Automatic updates turning off and pop ups! |
![]() ![]() |
Automatic updates turning off and pop ups! |
Jul 5 2008, 02:54 AM
Post
#1
|
|
|
New Member ![]() Posts: 7 OS: xp home edition |
ComboFix 08-07-04.3 - Jonah & Elizabeth 2008-07-05 4:00:36.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.609 [GMT -4:00] Running from: C:\Documents and Settings\Jonah & Elizabeth\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Jonah & Elizabeth\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\cookies.ini C:\WINDOWS\system32\avunculx.dll C:\WINDOWS\system32\BKknmnmp.ini C:\WINDOWS\system32\BKknmnmp.ini2 C:\WINDOWS\system32\ecbvmo.dll C:\WINDOWS\system32\fdxmcrnc.dll C:\WINDOWS\system32\gmwtbkgu.ini C:\WINDOWS\system32\iiffeBUn.dll C:\WINDOWS\system32\kbgoen.dll C:\WINDOWS\system32\khjfabqf.ini C:\WINDOWS\system32\kwtdadao.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\oadadtwk.dll C:\WINDOWS\system32\pmnmnkKB.dll C:\WINDOWS\system32\pmnnKASk.dll C:\WINDOWS\system32\qmvqgdvs.dll . ((((((((((((((((((((((((( Files Created from 2008-06-05 to 2008-07-05 ))))))))))))))))))))))))))))))) . 2008-07-04 03:15 . 2008-07-04 03:15 <DIR> d-------- C:\Program Files\Lavasoft 2008-07-04 03:15 . 2008-07-04 03:15 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-07-04 02:57 . 2008-07-04 02:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-07-04 02:50 . 2008-07-04 02:50 <DIR> d-------- C:\Documents and Settings\Jonah & Elizabeth\Application Data\McAfee 2008-07-04 02:46 . 2008-07-04 02:46 <DIR> d-------- C:\WINDOWS\system32\URTTEMP 2008-07-03 23:03 . 2008-07-05 04:09 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-07-03 23:03 . 2008-07-03 23:03 1,409 --a------ C:\WINDOWS\QTFont.for 2008-07-03 21:24 . 2008-07-03 21:24 1,694,256 --ahs---- C:\WINDOWS\system32\gmwtbkgu.tmp 2008-06-10 16:16 . 2008-06-13 07:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-10 16:16 . 2008-05-08 10:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys 2008-06-05 00:29 . 2008-06-05 00:30 <DIR> d-------- C:\Program Files\LimeWire . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-05 07:17 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-04 07:47 --------- d-----w C:\Program Files\Common Files\Webroot Shared 2008-07-04 07:03 --------- d-----w C:\Program Files\McAfee 2008-07-04 06:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee 2008-07-04 04:31 --------- d-----w C:\Program Files\Windows Live 2008-07-03 01:36 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\Apple Computer 2008-06-29 22:11 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\Azureus 2008-06-29 20:43 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-06-27 04:25 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\LimeWire 2008-06-17 21:18 --------- d-----w C:\Program Files\Azureus 2008-06-13 11:05 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys 2008-06-03 17:27 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-05-29 22:15 --------- d-----w C:\Program Files\Apple Software Update 2008-05-29 16:56 --------- d-----w C:\Program Files\MagicISO 2008-05-29 16:55 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition 2008-05-29 16:49 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-05-29 16:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-05-29 16:42 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\Media Player Classic 2008-05-29 16:31 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-05-29 16:28 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-05-29 16:28 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\DAEMON Tools 2008-05-29 16:18 --------- d-----w C:\Program Files\ImgBurn 2008-05-29 16:18 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\ImgBurn 2008-05-23 06:14 --------- d-----w C:\Program Files\AWS 2008-05-23 06:14 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\WeatherBug 2008-05-23 06:10 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\Viewpoint 2008-05-23 06:04 --------- d-----w C:\Program Files\iTunes 2008-05-23 06:04 --------- d-----w C:\Program Files\iPod 2008-05-23 06:03 --------- d-----w C:\Program Files\QuickTime 2008-05-23 06:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-05-23 06:01 --------- d-----w C:\Program Files\Common Files\Apple 2008-05-23 06:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple 2008-05-23 05:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Webroot 2008-05-23 05:45 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\MSN6 