Google/Yahoo Redirect (Overclick.cn) [Solved] |
Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!
|
|
  |
 Jun 12 2009, 05:46 PM
Post
#1
|
|
|
New Member  Posts: 6 OS: Windows XP  |
Hello, I have had a problem with Google/Yahoo Redirects in Firefox and would be very grateful for any help you could provide. To summarize: 1) When I click on Google or Yahoo search results, I am sometimes redirected elsewhere - ie, wallpaperswoman.com. I have since installed NoScript for Firefox, which blocks "http://overclick.cn/...." (.... is a long alphanumeric) which appears to be common to all the redirects. Google Chrome does not seem to have the Redirect problem. I do not know if IE is affected. 2) The problem began after I had an attack on my computer. My Adobe Acrobat attempted to load on its own and Norton Antivirus blocked 2 viruses: Backdoor.Tidserve and Bloodhound.Exploit.196. I also noticed my printer status display loaded itself. My actions so far: 1) Downloaded and installed NoScript. Updated Adobe Acrobat and Disabled Javascript. 2) I followed the Malware/Spyware Guide: -MBAM/Antivirus found no Wares or Viruses. -The Logs for MBAM, Rooter, and OTL are below. -The Redirects have continued. Other notes: My problems seem similar to the one under discussion here: http://www.geekstogo.com/forum/Google-hija...01-t241510.html. Any suggestions or help you could provide me would be great. Thank you in advance! Malwarebytes' Anti-Malware 1.37 Database version: 2268 Windows 5.1.2600 Service Pack 3 6/12/2009 3:39:59 PM mbam-log-2009-06-12 (15-39-59).txt Scan type: Quick Scan Objects scanned: 95272 Time elapsed: 3 minute(s), 12 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Rooter.exe (v1.0) by Eric_71 ¨ Microsoft Windows XP Professional (5.1.2600) Service Pack 3 32_bits - x86 Family 6 Model 15 Stepping 11, GenuineIntel ¨ C:\ [Fixed-NTFS] .. ( Total:88527 Mo - Free:37004 Mo ) D:\ [CD_Rom] ¨ Scan : 16:25.41 Path : C:\Documents and Settings\Robert Chang\Desktop\Rooter.exe User : Robert Chang ( Administrator -> YES ) ¨ ----------------------\\ Processes ¨ Locked [System Process] (0) ______ System (4) ______ \SystemRoot\System32\smss.exe (792) ______ \??\C:\WINDOWS\system32\csrss.exe (840) ______ \??\C:\WINDOWS\system32\winlogon.exe (872) ______ C:\WINDOWS\system32\services.exe (924) ______ C:\WINDOWS\system32\lsass.exe (936) ______ C:\WINDOWS\system32\ibmpmsvc.exe (1112) ______ C:\WINDOWS\system32\svchost.exe (1144) ______ C:\WINDOWS\system32\svchost.exe (1372) ______ C:\WINDOWS\System32\svchost.exe (1436) ______ C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe (1468) ______ C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (1568) ______ C:\WINDOWS\system32\svchost.exe (1636) ______ C:\WINDOWS\system32\svchost.exe (1736) ______ C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (1800) ______ C:\WINDOWS\system32\spoolsv.exe (288) ______ C:\WINDOWS\system32\svchost.exe (412) ______ C:\WINDOWS\system32\IPSSVC.EXE (488) ______ C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (644) ______ C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (668) ______ C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (740) ______ C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe (772) ______ C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (832) ______ C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (1224) ______ C:\WINDOWS\runservice.exe (1288) ______ C:\WINDOWS\system32\nvsvc32.exe (1332) ______ C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (1584) ______ C:\WINDOWS\system32\svchost.exe (2980) ______ C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe (3020) ______ C:\WINDOWS\System32\TPHDEXLG.exe (3068) ______ C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe (3112) ______ C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe (3160) ______ C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe (3208) ______ c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe (3252) ______ C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe (3296) ______ C:\WINDOWS\system32\wdfmgr.exe (3352) ______ C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe (3416) ______ C:\Program Files\Common Files\Lenovo\Logger\logmon.exe (3420) ______ c:\program files\lenovo\system update\suservice.exe (3484) ______ C:\WINDOWS\Explorer.EXE (3588) ______ C:\WINDOWS\system32\wuauclt.exe (3800) ______ C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe (3940) ______ C:\WINDOWS\System32\alg.exe (2372) ______ C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe (2756) ______ C:\WINDOWS\system32\rundll32.exe (2832) ______ C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (2820) ______ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (2876) ______ C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe (3260) ______ C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (2972) ______ C:\WINDOWS\system32\TpShocks.exe (2928) ______ C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe (3748) ______ C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe (3772) ______ C:\Program Files\Analog Devices\Core\smax4pnp.exe (3968) ______ C:\Program Files\Lenovo\Zoom\TpScrex.exe (1220) ______ C:\WINDOWS\system32\RUNDLL32.EXE (4008) ______ C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe (3872) ______ C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe (3828) ______ C:\WINDOWS\System32\DLA\DLACTRLW.EXE (3188) ______ C:\WINDOWS\system32\rundll32.exe (3980) ______ C:\Program Files\Lenovo\AwayTask\AwaySch.EXE (2960) ______ C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe (1480) ______ C:\Program Files\ThinkVantage\AMSG\Amsg.exe (1268) ______ C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe (1004) ______ C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe (2364) ______ C:\Program Files\Lenovo\Client Security Solution\cssauth.exe (2148) ______ C:\Program Files\Players\Winamp\winampa.exe (4048) ______ C:\WINDOWS\system32\MSTMON_Q.EXE (2384) ______ C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (2292) ______ C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe (2464) ______ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (2184) ______ C:\WINDOWS\system32\ctfmon.exe (228) ______ C:\Program Files\Common Files\Installshield\UpdateService\ISUSPM.exe (4084) ______ C:\Documents and Settings\Robert Chang\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (2260) ______ C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (4204) ______ C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (4280) ______ C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe (4316) ______ C:\Program Files\Digital Line Detect\DLG.exe (4344) ______ C:\Program Files\Palm\Hotsync.exe (4376) ______ C:\Program Files\Lenovo\Client Security Solution\tvtpwm_tray.exe (4512) ______ C:\Program Files\Sprint\Sprint SmartView\SprintSV.exe (4552) ______ C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe (4584) ______ C:\Program Files\Sprint\Sprint SmartView\RcAppSvc.exe (4632) ______ C:\WINDOWS\system32\wbem\wmiprvse.exe (4672) ______ C:\Program Files\Sprint\Sprint SmartView\SwiApiMuxCdma.exe (5064) ______ C:\WINDOWS\system32\wbem\unsecapp.exe (5128) ______ C:\Documents and Settings\Robert Chang\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (3364) ______ C:\Documents and Settings\Robert Chang\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (352) ______ C:\Documents and Settings\Robert Chang\Desktop\ZMUD2\Zmud.exe (4372) ______ C:\Documents and Settings\Robert Chang\Desktop\Rooter.exe (5404) ¨ ----------------------\\ Device\Harddisk0\ ¨ \Device\Harddisk0 [Sectors : 63 x 512 Bytes] ¨ \Device\Harddisk0\Partition1 --[ MBR ]-- (Start_Offset:32256 | Length:92827574784) \Device\Harddisk0\Partition2 (Start_Offset:92827607040 | Length:7199539200) ¨ ----------------------\\ Scheduled Tasks ¨ C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job C:\WINDOWS\Tasks\desktop.ini C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2050315434-2678734953-2199075136-1005.job C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Robert Chang.job C:\WINDOWS\Tasks\PMTask.job C:\WINDOWS\Tasks\SA.DAT C:\WINDOWS\Tasks\WGASetup.job ¨ ----------------------\\ Registry ¨ ¨ ----------------------\\ Files & Folders ¨ ----------------------\\ Scan completed at 16:26.51 ¨ C:\Rooter$\Rooter_1.txt - (12/06/2009 | 16:26.51) OTL logfile created on: 6/12/2009 4:31:16 PM - Run 1 OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\Robert Chang\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1.97 Gb Total Physical Memory | 1.17 Gb Available Physical Memory | 59.35% Memory free 3.81 Gb Paging File | 3.08 Gb Available in Paging File | 80.66% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 86.45 Gb Total Space | 36.14 Gb Free Space | 41.80% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: RHYDDERCH Current User Name: Robert Chang Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Minimal File Age = 30 Days Company Name Whitelist: On ========== Processes (SafeList) ========== PRC - C:\WINDOWS\system32\ibmpmsvc.exe (Lenovo) PRC - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.) PRC - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation ) PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation) PRC - C:\WINDOWS\system32\IPSSVC.EXE (Lenovo Group Limited) PRC - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (Lenovo ) PRC - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation) PRC - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) PRC - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe (Diskeeper Corporation) PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation) PRC - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo) PRC - C:\WINDOWS\runservice.exe () PRC - C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation) PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation) PRC - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe (Lenovo Group Limited) PRC - C:\WINDOWS\System32\TPHDEXLG.exe (Lenovo.) PRC - C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe (IBM) PRC - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe () PRC - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe (Lenovo Group Limited) PRC - c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe (Lenovo Group Limited) PRC - C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe () PRC - C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation) PRC - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe (Lenovo ) PRC - C:\Program Files\Common Files\Lenovo\Logger\logmon.exe () PRC - c:\program files\lenovo\system update\suservice.exe (Lenovo Group Limited) PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation) PRC - C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe (Diskeeper Corporation) PRC - C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe (Lenovo ) PRC - C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) PRC - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.) PRC - C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe (Lenovo Group Limited) PRC - C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited) PRC - C:\WINDOWS\system32\TpShocks.exe (Lenovo.) PRC - C:\Program Files\ThinkPad\Utilities\EZEJMNAP.EXE (Lenovo Group Ltd.) PRC - C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe (Lenovo Group Limited) PRC - C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.) PRC - C:\Program Files\Lenovo\Zoom\TpScrex.exe (Lenovo Group Limited) PRC - C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited) PRC - C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe (Sun Microsystems, Inc.) PRC - C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions) PRC - C:\Program Files\Lenovo\AwayTask\AwaySch.EXE (Lenovo Group Limited) PRC - C:\Program Files\ThinkVantage\PrdCtr\LPMGR.EXE (Lenovo Group Limited) PRC - C:\Program Files\ThinkVantage\AMSG\Amsg.exe (LENOVO) PRC - C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe (Lenovo ) PRC - C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe (Lenovo ) PRC - C:\Program Files\Lenovo\Client Security Solution\cssauth.exe (Lenovo Group Limited) PRC - C:\Program Files\Players\Winamp\winampa.exe () PRC - C:\WINDOWS\system32\MSTMON_Q.EXE (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.) PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation) PRC - C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited) PRC - C:\Program Files\Common Files\Installshield\UpdateService\ISUSPM.exe (Macrovision Corporation) PRC - C:\Documents and Settings\Robert Chang\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.) PRC - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.) PRC - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.) PRC - C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe (DataViz, Inc.) PRC - C:\Program Files\Digital Line Detect\DLG.exe (Avanquest Software ) PRC - C:\Program Files\Palm\Hotsync.exe (PalmSource, Inc) PRC - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_tray.exe (Lenovo Group Limited) PRC - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe () PRC - C:\WINDOWS\system32\wbem\wmiprvse.exe (Microsoft Corporation) PRC - C:\Documents and Settings\Robert Chang\Desktop\OTL.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (AcPrfMgrSvc [Auto | Running]) -- C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe (Lenovo ) SRV - (AcSvc [Auto | Running]) -- C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe (Lenovo ) SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation) SRV - (Automatic LiveUpdate Scheduler [Auto | Running]) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe (Symantec Corporation) SRV - (btwdins [Auto | Running]) -- C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe (Broadcom Corporation.) SRV - (ccEvtMgr [Auto | Running]) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation) SRV - (ccSetMgr [Auto | Running]) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation) SRV - (clr_optimization_v2.0.50727_32 [Auto | Running]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (CLTNetCnService [Auto | Running]) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation) SRV - (comHost [On_Demand | Stopped]) -- C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe (Symantec Corporation) SRV - (Diskeeper [Auto | Running]) -- C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe (Diskeeper Corporation) SRV - (EvtEng [Auto | Running]) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation) SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) SRV - (gusvc [On_Demand | Stopped]) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google) SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation) SRV - (IBMPMSVC [Auto | Running]) -- C:\WINDOWS\system32\ibmpmsvc.exe (Lenovo) SRV - (IDriverT [On_Demand | Stopped]) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation) SRV - (idsvc [Unknown | Stopped]) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation) SRV - (IPSSVC [Auto | Running]) -- C:\WINDOWS\system32\IPSSVC.EXE (Lenovo Group Limited) SRV - (IviRegMgr [Auto | Running]) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo) SRV - (LicCtrlService [Auto | Running]) -- C:\WINDOWS\runservice.exe () SRV - (LiveUpdate [On_Demand | Stopped]) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE (Symantec Corporation) SRV - (LiveUpdate Notice [Auto | Running]) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation) SRV - (NetTcpPortSharing [Disabled | Stopped]) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation) SRV - (NVSvc [Auto | Running]) -- C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation) SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (RegSrvc [Auto | Running]) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation) SRV - (Roxio UPnP Renderer 9 [On_Demand | Stopped]) -- C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe (Sonic Solutions) SRV - (Roxio Upnp Server 9 [Auto | Stopped]) -- C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe (Sonic Solutions) SRV - (RoxLiveShare9 [Auto | Stopped]) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (Sonic Solutions) SRV - (RoxMediaDB9 [On_Demand | Stopped]) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (Sonic Solutions) SRV - (RoxWatch9 [Auto | Stopped]) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (Sonic Solutions) SRV - (S24EventMonitor [Auto | Running]) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation ) SRV - (SprintRcAppSvc [On_Demand | Stopped]) -- C:\Program Files\Sprint\Sprint SmartView\RcAppSvc.exe (PCTEL) SRV - (SUService [Auto | Running]) -- c:\program files\lenovo\system update\suservice.exe (Lenovo Group Limited) SRV - (Symantec Core LC [On_Demand | Running]) -- C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe () SRV - (ThinkVantage Registry Monitor Service [Auto | Running]) -- C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe (Lenovo Group Limited) SRV - (TPHDEXLGSVC [Auto | Running]) -- C:\WINDOWS\System32\TPHDEXLG.exe (Lenovo.) SRV - (TSSCoreService [Auto | Running]) -- C:\Program Files\Lenovo\Client Security Solution\tvttcsd.exe (IBM) SRV - (TVT Backup Protection Service [Auto | Running]) -- C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe () SRV - (TVT Backup Service [Auto | Running]) -- C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe (Lenovo Group Limited) SRV - (TVT Scheduler [Auto | Running]) -- c:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe (Lenovo Group Limited) SRV - (tvtnetwk [Auto | Running]) -- C:\Program Files\Lenovo\Rescue and Recovery\ADM\IUService.exe () SRV - (UMWdf [Auto | Running]) -- C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation) SRV - (WMConnectCDS [On_Demand | Stopped]) -- C:\Program Files\Windows Media Connect 2\wmccds.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (ac97intc [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\ac97intc.sys (Intel Corporation) DRV - (ADIHdAudAddService [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\ADIHdAud.sys (Analog Devices, Inc.) DRV - (AEAudio [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\AEAudio.sys (Andrea Electronics Corporation) DRV - (AegisP [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\AegisP.sys (Cisco Systems, Inc.) DRV - (AliIde [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.) DRV - (amdagp [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.) DRV - (ANC [System | Running]) -- C:\WINDOWS\System32\drivers\ANC.SYS (IBM Corp.) DRV - (asc [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.) DRV - (asc3550 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.) DRV - (atmeltpm [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\atmeltpm.sys (Atmel, Inc.) DRV - (BTKRNL [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\btkrnl.sys (Broadcom Corporation.) DRV - (CmdIde [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.) DRV - (COH_Mon [On_Demand | Stopped]) -- C:\WINDOWS\system32\Drivers\COH_Mon.sys (Symantec Corporation) DRV - (CO_Mon [Auto | Running]) -- C:\WINDOWS\system32\drivers\CO_Mon.sys (Symantec Corporation) DRV - (dac2w2k [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation) DRV - (DLABOIOM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLABOIOM.SYS (Sonic Solutions) DRV - (DLACDBHM [System | Running]) -- C:\WINDOWS\System32\Drivers\DLACDBHM.SYS (Sonic Solutions) DRV - (DLADResN [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLADResN.SYS (Sonic Solutions) DRV - (DLAIFS_M [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAIFS_M.SYS (Sonic Solutions) DRV - (DLAOPIOM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAOPIOM.SYS (Sonic Solutions) DRV - (DLAPoolM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAPoolM.SYS (Sonic Solutions) DRV - (DLARTL_N [System | Running]) -- C:\WINDOWS\System32\Drivers\DLARTL_N.SYS (Sonic Solutions) DRV - (DLAUDFAM [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAUDFAM.SYS (Sonic Solutions) DRV - (DLAUDF_M [Auto | Running]) -- C:\WINDOWS\System32\DLA\DLAUDF_M.SYS (Sonic Solutions) DRV - (DRVMCDB [Boot | Running]) -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions) DRV - (DRVNDDM [Auto | Running]) -- C:\WINDOWS\System32\Drivers\DRVNDDM.SYS (Sonic Solutions) DRV - (E100B [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\e100b325.sys (Intel Corporation) DRV - (e1express [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\e1e5132.sys (Intel Corporation) DRV - (eeCtrl [System | Running]) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation) DRV - (EraserUtilRebootDrv [On_Demand | Running]) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation) DRV - (HDAudBus [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider) DRV - (HSFHWAZL [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HSFHWAZL.sys (Conexant Systems, Inc.) DRV - (HSF_DPV [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys (Conexant Systems, Inc.) DRV - (iaStor [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\iaStor.sys (Intel Corporation) DRV - (IBMPMDRV [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys (Lenovo.) DRV - (IBMTPCHK [System | Running]) -- C:\WINDOWS\system32\Drivers\IBMBLDID.sys () DRV - (Iviaspi [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\iviaspi.sys (InterVideo, Inc.) DRV - (mdmxsdk [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys (Conexant) DRV - (MLPTDR_Q [Auto | Stopped]) -- C:\WINDOWS\system32\MLPTDR_Q.SYS (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.) DRV - (motmodem [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\motmodem.sys (Motorola) DRV - (mraid35x [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.) DRV - (NAVENG [On_Demand | Running]) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090612.003\NAVENG.SYS (Symantec Corporation) DRV - (NAVEX15 [On_Demand | Running]) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090612.003\NAVEX15.SYS (Symantec Corporation) DRV - (NETw4x32 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\NETw4x32.sys (Intel Corporation) DRV - (Nmea [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\pctnullport.sys (PCTEL Inc.) DRV - (nv [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys (NVIDIA Corporation) DRV - (NWADI [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\NWADIenum.sys (Novatel Wireless Inc) DRV - (PalmUSBD [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\PalmUSBD.sys (PalmSource, Inc.) DRV - (PCASp50 [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\PCASp50.sys (Printing Communications Assoc., Inc. (PCAUSA)) DRV - (PCTINDIS5 [On_Demand | Running]) -- C:\WINDOWS\system32\PCTINDIS5.SYS (PCTEL Inc.) DRV - (pmem [Auto | Running]) -- C:\WINDOWS\System32\drivers\pmemnt.sys (Microsoft