Weird files not closing when computer shutting down [Solved] |
Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!
  |
 Jun 27 2009, 11:47 PM
Post
#1
|
|
|
Member  Posts: 13 OS: XP  |
The past couple of days when I try to shutdown my computer I get an alert that a file is not closing down normally and is asking me to 'cancel' or 'end now'. The odd part is the file name is not the same each time and is just random letters and numbers (ie. f94). These file names do not exist on my computer when I do a search. Followed the cleaning guide and have posted the malware, rooter, and otl logs below. The malware did detect spyware but I would like additional verification that my computer is clean. Also, did a McAfee virus scan and spy sweeper scan which detected nothing. Thanks for your time. Malwarebytes' Anti-Malware 1.38 Database version: 2340 Windows 5.1.2600 Service Pack 3 6/27/2009 10:15:37 AM mbam-log-2009-06-27 (10-15-37).txt Scan type: Full Scan (C:\|) Objects scanned: 187355 Time elapsed: 1 hour(s), 7 minute(s), 8 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 2 Folders Infected: 3 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\Program Files\MyWaySA (Adware.MyWebSearch) -> Quarantined and deleted successfully. c:\program files\MyWaySA\SrchAsDe (Adware.MyWebSearch) -> Quarantined and deleted successfully. c:\program files\MyWaySA\SrchAsDe\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully. Files Infected: (No malicious items detected) Rooter.exe (v1.0.2) by Eric_71 . SeDebugPrivilege granted successfully ... . Windows XP Home Edition (5.1.2600) Service Pack 3 [32_bits] - x86 Family 15 Model 3 Stepping 4, GenuineIntel . [wscsvc] (Security Center) RUNNING (state:4) [SharedAccess] RUNNING (state:4) Windows Firewall -> Enabled . Internet Explorer 8.0.6001.18702 Mozilla Firefox 3.0.11 (en-US) . C:\ [Fixed-NTFS] .. ( Total:71 Go - Free:15 Go ) D:\ [CD_Rom] E:\ [Removable] . Scan : 22:36.41 Path : C:\Documents and Settings\CT\Desktop\Rooter.exe User : CT ( Administrator -> YES ) . ----------------------\\ Processes . Locked [System Process] (0) ______ System (4) ______ \SystemRoot\System32\smss.exe (560) ______ \??\C:\WINDOWS\system32\csrss.exe (616) ______ \??\C:\WINDOWS\system32\winlogon.exe (640) ______ C:\WINDOWS\system32\services.exe (684) ______ C:\WINDOWS\system32\lsass.exe (696) ______ C:\WINDOWS\system32\Ati2evxx.exe (860) ______ C:\WINDOWS\system32\svchost.exe (876) ______ C:\WINDOWS\system32\svchost.exe (952) ______ C:\WINDOWS\System32\svchost.exe (1048) ______ C:\WINDOWS\system32\svchost.exe (1088) ______ C:\WINDOWS\system32\svchost.exe (1152) ______ C:\WINDOWS\system32\svchost.exe (1284) ______ C:\WINDOWS\system32\spoolsv.exe (1456) ______ C:\WINDOWS\system32\svchost.exe (1560) ______ C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe (1592) ______ C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (1624) ______ C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (1700) ______ C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe (1732) ______ c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe (1792) ______ c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (1872) ______ C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (1896) ______ C:\Program Files\McAfee\MPF\MPFSrv.exe (1960) ______ C:\WINDOWS\system32\svchost.exe (168) ______ C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe (424) ______ C:\Program Files\Canon\CAL\CALMAIN.exe (1224) ______ C:\WINDOWS\System32\alg.exe (2556) ______ C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (3812) ______ c:\PROGRA~1\mcafee.com\agent\mcagent.exe (612) ______ C:\WINDOWS\Explorer.EXE (2080) ______ C:\Program Files\Verizon\VSP\VerizonServicepoint.exe (2636) ______ C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe (2116) ______ C:\Program Files\iTunes\iTunesHelper.exe (2820) ______ C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe (2856) ______ C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe (2908) ______ C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe (1236) ______ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (980) ______ C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (3184) ______ C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe (3288) ______ C:\Program Files\Dell Support\DSAgnt.exe (3344) ______ C:\Program Files\Messenger\msmsgs.exe (3404) ______ C:\WINDOWS\system32\ctfmon.exe (3416) ______ C:\Program Files\Digital Line Detect\DLG.exe (1832) ______ C:\Program Files\iPod\bin\iPodService.exe (3612) ______ C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (3948) ______ C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe (4048) ______ C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe (152) ______ C:\Program Files\Vidalia Bundle\Tor\tor.exe (1516) ______ C:\Program Files\Webroot\Spy Sweeper\SSU.EXE (3704) ______ C:\Program Files\Mozilla Firefox\firefox.exe (2932) ______ C:\Documents and Settings\CT\Desktop\Rooter.exe (2944) . ----------------------\\ Device\Harddisk0\ . \Device\Harddisk0 [Sectors : 63 x 512 Bytes] . \Device\Harddisk0\Partition1 (Start_Offset:32256 | Length:49319424) \Device\Harddisk0\Partition2 --[ MBR ]-- (Start_Offset:49351680 | Length:76988620800) \Device\Harddisk0\Partition3 (Start_Offset:77037972480 | Length:2952875520) . ----------------------\\ Scheduled Tasks . C:\WINDOWS\Tasks\DESKTOP.INI C:\WINDOWS\Tasks\McDefragTask.job C:\WINDOWS\Tasks\SA.DAT . ----------------------\\ Registry . . ----------------------\\ Files & Folders . ----------------------\\ Scan completed at 22:37.24 . C:\Rooter$\Rooter_1.txt - (27/06/2009 | 22:37.24) OTL logfile created on: 6/27/2009 10:41:37 PM - Run 1 OTL by OldTimer - Version 3.0.5.3 Folder = C:\Documents and Settings\CT\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 510.07 Mb Total Physical Memory | 141.97 Mb Available Physical Memory | 27.83% Memory free 1.22 Gb Paging File | 0.67 Gb Available in Paging File | 54.83% Paging File free Paging file location(s): C:\pagefile.sys 768 1500 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 71.70 Gb Total Space | 15.29 Gb Free Space | 21.32% Space Free | Partition Type: NTFS Drive D: | 561.63 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Drive E: | 982.72 Mb Total Space | 961.70 Mb Free Space | 97.86% Space Free | Partition Type: FAT F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: POP_UP_1 Current User Name: CT Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\WINDOWS\System32\Ati2evxx.exe () PRC - C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe () PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.) PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.) PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.) PRC - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe (Webroot Software, Inc.) PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.) PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.) PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation) PRC - C:\Program Files\Verizon\VSP\VerizonServicepoint.exe (Verizon) PRC - C:\Program Files\Verizon\SmartBridge\MotiveSB.exe (Motive Communications, Inc.) PRC - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) PRC - C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe (Adobe Systems Incorporated) PRC - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe (Webroot Software, Inc.) PRC - C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe () PRC - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) PRC - C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe (Time Information Services Ltd.) PRC - C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.) PRC - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) PRC - C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software) PRC - C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.) PRC - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.) PRC - C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe () PRC - C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe (Nokia Corporation) PRC - C:\Program Files\Vidalia Bundle\Tor\tor.exe () PRC - C:\Program Files\Webroot\Spy Sweeper\SSU.EXE () PRC - C:\Documents and Settings\CT\Desktop\OTL.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (AdobeActiveFileMonitor5.0 [Auto | Running]) -- C:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe () SRV - (Apple Mobile Device [Auto | Running]) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.) SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation) SRV - (Ati HotKey Poller [Auto | Running]) -- C:\WINDOWS\System32\Ati2evxx.exe () SRV - (CCALib8 [Auto | Running]) -- C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.) SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- c:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) SRV - (gusvc [On_Demand | Stopped]) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google) SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation) SRV - (IDriverT [On_Demand | Stopped]) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation) SRV - (idsvc [Unknown | Stopped]) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation) SRV - (IntuitUpdateService [Auto | Running]) -- C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.) SRV - (iPod Service [On_Demand | Running]) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.) SRV - (mcmscsvc [Auto | Running]) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) SRV - (McNASvc [Auto | Running]) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.) SRV - (McODS [On_Demand | Stopped]) -- C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.) SRV - (McProxy [Auto | Running]) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.) SRV - (McShield [Unknown | Running]) -- C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.) SRV - (McSysmon [On_Demand | Running]) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.) SRV - (MpfService [Auto | Running]) -- C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.) SRV - (NetSvc [On_Demand | Stopped]) -- C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe (Intel® Corporation) SRV - (NetTcpPortSharing [Disabled | Stopped]) -- c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation) SRV - (ServiceLayer [On_Demand | Running]) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.) SRV - (WebrootSpySweeperService [Auto | Running]) -- C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe (Webroot Software, Inc.) SRV - (WMPNetworkSvc [Disabled | Stopped]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (aeaudio [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\aeaudio.sys (Andrea Electronics Corporation) DRV - (AliIde [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.) DRV - (amdagp [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.) DRV - (asc [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.) DRV - (asc3550 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.) DRV - (ati2mtag [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.) DRV - (BANTExt [System | Running]) -- C:\WINDOWS\System32\Drivers\BANTExt.sys () DRV - (CmdIde [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.) DRV - (dac2w2k [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation) DRV - (E100B [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\e100b325.sys (Intel Corporation) DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.) DRV - (hamachi_oem [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\gan_adapter.sys (Applied Networking Inc.) DRV - (HSFHWBS2 [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\HSFHWBS2.sys (Conexant Systems, Inc.) DRV - (HSF_DP [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\HSF_DP.sys (Conexant Systems, Inc.) DRV - (mdmxsdk [Auto | Running]) -- C:\WINDOWS\System32\DRIVERS\mdmxsdk.sys (Conexant) DRV - (mfeavfk [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\mfeavfk.sys (McAfee, Inc.) DRV - (mfebopk [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\mfebopk.sys (McAfee, Inc.) DRV - (mfehidk [System | Running]) -- C:\WINDOWS\System32\drivers\mfehidk.sys (McAfee, Inc.) DRV - (mferkdk [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\mferkdk.sys (McAfee, Inc.) DRV - (mfesmfk [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\mfesmfk.sys (McAfee, Inc.) DRV - (MODEMCSA [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\MODEMCSA.sys (Microsoft Corporation) DRV - (MPFP [System | Running]) -- C:\WINDOWS\System32\Drivers\Mpfp.sys (McAfee, Inc.) DRV - (mraid35x [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.) DRV - (MREMPR5 [On_Demand | Stopped]) -- C:\Program Files\Common Files\Motive\MREMPR5.sys (Motive, Inc.) DRV - (MRENDIS5 [On_Demand | Stopped]) -- C:\Program Files\Common Files\Motive\MRENDIS5.sys (Motive, Inc.) DRV - (nmwcd [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\ccdcmb.sys (Nokia) DRV - (nmwcdc [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\ccdcmbo.sys (Nokia) DRV - (nmwcdnsu [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\nmwcdnsu.sys (Nokia) DRV - (nmwcdnsuc [On_Demand | Stopped]) -- C:\WINDOWS\System32\drivers\nmwcdnsuc.sys (Nokia) DRV - (nv [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation) DRV - (omci [System | Running]) -- C:\WINDOWS\System32\DRIVERS\omci.sys (Dell Computer Corporation) DRV - (pccsmcfd [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\pccsmcfd.sys (Nokia) DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.) DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions) DRV - (ql1080 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation) DRV - (ql12160 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation) DRV - (ql1280 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation) DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - (sisagp [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation) DRV - (smwdm [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\smwdm.sys (Analog Devices, Inc.) DRV - (Sparrow [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.) DRV - (SSFS0BB9 [Boot | Running]) -- C:\WINDOWS\SYSTEM32\Drivers\SSFS0BB9.SYS (Webroot Software Inc (www.webroot.com)) DRV - (SSHRMD [Boot | Running]) -- C:\WINDOWS\SYSTEM32\Drivers\SSHRMD.SYS (Webroot Software Inc (www.webroot.com)) DRV - (SSIDRV [Boot | Running]) -- C:\WINDOWS\SYSTEM32\Drivers\SSIDRV.SYS (Webroot Software Inc (www.webroot.com)) DRV - (SSKBFD [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\sskbfd.sys (Webroot Software Inc (www.webroot.com)) DRV - (symc810 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.) DRV - (symc8xx [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic) DRV - (sym_hi [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic) DRV - (sym_u3 [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic) DRV - (ultra [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.) DRV - (upperdev [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\usbser_lowerflt.sys (Windows ® Codename Longhorn DDK provider) DRV - (usbser [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\usbser.sys (Microsoft Corporation) DRV - (UsbserFilt [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\usbser_lowerfltj.sys (Windows ® Codename Longhorn DDK provider) DRV - (winachsf [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\HSF_CNXT.sys (Conexant Systems, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Google" FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:0.7.5.5 FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.29 FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.3 FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:2.8.12 FF - prefs.js..extensions.enabledItems: firefox@ghostery.com:1.4.0 FF - prefs.js..extensions.enabledItems: {3112ca9c-de6d-4884-a869-9855de68056c}:3.1.20081127W FF - prefs.js..extensions.enabledItems: locationbar2@design-noir.de:1.0.3 FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000006 FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.2.8 FF - prefs.js..extensions.enabledItems: secureLogin@blueimp.net:0.9.3 FF - prefs.js..extensions.enabledItems: {e0204bd5-9d31-402b-a99d-a6aa8ffebdca}:1.2.0 FF - prefs.js..extensions.enabledItems: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}:20090325 FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.0 FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.11 FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/06/27 14:18:40 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/06/26 11:23:25 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.11\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/06/26 11:23:21 | 00,000,000 | ---D | M] [2008/09/03 15:03:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CT\Application Data\mozilla\Extensions [2008/09/03 15:03:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CT\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/06/27 15:37:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CT\Application Data\mozilla\Firefox\Profiles\jemu7mak.default\extensions [2009/01/08 12:29:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CT\Application Data\mozilla\Firefox\Profiles\jemu7mak.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2009/05/14 22:05:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CT\Application Data\mozilla\Firefox\Profiles\jemu7mak.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232} [2009/05/14 16:54:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CT\Application Data\mozilla\Firefox\Profiles\jemu7mak.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2008/07/10 08:43:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CT\Application Data\mozilla\Firefox\Profiles\jemu7mak.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2009/05/14 16:54:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CT\Application Data\mozilla\Firefox\Profiles\jemu7mak.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3} [2008/07/10 08:42:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CT\Application Data\mozilla\Firefox\Profiles\jemu7mak.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389} [2009/03/16 20:01:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CT\Application Data\mozilla\Firefox\Profiles\jemu7mak.default\extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca} [2009/05/14 22:05:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CT\Application Data\mozilla\Firefox\Profiles\jemu7mak.default\extensions\firefox@ghostery.com [2009/03/16 19:57:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CT\Application Data\mozilla\Firefox\Profiles\jemu7mak.default\extensions\foxyproxy@eric.h.jung [2009/05/27 16:45:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CT\Application Data\mozilla\Firefox\Profiles\jemu7mak.default\extensions\locationbar2@design-noir.de [2009/03/20 22:15:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CT\Application Data\mozilla\Firefox\Profiles\jemu7mak.default\extensions\moveplayer@movenetworks.com [2009/05/27 16:34:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\CT\Application Data\mozilla\Firefox\Profiles\jemu7mak.default\extensions\secureLogin@blueimp.net [2009/06/26 11:23:21 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2007/06/06 21:23:04 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c} [2009/06/26 11:23:21 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/06/02 20:00:58 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009/06/02 20:00:59 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2007/04/10 17:21:08 | 00,163,256 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2009/06/02 20:01:00 | 00,065,528 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll [2006/12/18 04:18:30 | 00,077,824 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2009/06/02 16:18:22 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml [2009/06/02 16:18:22 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml [2009/06/02 16:18:22 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml [2009/06/02 16:18:22 | 00,002,343 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml [2009/06/02 16:18:22 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2009/06/02 16:18:22 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml [2009/06/02 16:18:22 | 00,000,792 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml O1 HOSTS File: (306712 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 10560 more lines... O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.) O3 - HKLM\..