#15
|
|
|
Member Posts: 19 OS: Windows XP |
My Easter Holiday was fun. We took the kids to the beach for a few days
I did the ATF Cleaner and also updated my Adobe Reader. My computer seems to be running much better and I dont get the redirecting to ad sites any longer. Guess all is ok now? |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
Similar Topics
| Topic Title | Replies / Views | Topic Information | |||||
|---|---|---|---|---|---|---|---|
 |
15 / 834 | 13th November 2005 - 07:28 PM dabomb7612 started - last by Trevuren |
|||||
 |
8 / 1,858 | 19th January 2006 - 11:24 AM HarryT started - last by OwNt |
|||||
|
0 / 280 | 25th January 2007 - 12:22 PM Nancyblues21 started - last by Nancyblues21 |
|||||
|
14 / 228 | 17th May 2009 - 10:23 AM mattpoole started - last by andrewuk |
|||||
|
Time is now: 21st November 2009 - 04:50 AM |
Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks mentioned on this page are the property of their respective owners.
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy | Advertising