Corporation) DRV - (PROCDD [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\PROCDD.SYS (Lenovo Group Limited) DRV - (psadd [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\psadd.sys (Lenovo (United States) Inc.) DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.) DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions) DRV - (ql1080 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation) DRV - (ql12160 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation) DRV - (ql1280 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation) DRV - (rimmptsk [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\rimmptsk.sys (REDC) DRV - (rimsptsk [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\rimsptsk.sys (REDC) DRV - (RimUsb [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\RimUsb.sys (Research In Motion Limited) DRV - (RimVSerPort [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\RimSerial.sys (Research in Motion Ltd) DRV - (rismxdp [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\rixdptsk.sys (REDC) DRV - (ROOTMODEM [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\RootMdm.sys (Microsoft Corporation) DRV - (s24trans [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\s24trans.sys (Intel Corporation) DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - (Shockprf [Boot | Running]) -- C:\WINDOWS\System32\DRIVERS\Apsx86.sys (Lenovo.) DRV - (sisagp [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation) DRV - (smihlp [Auto | Running]) -- C:\Program Files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys (UPEK Inc.) DRV - (Sparrow [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.) DRV - (SPBBCDrv [System | Running]) -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation) DRV - (SRTSP [System | Running]) -- C:\WINDOWS\System32\Drivers\SRTSP.SYS (Symantec Corporation) DRV - (SRTSPL [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\SRTSPL.SYS (Symantec Corporation) DRV - (SRTSPX [System | Running]) -- C:\WINDOWS\System32\Drivers\SRTSPX.SYS (Symantec Corporation) DRV - (swmsflt [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\swmsflt.sys () DRV - (swmx00 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\swmx00.sys (Sierra Wireless Inc.) DRV - (SWNC5E00 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\SWNC5E00.sys (Sierra Wireless Inc.) DRV - (symc810 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.) DRV - (symc8xx [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic) DRV - (SYMDNS [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\SYMDNS.SYS (Symantec Corporation) DRV - (SymEvent [On_Demand | Running]) -- C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Corporation) DRV - (SYMFW [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\SYMFW.SYS (Symantec Corporation) DRV - (SYMIDS [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\SYMIDS.SYS (Symantec Corporation) DRV - (SYMIDSCO [On_Demand | Running]) -- C:\Program Files\Common Files\Symantec Shared\SymcData\ipsdefs\20090610.001\SymIDSCo.sys (Symantec Corporation) DRV - (SymIM [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\SymIM.sys (Symantec Corporation) DRV - (SymIMMP [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\SymIM.sys (Symantec Corporation) DRV - (SYMNDIS [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\SYMNDIS.SYS (Symantec Corporation) DRV - (SYMREDRV [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation) DRV - (SYMTDI [System | Running]) -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation) DRV - (sym_hi [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic) DRV - (sym_u3 [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic) DRV - (SynTP [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\SynTP.sys (Synaptics, Inc.) DRV - (TcUsb [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\tcusb.sys (UPEK Inc.) DRV - (TPDIGIMN [Boot | Running]) -- C:\WINDOWS\System32\DRIVERS\ApsHM86.sys (Lenovo.) DRV - (TPHKDRV [System | Running]) -- C:\WINDOWS\system32\DRIVERS\TPHKDRV.sys (IBM Corporation) DRV - (TPPWRIF [System | Running]) -- C:\WINDOWS\System32\drivers\Tppwrif.sys () DRV - (TSMAPIP [System | Running]) -- C:\WINDOWS\System32\drivers\TSMAPIP.SYS () DRV - (tvtfilter [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\tvtfilter.sys (Lenovo) DRV - (TVTI2C [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\Tvti2c.sys (Lenovo (United States) Inc.) DRV - (TVTPktFilter [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\tvtpktfilter.sys (Lenovo Group Limited) DRV - (ultra [Disabled | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.) DRV - (winachsf [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys (Conexant Systems, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/welcome/thinkpad [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://lenovo.live.com IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/" FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:3.0.4 FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.3.3 FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.0 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.11 FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\ [2009/06/12 16:13:15 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/06/11 23:52:22 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/06/12 10:24:39 | 00,000,000 | ---D | M] [2008/06/19 22:45:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Robert Chang\Application Data\mozilla\Extensions [2008/06/19 22:45:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Robert Chang\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/06/12 16:24:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Robert Chang\Application Data\mozilla\Firefox\Profiles\ds66xba3.default\extensions [2009/06/12 02:25:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Robert Chang\Application Data\mozilla\Firefox\Profiles\ds66xba3.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232} [2008/06/19 23:44:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Robert Chang\Application Data\mozilla\Firefox\Profiles\ds66xba3.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2008/06/19 22:45:13 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2009/06/11 23:52:20 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/06/11 23:52:16 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009/06/11 23:52:16 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2008/09/28 10:09:49 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml [2008/09/28 10:09:49 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml [2008/09/28 10:09:49 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml [2008/11/13 22:57:00 | 00,002,343 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml [2008/09/28 10:09:49 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2008/09/28 10:09:49 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml [2008/09/28 10:09:49 | 00,000,792 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml O1 HOSTS File: (734 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL (Sonic Solutions) O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll (Symantec Corporation) O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Common Files\Symantec Shared\IDS\IPSBHO.dll (Symantec Corporation) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll () O2 - BHO: (Windows Live Toolbar Helper) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O2 - BHO: (CPwmIEBrowserHelper Object) - {F040E541-A427-4CF7-85D8-75E3E0F476C5} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll () O3 - HKLM\..\Toolbar: (Show Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (Windows Live Toolbar) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll () O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll (Symantec Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (Microsoft Corporation) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe (Lenovo ) O4 - HKLM..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe (Lenovo ) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" (Adobe Systems Incorporated) O4 - HKLM..\Run: [AMSG] C:\Program Files\ThinkVantage\AMSG\Amsg.exe /startup (LENOVO) O4 - HKLM..\Run: [AwaySch] C:\Program Files\Lenovo\AwayTask\AwaySch.EXE (Lenovo Group Limited) O4 - HKLM..\Run: [BlackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background (Research In Motion Limited) O4 - HKLM..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog () O4 - HKLM..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" (Symantec Corporation) O4 - HKLM..\Run: [cssauth] "C:\Program Files\Lenovo\Client Security Solution\cssauth.exe" silent (Lenovo Group Limited) O4 - HKLM..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" (Diskeeper Corporation) O4 - HKLM..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE (Sonic Solutions) O4 - HKLM..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe (Lenovo Group Ltd.) O4 - HKLM..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup (Macrovision Corporation) O4 - HKLM..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start (Macrovision Corporation) O4 - HKLM..\Run: [KONICA MINOLTA PagePro 1350WStatusDisplay] C:\WINDOWS\system32\MSTMON_Q.EXE (KONICA MINOLTA BUSINESS TECHNOLOGIES, INC.) O4 - HKLM..\Run: [LPManager] C:\PROGRA~1\THINKV~1\PrdCtr\LPMGR.exe (Lenovo Group Limited) O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect File not found O4 - HKLM..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe" (Symantec Corporation) O4 - HKLM..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor (Lenovo Group Limited) O4 - HKLM..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" (Sonic Solutions) O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray (Analog Devices, Inc.) O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.) O4 - HKLM..\Run: [Sprint SmartView] "C:\Program Files\Sprint\Sprint SmartView\SprintSV.exe" -a (Sprint) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.) O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) O4 - HKLM..\Run: [TPFNF7] C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe /r (Lenovo Group Limited) O4 - HKLM..\Run: [TPHOTKEY] C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe (Lenovo Group Limited) O4 - HKLM..\Run: [TpShocks] TpShocks.exe (Lenovo.) O4 - HKLM..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe (Lenovo Group Limited) O4 - HKLM..\Run: [WinampAgent] "C:\Program Files\Players\Winamp\winampa.exe" () O4 - HKCU..\Run: [Google Update] "C:\Documents and Settings\Robert Chang\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c (Google Inc.) O4 - HKCU..\Run: [ISUSPM] "C:\Program Files\Common Files\Installshield\UpdateService\ISUSPM.exe" -scheduler (Macrovision Corporation) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe (Adobe Systems Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk = C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe (DataViz, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (Avanquest Software ) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe (PalmSource, Inc) O4 - Startup: C:\Documents and Settings\Robert Chang\Start Menu\Programs\Startup\Palm Registration.lnk = C:\Program Files\Palm\register.exe (Palm/Leader Technologies) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm (Microsoft Corporation) O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation) O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm () O9 - Extra 'Tools' menuitem : ThinkVantage Password Manager... - {0045D4BC-5189-4b67-969C-83BB1906C421} - C:\Program Files\Lenovo\Client Security Solution\tvtpwm_ie_com.dll (Lenovo Group Limited) O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll (Sun Microsystems, Inc.