\Toolbar: (no name) - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - No CLSID value found. O3 - HKCU\..\Toolbar\ShellBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (&Google) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (Google Inc.) O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Elements 5.0\apdproxy.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.) O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.) O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [Motive SmartBridge] C:\Program Files\Verizon\SmartBridge\MotiveSB.exe (Motive Communications, Inc.) O4 - HKLM..\Run: [OSCD_Creator] c:\Dell\PreODM.EXE () O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.) O4 - HKLM..\Run: [SpySweeper] File not found O4 - HKLM..\Run: [VerizonServicepoint.exe] C:\Program Files\Verizon\VSP\VerizonServicepoint.exe (Verizon) O4 - HKCU..\Run: [DellSupport] File not found O4 - HKCU..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O4 - HKCU..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe (Time Information Services Ltd.) O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKCU..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated) O4 - HKCU..\Run: [Vidalia] C:\Program Files\Vidalia Bundle\Vidalia\vidalia.exe () O4 - HKLM..\RunOnce: [OSCD_Creator] C:\Dell\PreODM.EXE () O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskmgr = 0 O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKCU\..Trusted Domains: aaa.com ([www] https in Trusted sites) O15 - HKCU\..Trusted Domains: turbotax.com ([]https in Trusted sites) O15 - HKCU\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKCU\..Trusted Ranges: 1 range(s) not assigned to a zone. O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://v5.windowsupdate.microsoft.com/v5co...b?1107328650011 (WUWebControl Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1246061725109 (MUWebControl Class) O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.mcafee.com/molbin/shared/m...,26/mcgdmgr.cab (Reg Error: Key error.) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 O18 - Protocol\Handler\belarc - No CLSID value found O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\WRNotifier: DllName - WRLogonNTF.dll - C:\WINDOWS\System32\WRLogonNTF.dll (Webroot Software, Inc.) O24 - Desktop Components:0 (My Current Home Page) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004/08/10 12:04:08 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2004/08/12 07:12:03 | 00,000,110 | R--- | M] () - D:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found ========== Files/Folders - Created Within 30 Days ========== [2009/06/27 22:40:35 | 00,513,536 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\CT\Desktop\OTL.exe [2009/06/27 22:37:24 | 00,000,000 | ---D | C] -- C:\Rooter$ [2009/06/27 22:34:24 | 00,173,119 | ---- | C] (Eric_71) -- C:\Documents and Settings\CT\Desktop\Rooter.exe [2009/06/27 15:06:09 | 00,000,000 | ---D | C] -- C:\5480b7865bf0621ec2284555f4 [2009/06/27 14:32:11 | 00,000,000 | ---D | C] -- C:\WINDOWS\ie8updates [2009/06/27 14:29:18 | 00,000,000 | ---D | C] -- C:\WINDOWS\WBEM [2009/06/27 14:26:42 | 00,000,000 | -H-D | C] -- C:\WINDOWS\ie8 [2009/06/27 14:24:08 | 00,102,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iecompat.dll [2009/06/27 14:23:59 | 00,246,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieproxy.dll [2009/06/27 14:23:59 | 00,012,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xpshims.dll [2009/06/27 14:23:57 | 01,985,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll [2009/06/27 14:23:49 | 11,064,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll [2009/06/27 14:16:31 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\XPSViewer [2009/06/27 14:16:21 | 00,000,000 | ---D | C] -- C:\Program Files\MSBuild [2009/06/27 14:14:22 | 00,000,000 | ---D | C] -- C:\25e68d17eb7cd2c859ca08ad8887 [2009/06/27 10:41:17 | 00,027,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll.mui [2009/06/27 10:41:16 | 00,268,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll [2009/06/26 22:14:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\CT\Application Data\Malwarebytes [2009/06/26 22:14:24 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2009/06/26 