2008-05-23 05:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\MSN6 2008-05-23 05:34 --------- d-----w C:\Program Files\Diskeeper Corporation 2008-05-23 05:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Diskeeper Corporation 2008-05-23 05:23 --------- d-----w C:\Program Files\McAfee.com 2008-05-23 05:23 --------- d-----w C:\Program Files\Common Files\McAfee 2008-05-23 05:12 --------- d-----w C:\Program Files\K-Lite Codec Pack 2008-05-23 05:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL OCP 2008-05-23 05:00 --------- d-----w C:\Program Files\AIM6 2008-05-23 05:00 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\acccore 2008-05-23 04:59 --------- d-----w C:\Program Files\Viewpoint 2008-05-23 04:59 --------- d-----w C:\Program Files\Common Files\AOL 2008-05-23 04:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-05-23 04:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Azureus 2008-05-23 04:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL 2008-05-23 04:57 --------- d-----w C:\Program Files\Java 2008-05-23 04:56 --------- d-----w C:\Program Files\Common Files\Java 2008-05-23 02:57 --------- d-----w C:\Program Files\Webroot 2008-05-23 02:57 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\Webroot 2008-05-23 02:49 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-05-23 02:48 --------- d-----w C:\Program Files\Creative 2008-05-23 02:48 --------- d-----w C:\Documents and Settings\Jonah & Elizabeth\Application Data\Creative 2008-05-23 02:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Creative 2008-05-23 02:38 --------- d-----w C:\Program Files\Analog Devices 2008-05-23 02:36 --------- d-----w C:\Program Files\Intel 2008-05-23 02:02 558,142 ----a-w C:\WINDOWS\java\Packages\E607ZH7Z.ZIP 2008-05-23 02:02 155,995 ----a-w C:\WINDOWS\java\Packages\NDBNNLVL.ZIP 2008-05-23 02:02 --------- d-----w C:\Program Files\microsoft frontpage 2008-05-16 15:58 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe 2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-14 09:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll 2008-04-14 09:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe 2008-04-14 09:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll 2008-04-14 00:25 1,804 ----a-w C:\WINDOWS\system32\dcache.bin 2008-04-14 00:16 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe 2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll 2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll 2008-04-14 00:13 299,520 ----a-w C:\WINDOWS\system32\drmclien.dll 2008-04-14 00:13 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll 2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\msgina.dll 2008-04-14 00:10 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll 2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll 2008-04-14 00:10 3,584 ----a-w C:\WINDOWS\system32\msafd.dll 2008-04-13 21:00 103,424 ----a-w C:\WINDOWS\system32\dpcdll.dll 2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys 2008-04-13 19:27 2,188,928 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-04-13 18:44 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys 2008-04-13 18:35 24,064 ----a-w C:\WINDOWS\system32\pidgen.dll 2008-04-13 18:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll 2008-04-13 18:31 2,065,792 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-04-13 18:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll 2008-04-13 18:14 76,800 ----a-w C:\WINDOWS\system32\msshavmsg.dll 2008-04-13 17:39 438,784 ----a-w C:\WINDOWS\system32\xpob2res.dll 2008-04-13 17:39 2,897,920 ----a-w C:\WINDOWS\system32\xpsp2res.dll 2008-04-13 17:39 187,392 ----a-w C:\WINDOWS\system32\xpsp1res.dll 2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll 2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll 2008-04-13 17:27 79,872 ----a-w C:\WINDOWS\system32\msxml6r.dll 2008-04-13 17:26 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll 2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll 2008-04-13 17:24 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll 2008-04-13 17:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll 2008-04-13 17:09 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll 2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Window Washer"="C:\Program Files\Webroot\Washer\wwDisp.exe" [2007-11-26 14:47 1206600] "Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-03-25 16:21 50528] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184] "Weather"="C:\Program