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_06) O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_06) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_06) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\ACNotify: DllName - ACNotify.dll - C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll (Lenovo ) O20 - Winlogon\Notify\psfus: DllName - C:\WINDOWS\system32\psqlpwd.dll - C:\WINDOWS\system32\psqlpwd.dll (UPEK Inc.) O20 - Winlogon\Notify\tpfnf2: DllName - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll - C:\Program Files\Lenovo\HOTKEY\notifyf2.dll () O20 - Winlogon\Notify\tphotkey: DllName - C:\Program Files\Lenovo\HOTKEY\tphklock.dll - C:\Program Files\Lenovo\HOTKEY\tphklock.dll () O24 - Desktop Components:0 (My Current Home Page) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/04/30 00:13:35 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{e233fbde-56a5-11de-9565-ba2317ddabe8}\Shell - "" = AutoRun O33 - MountPoints2\{e233fbde-56a5-11de-9565-ba2317ddabe8}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{e233fbde-56a5-11de-9565-ba2317ddabe8}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - * [2009/06/12 16:23:52 | 00,000,000 | ---D | M] ========== Files/Folders - Created Within 30 Days ========== [9 C:\Documents and Settings\Robert Chang\Desktop\*.tmp files] [2009/06/12 16:26:51 | 00,000,000 | ---D | C] -- C:\Rooter$ [2009/06/12 16:11:57 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\XPSViewer [2009/06/12 16:11:53 | 00,000,000 | ---D | C] -- C:\Program Files\MSBuild [2009/06/12 16:11:45 | 00,000,000 | ---D | C] -- C:\Program Files\Reference Assemblies [2009/06/12 16:11:12 | 01,676,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpssvcs.dll [2009/06/12 16:11:12 | 01,676,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xpssvcs.dll [2009/06/12 16:11:12 | 00,597,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\printfilterpipelinesvc.exe [2009/06/12 16:11:12 | 00,575,488 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpsshhdr.dll [2009/06/12 16:11:12 | 00,575,488 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xpsshhdr.dll [2009/06/12 16:11:12 | 00,117,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\prntvpt.dll [2009/06/12 16:11:12 | 00,089,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\filterpipelineprintproc.dll [2009/06/12 16:11:12 | 00,000,000 | ---D | C] -- C:\3386f24233a1474bdb9ba9e0 [2009/06/12 16:09:00 | 00,000,000 | -HSD | C] -- C:\Config.Msi [2009/06/12 16:06:09 | 00,012,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xpshims.dll [2009/06/12 16:06:08 | 00,246,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieproxy.dll [2009/06/12 16:06:05 | 00,000,000 | ---D | C] -- C:\WINDOWS\ie8updates [2009/06/12 16:05:56 | 00,102,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iecompat.dll [2009/06/12 16:04:18 | 00,000,000 | -H-D | C] -- C:\WINDOWS\ie8 [2009/06/12 15:35:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Robert Chang\Application Data\Malwarebytes [2009/06/12 15:35:51 | 00,040,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009/06/12 15:35:50 | 00,019,096 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009/06/12 15:35:50 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009/06/12 15:35:50 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2009/06/12 15:35:10 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2009/06/12 15:34:28 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT [2009/06/12 15:32:26 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Robert Chang\Desktop\DownL [2009/06/12 15:15:56 | 00,501,760 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Robert Chang\Desktop\OTL.exe [2009/06/12 15:15:44 | 00,128,933 | ---- | C] (Eric_71) -- C:\Documents and Settings\Robert Chang\Desktop\Rooter.exe [2009/06/12 10:44:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Robert Chang\My Documents\Downloads [2009/06/12 10:41:33 | 00,000,954 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2050315434-2678734953-2199075136-1005.job [2009/06/11 09:35:34 | 00,000,000 | ---D | C] -- C:\Program Files\InterMute [2009/06/05 17:22:01 | 00,011,959 | ---- | C] () -- C:\Documents and Settings\Robert Chang\Desktop\Notes 3.rtf [2009/06/05 12:54:01 | 00,012,820 | ---- | C] () -- C:\Documents and Settings\Robert Chang\Desktop\Notes 2.rtf [2009/06/03 03:52:16 | 00,026,514 | ---- | C] () -- C:\Documents and Settings\Robert Chang\Desktop\Notes.rtf [2009/05/28 20:56:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Robert Chang\Desktop\KH2 [2009/05/25 14:16:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Robert Chang\Desktop\Wave 9 [2009/05/14 12:33:06 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Robert Chang\Desktop\Art of MPoc [2009/05/14 05:15:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Robert Chang\Desktop\Encounters [2008/10/15 12:58:34 | 00,024,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\swmsflt.sys [2008/08/24 23:24:08 | 00,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll [2008/08/24 23:24:08 | 00,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll [2008/08/24 23:24:08 | 00,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll [2008/07/19 23:53:07 | 00,000,818 | ---- | C] () -- C:\WINDOWS\GMUD.INI [2008/07/19 23:34:13 | 00,001,177 | -HS- | C] () -- C:\WINDOWS\System32\mmf.sys [2008/07/19 23:34:12 | 00,049,152 | ---- | C] () -- C:\WINDOWS\mmfs.dll [2008/07/15 07:53:42 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [2008/06/28 20:22:08 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2008/06/21 22:05:58 | 00,001,066 | ---- | C] () -- C:\WINDOWS\GMUD32.INI [2008/06/17 00:16:40 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2008/06/17 00:07:39 | 00,004,224 | ---- | C] () -- C:\WINDOWS\System32\drivers\IBMBLDID.sys [2008/06/17 00:02:26 | 00,000,126 | ---- | C] () -- C:\WINDOWS\wininit.ini [2008/06/17 00:01:01 | 00,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2008/06/17 00:01:01 | 00,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2008/06/17 00:01:01 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2008/06/17 00:01:01 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2008/06/17 00:01:01 | 00,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2008/06/17 00:01:01 | 00,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2008/06/16 23:54:27 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2008/06/16 23:54:26 | 01,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2008/06/16 23:54:26 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2008/06/16 23:54:25 | 01,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2008/06/16 23:50:01 | 00,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\TSMAPIP.SYS [2008/06/16 23:48:16 | 09,598,080 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys [2008/06/16 23:48:16 | 00,167,936 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll [2008/06/16 23:48:16 | 00,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll [2008/06/16 23:48:16 | 00,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini [2008/06/16 23:46:48 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\SynTPCoI.dll [2008/06/16 23:45:23 | 00,004,442 | ---- | C] () -- C:\WINDOWS\System32\drivers\TPPWRIF.SYS [2007/07/26 23:37:40 | 00,025,269 | ---- | C] () -- C:\WINDOWS\System32\PROCDB.INI [2007/07/26 23:37:29 | 00,000,380 | ---- | C] () -- C:\WINDOWS\System32\IPSCtrl.INI [2007/02/27 17:48:38 | 02,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll [2007/02/27 17:29:32 | 00,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll [2007/01/16 08:12:12 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2006/09/05 14:20:36 | 00,079,400 | ---- | C] () -- C:\WINDOWS\System32\DEVMAN.DLL [2006/04/30 00:31:51 | 00,004,670 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2006/04/30 00:22:10 | 00,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini [2006/04/29 23:56:08 | 00,000,631 | ---- | C] () -- C:\WINDOWS\win.ini [2006/04/29 23:56:05 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini [2005/02/17 11:41:32 | 00,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest [2005/02/17 11:41:30 | 00,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest [2004/11/18 21:10:42 | 00,014,740 | ---- | C] () -- C:\WINDOWS\MSTMON_Q.INI [2004/11/18 21:10:42 | 00,011,521 | ---- | C] () -- C:\WINDOWS\MSUMLT_Q.INI [2003/01/07 15:05:08 | 00,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2001/11/14 12:56:00 | 01,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll ========== Files - Modified Within 30 Days ========== [9 C:\Documents and Settings\Robert Chang\Desktop\*.tmp files] [2009/06/12 16:31:01 | 00,000,268 | ---- | M] () -- C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job [2009/06/12 16:24:05 | 00,001,177 | -HS- | M] () -- C:\WINDOWS\System32\mmf.sys [2009/06/12 16:22:52 | 00,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job [2009/06/12 16:22:34 | 00,000,316 | ---- | M] () -- C:\WINDOWS\tasks\PMTask.job [2009/06/12 16:22:23 | 00,025,269 | ---- | M] () -- C:\WINDOWS\System32\PROCDB.INI [2009/06/12 16:21:39 | 00,000,083 | -HS- | M] () -- C:\Documents and Settings\Robert Chang\My Documents\desktop.ini [2009/06/12 16:20:30 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Robert Chang\Local Settings\desktop.ini [2009/06/12 16:20:14 | 00,000,380 | ---- | M] () -- C:\WINDOWS\System32\IPSCtrl.INI [2009/06/12 16:20:12 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009/06/12 16:20:01 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009/06/12 16:19:53 | 00,267,696 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009/06/12 16:19:52 | 21,121,39264 | -HS- | M] () -- C:\hiberfil.sys [2009/06/12 16:16:19 | 00,506,068 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/06/12 16:16:19 | 00,444,596 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009/06/12 16:16:19 | 00,072,306 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2009/06/12 16:06:08 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2009/06/12 15:47:03 | 00,002,278 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009/06/12 15:16:24 | 00,501,760 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Robert Chang\Desktop\OTL.exe [2009/06/12 15:16:04 | 00,128,933 | ---- | M] (Eric_71) -- C:\Documents and Settings\Robert Chang\Desktop\Rooter.exe [2009/06/12 10:41:33 | 00,000,954 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-2050315434-2678734953-2199075136-1005.job [2009/06/12 03:10:46 | 00,000,636 | ---- | M] () -- C:\WINDOWS\tasks\Norton Internet Security - Run Full System Scan - Robert Chang.job [2009/06/11 14:14:14 | 00,012,613 | ---- | M] () -- C:\Documents and Settings\Robert Chang\Desktop\Schedule.rtf [2009/06/09 17:46:39 | 00,000,754 | ---- | M] () -- C:\WINDOWS\WORDPAD.INI [2009/06/06 06:51:05 | 00,011,959 | ---- | M] () -- C:\Documents and Settings\Robert Chang\Desktop\Notes 3.rtf [2009/06/05 13:57:20 | 00,012,820 | ---- | M] () -- C:\Documents and Settings\Robert Chang\Desktop\Notes 2.rtf [2009/06/03 06:21:03 | 00,026,514 | ---- | M] () -- C:\Documents and Settings\Robert Chang\Desktop\Notes.rtf [2009/06/01 20:54:13 | 00,019,102 | ---- | M] () -- C:\Documents and Settings\Robert Chang\Desktop\PC Logs.rtf [2009/06/01 09:51:12 | 23,635,392 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe [2009/05/30 05:55:54 | 00,000,757 | ---- | M] () -- C:\Documents and Settings\Robert Chang\Start Menu\Programs\Startup\Palm Registration.lnk [2009/05/26 13:20:08 | 00,040,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009/05/26 13:19:56 | 00,019,096 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009/05/25 14:11:38 | 00,004,675 | ---- | M] () -- C:\Documents and Settings\Robert Chang\Desktop\Electives.rtf < End of report > OTL Extras logfile created on: 6/12/2009 4:31:16 PM - Run 1 OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\Robert Chang\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 1.97 Gb Total Physical Memory | 1.17 Gb Available Physical Memory | 59.35% Memory free 3.81 Gb Paging File | 3.08 Gb Available in Paging File | 80.66% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 86.45 Gb Total Space | 36.14 Gb Free Space | 41.80% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: RHYDDERCH Current User Name: Robert Chang Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Minimal File Age = 30 Days Company Name Whitelist: On ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = ChromeHTML] -- Reg Error: Key error. File not found ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile "EnableFirewall" = 0 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 "10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Connect "10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Connect "10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Connect "10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Connect "10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Connect "10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Connect ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] C:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III (Blizzard Entertainment) C:\Program Files\Sprint\Sprint SmartView\SwiApiMux.exe:*:Enabled:SwiApiMux (Sierra Wireless, Inc.) %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{034E061B-B3A3-4123-842E-10C1B6B3C8C7}" = BlackBerry Desktop Software 4.7 "{075473F5-846A-448B-BCB3-104AA1760205}" = RecordNow Data "{0BE3B033-FC8D-4810-AFBA-F488B1BAE99D}" = Symantec Real Time Storage Protection Component "{0FFD55FA-40CE-4B7F-9001-A06930C63FA2}" = Sprint SmartView "{1007F41F-7D69-468E-8017-3849A5A973C2}" = ThinkVantage Technologies Welcome Message "{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA "{1297C681-92D7-40EF-93BF-03F66EC5105C}" = ThinkPad EasyEject Utility "{17CBC505-D1AE-459D-B445-3D2000A85842}" = ThinkPad UltraNav Utility "{1B5983B7-4D7A-4AD6-9260-DDA07A58BE2F}" = SymNet "{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager "{31478BE1-CDE5-4753-A8B2-F6D4BC1FBE09}" = Component Framework "{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6 "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Integrated Camera "{41894269-0DD1-4C85-B3DD-1EB41B07621D}" = ThinkVantage Fingerprint Software 5.6 "{46A84694-59EC-48F0-964C-7E76E9F8A2ED}" = ThinkVantage Active Protection System "{51BA0AFE-6AA5-4B8C-8BA9-FA6AE5B1EEE0}" = Roxio Media Manager "{55A6283C-638A-4EE0-B491-51118554BDA2}" = Norton Confidential Core "{59F6A514-9813-47A3-948C-8A155460CC2A}" = RICOH R5C83x/84x Flash Media Controller Driver Ver.3.52.02 "{62120008-8E1E-4807-860D-A8B48F8552DB}" = Norton Protection Center "{65706020-7B6F-41F2-8047-FC69579E386A}" = Presentation Director "{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler "{69333A04-5134-40A5-A055-9166A7AA1EC8}" = "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{77772678-817F-4401-9301-ED1D01A8DA56}" = SPBBC 32bit "{77FFBA7E-0973-4F39-BBDB-AC2F537578D2}" = Norton AntiVirus "{796E076A-82F7-4D49-98C8-DEC0C3BC733A}" = Diskeeper Lite "{7EB114D8-207F-45AE-BABD-1669715F2630}" = ThinkVantage Access Connections "{7FC3BBEC-5A91-41B0-9CB8-960EC4421411}" = InterVideo WinDVD Creator 3 "{84814E6B-2581-46EC-926A-823BD1C670F6}" = ThinkPad Bluetooth with Enhanced Data Rate Software "{8675339C-128C-44DD-83BF-0A5D6ABD8297}" = System Update "{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr "{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD "{986F64DC-FF15-449D-998F-EE3BCEC6666A}" = Help Center "{A0E64EBA-8BF0-49FB-90C0-BB3D781A2016}" = ThinkPad Power Manager "{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}" = mDriver "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = RecordNow Audio "{AC76BA86-1033-0000-7760-000000000001}" = Adobe Acrobat 6.0 Professional "{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2 "{ADAED43C-BBD9-42C5-8B21-F4FBFA81E3C3}" = Palm "{B12665F4-4E93-4AB4-B7FC-37053B524629}" = RecordNow Copy "{B24E05CC-46FF-4787-BBB8-5CD516AFB118}" = ccCommon "{B334D9AE-1393-423E-97C0-3BDC3360E692}" = Sonic Icons for Lenovo "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C1C185CA-C531-49F5-A6FA-B838405A049D}" = Norton Internet Security "{C54ED2B6-1AF2-416F-BBA8-5E2B8CDCB5C4}" = XP Themes "{C6876FE6-A314-4628-B0D7-F3EE5E35C4B4}" = Windows Live Toolbar "{C6FA39A7-26B1-480A-BC74-6D17531AC222}" = Access Help "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{CF5737AF-8550-4546-A69B-0EA9EF5A9B55}" = ThinkVantage Productivity Center "{D728E945-256D-4477-B377-6BBA693714AC}" = Productivity Center Supplement for ThinkPad "{DB71210F-8314-4AE3-B7A7-EBAF85BD30E9}" = Wallpapers "{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}" = Norton AntiVirus Help "{E7E836B8-4BDD-454F-82E6-5FEA17C83AD4}" = Message Center "{E80F62FF-5D3C-4A19-8409-9721F2928206}" = LiveUpdate (Symantec Corporation) "{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore "{EB807EB6-5179-48B7-98D4-7B4934A57A81}" = Documents To Go "{EFB21DE7-8C19-4A88-BB28-A766E16493BC}" = Adobe Photoshop CS "{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}" = AppCore "{F055E1B2-8A05-4D87-8039-1BE979BA4193}" = Client Security Solution "{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX "{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse "{F151F2B3-0C32-44D3-90E2-E639B8024622}" = Rescue and Recovery "{F18DB86D-BC16-4E01-BCCE-63F62B931D82}" = InterVideo Register Manager "{F445476A-42DE-11D4-80D0-00C04F2750A6}" = Epocrates Essentials "{F705E3E1-A471-426B-9A09-73429F3418EE}" = System Migration Assistant "{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "AwayTask" = Maintenance Manager "BlackBerry_{034E061B-B3A3-4123-842E-10C1B6B3C8C7}" = BlackBerry Desktop Software 4.7 "CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_10140588" = ThinkPad Modem "Diablo" = Diablo "Diablo II" = Diablo II "ERUNT_is1" = ERUNT 1.1j "FLV Player" = FLV Player 2.0, build 24 "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie7" = Windows Internet Explorer 7 "ie8" = Windows Internet Explorer 8 "KONICA MINOLTA PagePro 1350W" = KONICA MINOLTA PagePro 1350W "Lenovo Registration" = Lenovo Registration "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Mozilla Firefox (3.0.11)" = Mozilla Firefox (3.0.11) "MSNINST" = MSN "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "NVIDIA Drivers" = NVIDIA Drivers "OnScreenDisplay" = On Screen Display "PC-Doctor 5 for Windows" = PC-Doctor 5 for Windows "PCMCIAPW" = ThinkPad PC Card Power Policy "Picasa2" = Picasa 2 "Power Management Driver" = ThinkPad Power Management Driver "ProInst" = Intel® PROSet/Wireless Software "PROSet" = Intel® PRO Network Connections Drivers "PsuedoLiveUpdate" = LiveUpdate (Symantec Corporation) "Remove Multimedia Center" = Remove Multimedia Center "SymSetup.{C1C185CA-C531-49F5-A6FA-B838405A049D}" = Norton Internet Security (Symantec Corporation) "SynTPDeinstKey" = ThinkPad UltraNav Driver "Terragen" = Terragen "ThinkPad FullScreen Magnifier" = ThinkPad FullScreen Magnifier "VLC media player" = VideoLAN VLC media player 0.8.6i "Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5 "Winamp" = Winamp "Windows Live Toolbar" = Windows Live Toolbar "Windows Media Format Runtime" = Windows Media Format Runtime "Windows XP Service Pack" = Windows XP Service Pack 3 "WinRAR archiver" = WinRAR archiver "WMCSetup" = Windows Media Connect ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Diablo" = Diablo "Google Chrome" = Google Chrome "IAM's Fantasy Card Editor v1.0" = IAM's Fantasy Card Editor v1.0 "Usmleworld Step2 QBank" = Usmleworld Step2 QBank "Warcraft III" = Warcraft III: All Products ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 6/11/2009 1:01:21 AM | Computer Name = RHYDDERCH | Source = Application Hang | ID = 1002 Description = Hanging application firefox.exe, version 1.9.0.3399, hang module hungapp, version 0.0.0.0, hang address 0x00000000. [ System Events ] Error - 6/11/2009 12:32:24 PM | Computer Name = RHYDDERCH | Source = Service Control Manager | ID = 7009 Description = Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher 9 service to connect. Error - 6/12/2009 1:22:44 PM | Computer Name = RHYDDERCH | Source = Service Control Manager | ID = 7000 Description = The Parallel port driver service failed to start due to the following error: %%1058 Error - 6/12/2009 1:22:44 PM | Computer Name = RHYDDERCH | Source = Service Control Manager | ID = 7002 Description = The MLPTDR_Q service depends on the Parallel arbitrator group and no member of this group started. Error - 6/12/2009 1:22:44 PM | Computer Name = RHYDDERCH | Source = Service Control Manager | ID = 7009 Description = Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher 9 service to connect. Error - 6/12/2009 6:24:05 PM | Computer Name = RHYDDERCH | Source = Service Control Manager | ID = 7000 Description = The Parallel port driver service failed to start due to the following error: %%1058 Error - 6/12/2009 6:24:05 PM | Computer Name = RHYDDERCH | Source = Service Control Manager | ID = 7002 Description = The MLPTDR_Q service depends on the Parallel arbitrator group and no member of this group started. Error - 6/12/2009 6:24:05 PM | Computer Name = RHYDDERCH | Source = Service Control Manager | ID = 7009 Description = Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher 9 service to connect. Error - 6/12/2009 7:21:43 PM | Computer Name = RHYDDERCH | Source = Service Control Manager | ID = 7000 Description = The Parallel port driver service failed to start due to the following error: %%1058 Error - 6/12/2009 7:21:43 PM | Computer Name = RHYDDERCH | Source = Service Control Manager | ID = 7002 Description = The MLPTDR_Q service depends on the Parallel arbitrator group and no member of this group started. Error - 6/12/2009 7:21:43 PM | Computer Name = RHYDDERCH | Source = Service Control Manager | ID = 7009 Description = Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher 9 service to connect. < End of report > This post has been edited by CluelessPC: Jun 12 2009, 05:48 PM |
 |
 
|
|
Jun 17 2009, 02:12 PM
Post
#2
|
|
 Moderator / Malware Staff  Posts: 4,316 From: USA OS: Windows XP professional |
Hello and welcome to Geeks To Go! My name is BHowett and I will be helping you to get sorted. If for any reason you do not understand any of the instructions, or are just unsure then please do not guess , simply post back with your question, and we will go through it again.