Files\AWS\WeatherBug\Weather.exe" [2007-08-29 10:55 1347584] "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 05:39 486856] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 20:12 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-04-04 13:38 774144] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112] "Jet Detection"="C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 01:00 28672] "CTStartup"="C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" [2001-12-20 01:00 28672] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-02-24 09:32 5537792] "NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-02-24 09:32 86016] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 19:12 582992] "McENUI"="C:\PROGRA~1\McAfee\MHN\McENUI.exe" [2007-11-30 05:42 1164576] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "McAfee Backup"="C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe" [2007-01-16 13:59 4838952] "MBkLogOnHook"="C:\Program Files\McAfee\MBK\LogOnHook.exe" [2007-01-08 11:22 20480] "WINDVDPatch"="CTHELPER.EXE" [2002-07-02 05:56 24576 C:\WINDOWS\system32\CTHELPER.EXE] "nwiz"="nwiz.exe" [2005-02-24 09:32 1495040 C:\WINDOWS\system32\nwiz.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.ctmp3"= C:\WINDOWS\System32\ctmp3.acm "VIDC.YV12"= yv12vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Azureus\\Azureus.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\AIM6\\aim6.exe"= "C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38] R2 wwEngineSvc;Window Washer Engine;C:\Program Files\Webroot\Washer\WasherSvc.exe [2007-11-26 14:47] . Contents of the 'Scheduled Tasks' folder "2008-07-03 02:14:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-05-23 05:23:22 C:\WINDOWS\Tasks\McDefragTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe' "2008-07-01 05:00:06 C:\WINDOWS\Tasks\McQcTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe . - - - - ORPHANS REMOVED - - - - BHO-{01667648-9237-4a62-a863-6120f5842639} - C:\WINDOWS\system32\kbgoen.dll BHO-{427B37EF-B6C5-4823-A97C-10B88977E398} - C:\WINDOWS\system32\pmnnKASk.dll BHO-{7D162D68-AD16-49EF-9BD6-0C29525D53EC} - C:\WINDOWS\system32\pmnmnkKB.dll HKLM-Run-84578c55 - C:\WINDOWS\system32\oadadtwk.dll HKLM-Run-TCASUTIEXE - TCAUDIAG.exe ShellExecuteHooks-{427B37EF-B6C5-4823-A97C-10B88977E398} - C:\WINDOWS\system32\pmnnKASk.dll ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-05 04:08:13 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run CTStartup = C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run???h??????s?????\?w? ?w???????w???w4???????.??w4???????4???TA?s4????????&3?????\??? ??? ???\???\???????????5?B~e?B~\???\?????????a??????C@?\???\??????s????\??????s\????&3?A??s?&3??C@?x???`|?w\?????@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> ?:\WINDOWS\system32\SETUPAPI.dll -> ?:\WINDOWS\System32\msvcp60.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\CTSVCCDA.EXE C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\McAfee\MBK\MBackMonitor.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe C:\PROGRA~1\COMMON~1\McAfee\MNA\McNASvc.exe C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe C:\Program Files\McAfee\MPF\MpfSrv.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\McAfee\MSK\msksrver.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\WINDOWS\system32\MsPMSPSv.exe C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2008-07-05 4:10:56 - machine was rebooted ComboFix-quarantined-files.txt 2008-07-05 08:10:45 Pre-Run: 141,152,575,488 bytes free Post-Run: 141,100,892,160 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 262 --- E O F --- 2008-07-05 07:26:57 |
|
|
Jul 5 2008, 07:01 AM
Post
#2
|
|
![]() GeekU Teacher Posts: 21,815 From: Dublin OS: XP |
Don't post multiple topics
DO NOT run tools like ComboFix unless a helper tells you to |
|
|
![]() ![]() |
Similar Topics
| Topic Title | Replies / Views | Topic Information | |||||
|---|---|---|---|---|---|---|---|
![]() |
6 / 649 | 12th July 2008 - 07:09 AM skywitit23 started - last by Essexboy |
|||||
![]() |
1 / 159 | 5th July 2008 - 01:29 PM skywitit23 started - last by Essexboy |
|||||
![]() |
3 / 204 | 28th August 2008 - 07:00 AM gary_gaz started - last by IndiGenus |
|||||
![]() |
2 / 143 | 7th December 2008 - 04:11 AM Nemesis2k44 started - last by fenzodahl512 |
|||||
|
Time is now: 7th January 2009 - 03:00 PM |
| Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. |