ComboFix Please download ComboFix from Here or Here * IMPORTANT !!! Save ComboFix.exe to your Desktop
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Do not mouse-click Combofix's window while it is running. That may cause it to stall. |
|
|
|
|
Jun 17 2009, 03:25 PM
Post
#3
|
|
|
New Member Posts: 6 OS: Windows XP |
Thank you. I ran Combofix, but without the Recovery Console because Combofix could not download it. I think my internet was not properly connected at the time, and it did not let me retry or stop the program after that. The log is further below. Please let me know if I should run the program again with a proper internet connection. Also, am I ok to re-enable Norton after I run Combofix? Or should I keep it disabled for now?
Also, not sure if this is relevant or not, but I have noticed the following changes on my PC since I last posted: 1. Antivirus picked up and removed a few cookies. The Email protection on my Antivirus was set to "off" a few times when I logged in. 2. After I log onto my PC, it shows a black screen for a few seconds before it loads my desktop. I'm not sure if that is part of the virus/malware problem. I noticed that my PC stayed on the black screen for a longer time after Combofix rebooted my machine: until after Combofix was finished. Does Windows tend to wait for ongoing processes to finish before it will load the desktop? Finally, a side question, if you do not mind: are these kinds of problems known to commonly spread to external media (external hard drives) or email? Ok, sorry for all the questions, and thank you again for your help. ComboFix 09-06-16.05 - Robert Chang 06/17/2009 14:06.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2014.1622 [GMT -7:00] Running from: c:\documents and settings\Robert Chang\Desktop\ComboFix.exe AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8} FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220} WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\drivers\SKYNETidufoaim.sys c:\windows\system32\SKYNETchotqmri.dat c:\windows\system32\SKYNETnuejtaat.dll c:\windows\system32\SKYNETumpgivdd.dll c:\windows\system32\SKYNETvqquvewj.dat . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_SKYNETqydwvigl ((((((((((((((((((((((((( Files Created from 2009-05-17 to 2009-06-17 ))))))))))))))))))))))))))))))) . 2009-06-17 19:20 . 2009-06-17 19:20 -------- d-----w- c:\documents and settings\Robert Chang\Application Data\uk.co.planetside 2009-06-17 19:20 . 2009-06-17 19:20 -------- d-----w- c:\documents and settings\Robert Chang\Application Data\Planetside Software 2009-06-17 19:19 . 2009-06-17 19:19 13094 ----a-r- c:\documents and settings\Robert Chang\Application Data\Microsoft\Installer\{BD8D42DC-02C9-47D0-99A3-7BF92E809D9C}\_2cd672ae.exe 2009-06-17 19:19 . 2009-06-17 19:19 13094 ----a-r- c:\documents and settings\Robert Chang\Application Data\Microsoft\Installer\{BD8D42DC-02C9-47D0-99A3-7BF92E809D9C}\_16496df1.exe 2009-06-17 19:19 . 2009-06-17 19:19 1078 ----a-r- c:\documents and settings\Robert Chang\Application Data\Microsoft\Installer\{BD8D42DC-02C9-47D0-99A3-7BF92E809D9C}\_69525f90.exe 2009-06-17 19:19 . 2009-06-17 19:19 -------- d-----w- c:\program files\Planetside Software 2009-06-12 23:26 . 2009-06-12 23:26 -------- d-----w- C:\Rooter$ 2009-06-12 23:21 . 2009-06-12 23:21 -------- d-sh--w- c:\documents and settings\Robert Chang\IETldCache 2009-06-12 23:20 . 2009-06-12 23:20 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache 2009-06-12 23:11 . 2009-06-12 23:11 -------- d-----w- c:\windows\system32\XPSViewer 2009-06-12 23:11 . 2009-06-12 23:11 -------- d-----w- c:\program files\MSBuild 2009-06-12 23:11 . 2009-06-12 23:11 -------- d-----w- c:\program files\Reference Assemblies 2009-06-12 23:11 . 2009-06-12 23:11 -------- d-----w- C:\3386f24233a1474bdb9ba9e0 2009-06-12 23:11 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-06-12 23:11 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll 2009-06-12 23:11 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll 2009-06-12 23:11 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll 2009-06-12 23:11 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll 2009-06-12 23:11 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll 2009-06-12 23:11 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-06-12 23:06 . 2009-04-30 21:22 12800 ------w- c:\windows\system32\dllcache\xpshims.dll 2009-06-12 23:06 . 2009-04-30 21:22 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll 2009-06-12 23:06 . 2009-06-12 23:06 -------- d-----w- c:\windows\ie8updates 2009-06-12 23:05 . 2009-05-12 05:11 102912 ------w- c:\windows\system32\dllcache\iecompat.dll 2009-06-12 23:04 . 2009-06-12 23:05 -------- dc-h--w- c:\windows\ie8 2009-06-12 22:35 . 2009-06-12 22:35 -------- d-----w- c:\documents and settings\Robert Chang\Application Data\Malwarebytes 2009-06-12 22:35 . 2009-05-26 20:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-06-12 22:35 . 2009-06-12 22:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-06-12 22:35 . 2009-06-12 22:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-06-12 22:35 . 2009-05-26 20:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-06-12 22:34 . 2009-06-12 22:34 -------- d-----w- c:\program files\ERUNT 2009-06-11 16:35 . 2009-06-11 16:35 -------- d-----w- c:\program files\InterMute . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-06-17 21:03 . 2008-07-20 06:34 1177 --sha-w- c:\windows\system32\mmf.sys 2009-06-17 21:03 . 2008-06-17 07:12 -------- d-----w- c:\program files\Common Files\Symantec Shared 2009-06-14 00:05 . 2008-06-19 08:43 -------- d-----w- c:\program files\Warcraft III 2009-06-12 23:20 . 2008-06-17 07:27 62616 ----a-w- c:\documents and settings\Robert Chang\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-06-12 17:24 . 2008-06-17 07:02 -------- d-----w- c:\program files\Common Files\Adobe 2009-06-12 09:14 . 2008-08-29 00:59 -------- d-----w- c:\documents and settings\Robert Chang\Application Data\U3 2009-06-09 12:15 . 2008-06-17 07:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec 2009-05-13 05:15 . 2006-04-30 06:56 915456 ----a-w- c:\windows\system32\wininet.dll 2009-05-07 15:32 . 2006-04-30 06:55 345600 ----a-w- c:\windows\system32\localspl.dll 2009-04-30 15:29 . 2008-07-15 13:19 -------- d-----w- c:\documents and settings\Robert Chang\Application Data\AdobeUM 2009-04-26 00:15 . 2009-04-26 00:15 -------- d-----w- c:\documents and settings\Robert Chang\Application Data\Intel 2009-04-17 12:26 . 2006-04-30 06:55 1847168 ----a-w- c:\windows\system32\win32k.sys 2009-04-15 14:51 . 2006-04-30 06:55 585216 ----a-w- c:\windows\system32\rpcrt4.dll 2009-04-09 00:44 . 2009-02-21 06:06 6246568 ----a-w- c:\documents and settings\All Users\Application Data\Sprint\Sprint SmartView\firmware\1\12\1234210960331\FlashCDMA_AC595U_01.06.01_06_sprint_do_000.011_000.exe 2009-04-01 00:16 . 2006-04-30 07:12 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "ISUSPM"="c:\program files\Common Files\Installshield\UpdateService\ISUSPM.exe" [2007-08-30 205480] "Google Update"="c:\documents and settings\Robert Chang\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-06-12 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2007-12-06 200704] "BLOG"="c:\progra~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2007-12-06 208896] "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2007-07-05 110592] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-07-05 512000] "TPFNF7"="c:\program files\Lenovo\NPDIRECT\TPFNF7SP.exe" [2007-11-29 59168] "TPHOTKEY"="c:\program files\Lenovo\HOTKEY\TPOSDSVC.exe" [2007-03-09 66176] "EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2007-03-28 243248] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-04-09 1015808] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-10 8495104] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-10 81920] "TVT Scheduler Proxy"="c:\program files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-03-04 487424] "SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975] "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2007-08-30 205480] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 86960] "AwaySch"="c:\program files\Lenovo\AwayTask\AwaySch.EXE" [2006-11-07 91688] "LPManager"="c:\progra~1\THINKV~1\PrdCtr\LPMGR.exe" [2007-04-26 120368] "AMSG"="c:\program files\ThinkVantage\AMSG\Amsg.exe" [2007-02-01 419376] "DiskeeperSystray"="c:\program files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-05-18 196696] "ACTray"="c:\program files\ThinkPad\ConnectUtilities\ACTray.exe" [2007-07-05 413696] "ACWLIcon"="c:\program files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2007-07-05 126976] "cssauth"="c:\program files\Lenovo\Client Security Solution\cssauth.exe" [2007-08-03 2630968] "WinampAgent"="c:\program files\Players\Winamp\winampa.exe" [2008-04-01 36352] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048] "osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2007-08-25 714608] "KONICA MINOLTA PagePro 1350WStatusDisplay"="c:\windows\system32\MSTMON_Q.EXE" [2004-11-22 163840] "Sprint SmartView"="c:\program files\Sprint\Sprint SmartView\SprintSV.exe" [2008-10-15 17664] "BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2008-11-04 615696] "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2008-09-19 236016] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792] "TpShocks"="TpShocks.exe" - c:\windows\system32\TpShocks.exe [2007-11-22 181536] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-12-10 1626112] c:\documents and settings\Robert Chang\Start Menu\Programs\Startup\ Palm Registration.lnk - c:\program files\Palm\register.exe [2005-8-8 2494464] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193] Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-7-15 113664] Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2007-2-27 561213] DataViz Inc Messenger.lnk - c:\program files\Common Files\DataViz\DvzIncMsgr.exe [2009-1-5 28672] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-6-16 50688] HOTSYNCSHORTCUTNAME.lnk - c:\program files\Palm\Hotsync.exe [2004-6-9 471040] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus] 2007-03-15 05:17 89600 ----a-w- c:\windows\system32\psqlpwd.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2] 2006-09-06 07:37 34344 ----a-w- c:\program files\Lenovo\HOTKEY\notifyf2.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey] 2006-12-14 02:06 28672 ----a-w- c:\program files\Lenovo\HOTKEY\tphklock.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify] 2007-07-05 21:52 32768 ----a-w- c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli ACGina psqlpwd [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Warcraft III\\Warcraft III.exe"= "c:\\Program Files\\Sprint\\Sprint SmartView\\SwiApiMux.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R0 Shockprf;Shockprf;c:\windows\system32\drivers\ApsX86.sys [10/16/2007 6:33 PM 103472] R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [10/16/2007 6:32 PM 19504] R1 TPPWRIF;TPPWRIF;c:\windows\system32\drivers\TPPWRIF.SYS [6/16/2008 11:45 PM 4442] R2 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [7/19/2008 11:34 PM 2560] R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [8/24/2007 10:07 PM 149352] R2 smihlp;SMI Helper Driver (smihlp);c:\program files\Common Files\ThinkVantage Fingerprint Software\Drivers\smihlp.sys [3/14/2007 10:10 PM 11152] R2 TVT Backup Protection Service;TVT Backup Protection Service;c:\program files\Lenovo\Rescue and Recovery\rrpservice.exe [2/8/2007 1:11 PM 569344] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/25/2009 8:34 PM 101936] R3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\drivers\tvti2c.sys [5/22/2007 3:59 PM 30336] S2 MLPTDR_Q;MLPTDR_Q;c:\windows\system32\MLPTDR_Q.SYS [11/18/2004 9:13 PM 18848] S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [5/29/2007 1:55 PM 23888] --- Other Services/Drivers In Memory --- *NewlyCreated* - COMHOST [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-06-17 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-02-12 22:54] 2009-06-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2050315434-2678734953-2199075136-1005.job - c:\documents and settings\Robert Chang\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-12 17:41] 2009-06-16 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Robert Chang.job - c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2007-08-27 01:19] 2009-06-17 c:\windows\Tasks\PMTask.job - c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2008-06-17 16:22] 2009-06-17 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2009-05-12 05:18] . . ------- Supplementary Scan ------- . uStart Page = hxxp://lenovo.live.com IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Send to &Bluetooth Device... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm FF - ProfilePath - . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-06-17 14:10 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \DA9879757777DAE8] "1"=hex:ed,4b,4a,ed,15,23,49,74,5a,62,6c,ea,06,f6,a6,df "2"=hex:a9,40,80,f3,45,2c,d5,a1,17,53,11,d7,21,de,a4,9e,70,5f,a0,52,5b,27,ae, 65,1c,9d,59,02,eb,37,2c,7a,87,23,4c,1a,3f,83,53,96 "3"=hex:ed,4b,4a,ed,15,23,49,74,b0,26,52,ff,a0,7d,07,31,e6,5f,d4,da,fb,3f,90, 71,75,14,ea,42,77,9a,7a,ec,d4,b7,cc,3b,f4,0a,33,5b,a4,1e,da,46,25,2d,2a,72,\ [HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&#&y@^t! #^$ g9^$&pgb SDB36o \DA9879757777DAE8\A4C6DC1D7052183A161573F7BA846387] "1"=hex:1a,dd,98,10,b1,7c,5d,e1 "2"=hex:f1,13,36,fb,86,a6,48,08 "3"=hex:ef,61,40,1a,75,0e,ef,ab,d8,75,1c,52,33,be,cf,32,24,78,87,8b,f5,78,9e, 27,0c,ad,f7,0d,7a,e9,61,5a,a2,f3,f1,53,29,37,b7,f2,27,8f,52,e1,f6,d6,48,fe,\ "4"=hex:2f,ad,a2,e7,8a,bf,05,5e "5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55, 1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\ "6"=hex:d0,5b,15,67,a5,cf,ea,5c,9c,21,08,b8,89,12,fc,7b,4f,2f,cb,9e,f2,64,76, bb,b3,f5,8b,62,4f,41,73,07,e6,a4,47,18,db,46,72,ee,66,a7,f3,5e,d8,49,22,c7,\ "7"=hex:ed,4b,4a,ed,15,23,49,74,5a,02,d0,c7,f9,dd,f2,e5,3e,e0,99,3d,a8,68,9c, 4f,1f,71,fc,13,23,3b,2c,6b,94,db,ee,08,97,0d,d7,27,bf,b9,1b,eb,26,77,8c,fe,\ "8"=hex:e3,36,21,8b,47,07,6d,39,53,04,16,c8,0c,ba,71,42,07,af,eb,7e,87,75,7c, c3,63,5e,30,ec,5e,69,91,54,fc,bb,d6,99,61,97,5c,58,2f,72,a5,69,73,7f,b3,54,\ "9"=hex:81,20,8f,ab,28,6a,52,9c "18"=hex:d0,71,12,cb,08,b7,a7,d6 "10"=hex:81,20,8f,ab,28,6a,52,9c "11"=hex:81,20,8f,ab,28,6a,52,9c "12"=hex:98,f6,48,73,4a,1c,57,dc,81,aa,94,a0,79,1e,e1,a4,05,62,5d,68,85,f5,3d, 6b,ec,15,ee,7d,54,9b,b4,c3,e1,09,6d,58,c9,ac,f7,44,1d,56,c8,38,62,ef,9d,37,\ "13"=hex:a7,48,5f,b4,2b,3c,2b,45,0a,32,6a,73,80,c0,a9,3c,50,8f,c6,86,c0,2c,52, 39 "14"=hex:0d,a3,f0,13,5a,b2,4b,be,11,13,f0,3c,be,44,35,ac "24"=hex:81,20,8f,ab,28,6a,52,9c "26"=hex:81,20,8f,ab,28,6a,52,9c "27"=hex:81,20,8f,ab,28,6a,52,9c "19"=hex:74,42,64,6f,34,b0,e4,ee,8c,42,27,5c,ba,ed,ac,0e "22"=hex:81,20,8f,ab,28,6a,52,9c "15"=hex:36,84,5c,7d,3e,91,04,72,d2,1b,eb,c1,ce,93,c0,30,2e,89,82,73,3f,0f,97, 17,e2,81,eb,b2,f8,73,f6,00,fc,47,ef,34,72,ac,4b,ab,c0,f9,af,5f,a5,85,d5,4b,\ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(880) c:\program files\ThinkPad\ConnectUtilities\ACNotify.dll c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll c:\windows\system32\psqlpwd.dll c:\program files\ThinkVantage Fingerprint Software\homefus2.dll c:\program files\ThinkVantage Fingerprint Software\infra.dll c:\program files\ThinkVantage Fingerprint Software\homepass.dll c:\program files\ThinkVantage Fingerprint Software\bio.dll c:\program files\ThinkVantage Fingerprint Software\ps2css.dll c:\program files\ThinkVantage Fingerprint Software\remote.dll c:\program files\Lenovo\HOTKEY\tphklock.dll c:\program files\ThinkVantage Fingerprint Software\pscssint.dll c:\program files\ThinkVantage Fingerprint Software\crypto.dll - - - - - - - > 'lsass.exe'(936) c:\program files\ThinkPad\ConnectUtilities\ACGina.dll c:\program files\ThinkPad\ConnectUtilities\ACHelper.dll c:\program files\ThinkPad\ConnectUtilities\AcSvcStub.dll c:\program files\ThinkPad\ConnectUtilities\AcLocSettings.dll c:\program files\ThinkPad\ConnectUtilities\ACON.dll c:\windows\system32\WININET.dll c:\program files\ThinkPad\ConnectUtilities\AcPrfMgr.dll c:\program files\ThinkPad\ConnectUtilities\AcCryptHlpr.dll c:\program files\ThinkPad\ConnectUtilities\ACTurinSupport.dll c:\program files\ThinkPad\ConnectUtilities\AcSmBiosHelper.dll c:\program files\ThinkPad\ConnectUtilities\AcAdaptersInfo.dll c:\windows\system32\psqlpwd.dll c:\program files\ThinkVantage Fingerprint Software\homefus2.dll c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll c:\program files\ThinkVantage Fingerprint Software\infra.dll . Completion time: 2009-06-17 14:11 ComboFix-quarantined-files.txt 2009-06-17 21:11 Pre-Run: 38,024,605,696 bytes free Post-Run: 38,063,169,536 bytes free 268 --- E O F --- 2009-06-14 00:26 This post has been edited by CluelessPC: Jun 17 2009, 03:35 PM |
|
|
|
|
Jun 17 2009, 04:05 PM
Post
#4
|
|
|
Moderator / Malware Staff Posts: 4,316 From: USA OS: Windows XP professional |
Hello CluelessPC,
QUOTE 1. Antivirus picked up and removed a few cookies. The Email protection on my Antivirus was set to "off" a few times when I logged in. Cookies are fine... every time you go to a wab page you get them. QUOTE 2. After I log onto my PC, it shows a black screen for a few seconds before it loads my desktop. I'm not sure if that is part of the virus/malware problem. I noticed that my PC stayed on the black screen for a longer time after Combofix rebooted my machine: until after Combofix was finished. Does Windows tend to wait for ongoing processes to finish before it will load the desktop? that is normal. QUOTE Finally, a side question, if you do not mind: are these kinds of problems known to commonly spread to external media (external hard drives) or email? I have not heard of the google redirect spreading through external media, but if you have reason to believe your drives, or thumb drives are infected we can make sure they are clean.
Download Flash_Disinfector.exe by sUBs from here and save it to your desktop. =============================================== ATF Cleaner Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only
Under Main choose: Select All Click the Empty Selected button.
Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. For Technical Support, double-click the e-mail address located at the bottom of each menu. =============================================== Kaspersky WebScanner please go to Kaspersky website and perform an online antivirus scan. [list=1] =============================================== please post the Kaspersky WebScanner results in your next reply, and let me know how things are running  |
|
|
|
|
Jun 17 2009, 08:37 PM
Post
#5
|
|
|
New Member Posts: 6 OS: Windows XP |
Thank you again. I ran the ATF Cleaner and Kaspersky Antivirus. The latter took awhile, and I think Norton reactivated itself during that time. Is it a good idea to run Kaspersky again? Also, thanks for the Flash Drive suggestion. I will run that as well then. Anything I should run for my email account? Or are those usually safe from these problems?
Edit: Forgot to post an update on how things are running. I tried a search in the Firefox browser and it seems to be back to normal. I tried several times (since it did not redirect 100% of the time before) and was never redirected. Ok, back to the Flash Drive Disinfector. 2nd Edit: Errm, I tried to click the link to the Flash Disinfector and Norton (which I had reactivated) said it had blocked a virus named Trojan Horse. That first time, when I received the Norton warning, it opened a download window. I clicked cancel though, because of the warning. Afterwards, when I clicked on the link again, it says the webpage is unavailable... So not sure what happened there. Other suggestions? Would it be a good idea to run any of the security utilities again to ensure nothing else crept onto my PC from the Trojan Horse attack? KASPERSKY LOG: -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0 REPORT Wednesday, June 17, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Thursday, June 18, 2009 01:38:28 Records in database: 2358989 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 130051 Threat name: 1 Infected objects: 1 Suspicious objects: 0 Duration of the scan: 01:39:40 File name / Threat name / Threats count C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETnuejtaat.dll.vir Infected: Trojan.Win32.Small.bzc 1 The selected area was scanned. This post has been edited by CluelessPC: Jun 17 2009, 09:00 PM |
|
|
|
|
Jun 17 2009, 09:39 PM
Post
#6
|
|
|
Moderator / Malware Staff Posts: 4,316 From: USA OS: Windows XP professional |
hello again,
I am glad to hear things are running better, no need to run Kaspersky again, your log looks good, and your email will be fine. As far as the link to the Flash Drive Disinfector, it works fine for me... sometimes anti virus will complain a little because of the type's of tools we use, but I can assure you the link is clean. Well done, your logs appear clean Now lets uninstall Combofix:
=============================================== Click Here to download OTCleanIt Double-click OTCleanIt.exe to run it. Click the Clean up button Click Yes to the reboot. Now delete any logs that you have left over on your desktop. =============================================== For some useful tips on staying clean, along with links to some freeware to help, have a look at this page. To find out more information about how you got infected in the first place, you can read this article. =============================================== Follow this list and your potential for being infected again will reduce dramatically. Thanks for letting us help you! |
|
|
|
|
Jun 17 2009, 10:24 PM
Post
#7
|
|
|
New Member Posts: 6 OS: Windows XP |
I removed Combofix. Google Chrome and Firefox both report OTCleanIt as a broken link. Google Chrome continues to report the Flash Drive Disinfector as "unavailable", but I was able to download it with Firefox. Weird.
You wrote: ...sometimes anti virus will complain a little because of the type's of tools we use, but I can assure you the link is clean. Ahh OK. A False Positive then. I know some of the other programs are incompatible with Antivirus programs, but did not know that one would be as well. Thank you for the reassurance! You wrote: For some useful tips on staying clean, along with links to some freeware to help, have a look at this page... To find out more information about how you got infected in the first place, you can read this article. Duly noted. I'll take a look at those after I figure out how to get to OTCleanIt. Any suggestions? Will the OldTimer "OTL" tool perform the same function? I downloaded that one when I followed the Malware and Spyware Cleaning Guide. Thanks again. Apologies for the constant barrage of questions. |
|
|
|
|
Jun 17 2009, 10:45 PM
Post
#8
|
|
|
Moderator / Malware Staff Posts: 4,316 From: USA OS: Windows XP professional |
Thanks for letting me know my OTC link was not working..... try this one.
thanks
|
|
|
|
|
Jun 17 2009, 11:19 PM
Post
#9
|
|
|
New Member Posts: 6 OS: Windows XP |
OK, that worked. Should I still keep ERUNT, Rooter, OTL, or TFC? Also, any thoughts on the safety of the (relatively) new Google Chrome vs Firefox? Ok, off to read the rest of those two articles for safer browsing.
Anything else I should keep you updated on? Or are we all finished? Either way, thank you once again. I really appreciate all of your help! 
|
|
|
|
|
Jun 18 2009, 06:46 AM
Post
#10
|
|
|
Moderator / Malware Staff Posts: 4,316 From: USA OS: Windows XP professional |
QUOTE (CluelessPC @ Jun 18 2009, 01:19 AM)  OK, that worked. Should I still keep ERUNT, Rooter, OTL, or TFC? Also, any thoughts on the safety of the (relatively) new Google Chrome vs Firefox? Ok, off to read the rest of those two articles for safer browsing. you can delete everything, but TFC... TFC is a nice temp file cleaner that you can use one a week to help keep things running good. As far a Chrome Vs Firefox... well that depends on your personal preference. Both are good security wise, but I prefer Firefox. QUOTE (CluelessPC @ Jun 18 2009, 01:19 AM) Anything else I should keep you updated on? Or are we all finished? Either way, thank you once again. I really appreciate all of your help! Just make sure you keep your AV up to date, and we are all done glad I could help & safe surfing! |
|
|
|
|
Jun 18 2009, 06:46 AM
Post
#11
|
|
|
Moderator / Malware Staff Posts: 4,316 From: USA OS: Windows XP professional |
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic. |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
Similar Topics
| Topic Title | Replies / Views | Topic Information | |||||
|---|---|---|---|---|---|---|---|
 |
16 / 1,092 | 28th August 2009 - 08:43 AM mituck started - last by handhfan |
|||||
|
 |
28 / 390 | 28th December 2009 - 10:11 AM spelloni started - last by Rorschach112 |
||||
 |
12 / 324 | 11th January 2010 - 09:07 AM Bfife started - last by Rorschach112 |
|||||
|
12 / 212 | 8th February 2010 - 06:04 AM John from Goderich started - last by Rorschach112 |
|||||
|
Time is now: 22nd March 2010 - 02:01 AM |
Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks mentioned on this page are the property of their respective owners.
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy | Advertising