22:14:19 | 00,038,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009/06/26 22:14:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2009/06/26 22:14:15 | 00,019,096 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009/06/26 22:14:13 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009/06/26 22:12:43 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2009/06/26 22:11:53 | 00,000,611 | ---- | C] () -- C:\Documents and Settings\CT\Desktop\NTREGOPT.lnk [2009/06/26 22:11:53 | 00,000,592 | ---- | C] () -- C:\Documents and Settings\CT\Desktop\ERUNT.lnk [2009/06/26 22:11:51 | 00,000,000 | ---D | C] -- C:\Program Files\ERUNT [2009/06/26 21:56:46 | 00,265,216 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\CT\Desktop\TFC.exe [2009/06/26 18:56:08 | 00,002,560 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xpsp4res.dll [2009/06/26 18:56:07 | 01,203,922 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sysmain.sdb [2009/06/26 18:56:06 | 00,215,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wordpad.exe [2009/06/26 18:55:34 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft CAPICOM 2.1.0.2 [2009/06/26 18:29:55 | 00,000,000 | ---D | C] -- C:\WINDOWS\Prefetch [2009/06/26 17:59:49 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\en-us [2009/06/26 17:59:45 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\scripting [2009/06/26 17:59:40 | 00,000,000 | ---D | C] -- C:\WINDOWS\l2schemas [2009/06/26 17:59:38 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\en [2009/06/26 17:59:37 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\bits [2009/06/26 17:51:07 | 00,000,000 | ---D | C] -- C:\WINDOWS\ServicePackFiles [2009/06/26 17:43:49 | 00,000,000 | ---D | C] -- C:\WINDOWS\network diagnostic [2009/06/26 17:34:06 | 00,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstall$ [2009/06/26 17:28:24 | 00,000,000 | ---D | C] -- C:\WINDOWS\EHome [2009/06/26 11:23:27 | 00,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk [2009/06/24 21:17:14 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\CT\Desktop\HijackThis.lnk [2009/06/24 21:17:13 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2009/06/23 18:38:43 | 00,000,870 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Baseline Security Analyzer 2.1.lnk [2009/06/23 18:38:34 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Baseline Security Analyzer 2 [2009/06/23 18:23:55 | 00,284,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pdh.dll [2009/06/23 18:23:54 | 00,035,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sc.exe [2009/06/23 18:23:53 | 00,401,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rpcss.dll [2009/06/23 18:23:52 | 00,473,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\fastprox.dll [2009/06/23 18:23:52 | 00,110,592 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\services.exe [2009/06/23 18:23:51 | 00,453,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiprvsd.dll [2009/06/23 18:23:51 | 00,227,840 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmiprvse.exe [2009/06/23 18:23:49 | 00,729,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\lsasrv.dll [2009/06/23 18:23:49 | 00,617,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\advapi32.dll [2009/06/23 18:23:48 | 00,714,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntdll.dll [2009/06/23 18:23:46 | 02,145,280 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlmp.exe [2009/06/23 18:23:44 | 02,189,056 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntoskrnl.exe [2009/06/23 18:23:42 | 02,023,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrpamp.exe [2009/06/23 17:57:43 | 00,001,748 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Belarc Advisor.lnk [2009/06/23 17:57:26 | 00,003,840 | ---- | C] () -- C:\WINDOWS\System32\drivers\BANTExt.sys [2009/06/23 17:57:26 | 00,000,000 | ---D | C] -- C:\Program Files\Belarc [2009/06/07 21:38:13 | 00,019,456 | ---- | C] () -- C:\Documents and Settings\CT\My Documents\contest.doc [2009/06/05 22:36:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\CT\Application Data\Vidalia [2009/06/05 13:55:13 | 00,001,757 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk [2009/06/05 13:55:13 | 00,001,725 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk [2009/06/05 13:55:13 | 00,000,493 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk [2009/06/05 11:00:45 | 00,056,224 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat [2009/06/01 10:36:41 | 00,036,864 | ---- | C] () -- C:\Documents and Settings\CT\My Documents\TM Agenda 6.2.09.doc [2007/04/11 11:44:43 | 00,026,480 | ---- | C] () -- C:\WINDOWS\System32\wrlzma.dll [2007/03/29 23:00:40 | 00,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll [2006/12/10 22:17:42 | 00,684,032 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll [2006/12/10 22:17:42 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll [2006/02/13 00:55:45 | 00,684,032 | ---- | C] () -- C:\WINDOWS\libeay32.dll [2006/02/13 00:55:45 | 00,155,648 | ---- | C] () -- C:\WINDOWS\ssleay32.dll [2006/01/26 20:58:40 | 00,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI [2005/09/26 20:03:41 | 00,000,000 | ---- | C] () -- C:\WINDOWS\SETUP32.INI [2005/08/07 17:26:06 | 00,000,011 | ---- | C] () -- C:\WINDOWS\OSA.INI [2005/03/13 15:55:33 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2005/02/02 00:46:30 | 00,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini [2005/02/02 00:04:08 | 00,000,034 | ---- | C] () -- C:\WINDOWS\AuthMgr.INI [2005/01/23 15:02:31 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2005/01/23 14:27:24 | 00,000,520 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2004/08/10 12:13:12 | 00,000,780 | ---- | C] () -- C:\WINDOWS\ORUN32.INI [2004/08/10 12:04:08 | 00,001,087 | ---- | C] () -- C:\WINDOWS\WIN.INI [2004/08/10 11:57:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\SYSTEM.INI [2002/03/13 17:46:46 | 00,053,248 | R--- | C] () -- C:\WINDOWS\System32\zlib.dll [1999/01/22 19:46:58 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL [1998/01/12 08:00:00 | 00,040,448 | ---- | C] () -- C:\WINDOWS\System32\REGOBJ.DLL [1979/12/31 23:00:00 | 00,151,552 | ---- | C] ( ) -- C:\WINDOWS\System32\ATIDEMGR.dll [1979/12/31 23:00:00 | 00,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll [1979/12/31 23:00:00 | 00,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll ========== Files - Modified Within 30 Days ========== [2009/06/27 22:40:39 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\CT\Desktop\OTL.exe [2009/06/27 22:34:30 | 00,173,119 | ---- | M] (Eric_71) -- C:\Documents and Settings\CT\Desktop\Rooter.exe [2009/06/27 21:13:30 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL [2009/06/27 21:11:09 | 00,010,661 | ---- | M] () -- C:\WINDOWS\System32\Config.MPF [2009/06/27 21:10:34 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009/06/27 21:10:32 | 00,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT [2009/06/27 20:24:43 | 00,256,656 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009/06/27 15:05:29 | 00,530,488 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/06/27 15:05:29 | 00,467,016 | ---- | M] () -- C:\WINDOWS\System32\PERFH009.DAT [2009/06/27 15:05:29 | 00,074,620 | ---- | M] () -- C:\WINDOWS\System32\PERFC009.DAT [2009/06/27 14:32:49 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2009/06/26 22:14:24 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2009/06/26 22:11:53 | 00,000,611 | ---- | M] () -- C:\Documents and Settings\CT\Desktop\NTREGOPT.lnk [2009/06/26 22:11:53 | 00,000,592 | ---- | M] () -- C:\Documents and Settings\CT\Desktop\ERUNT.lnk [2009/06/26 21:56:47 | 00,265,216 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\CT\Desktop\TFC.exe [2009/06/26 17:42:44 | 00,250,048 | RHS- | M] () -- C:\NTLDR [2009/06/26 11:23:27 | 00,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk [2009/06/24 21:26:40 | 00,001,087 | ---- | M] () -- C:\WINDOWS\WIN.INI [2009/06/24 21:25:26 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\CT\Desktop\HijackThis.lnk [2009/06/23 18:38:43 | 00,000,870 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Baseline Security Analyzer 2.1.lnk [2009/06/23 17:57:43 | 00,001,748 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Belarc Advisor.lnk [2009/06/17 11:27:56 | 00,038,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009/06/17 11:27:44 | 00,019,096 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009/06/15 20:23:53 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk [2009/06/07 21:38:13 | 00,019,456 | ---- | M] () -- C:\Documents and Settings\CT\My Documents\contest.doc [2009/06/06 16:13:27 | 00,000,211 | RHS- | M] () -- C:\BOOT.INI [2009/06/06 16:13:26 | 00,000,227 | ---- | M] () -- C:\WINDOWS\SYSTEM.INI [2009/06/05 21:28:03 | 00,020,480 | ---- | M] () -- C:\Documents and Settings\CT\My Documents\welcome Portland Leadership Forum.doc [2009/06/05 11:00:45 | 00,056,224 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat [2009/06/03 12:18:32 | 00,306,712 | R--- | M] () -- C:\WINDOWS\System32\drivers\ETC\hosts.20090604-133456.backup [2009/06/03 12:18:32 | 00,306,712 | ---- | M] () -- C:\WINDOWS\System32\drivers\ETC\HOSTS [2009/06/02 17:24:19 | 00,306,712 | R--- | M] () -- C:\WINDOWS\System32\drivers\ETC\hosts.20090603-121832.backup [2009/06/02 11:14:48 | 00,036,864 | ---- | M] () -- C:\Documents and Settings\CT\My Documents\TM Agenda 6.2.09.doc [2009/06/02 03:12:46 | 00,102,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iecompat.dll [2009/06/01 09:51:14 | 23,635,392 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe ========== Alternate Data Streams ========== @Alternate Data Stream - 138 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:D1B5B4F1 @Alternate Data Stream - 110 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:CBAC4FD8 < End of report > |
 |
 
|
|
Jul 2 2009, 04:25 PM
Post
#2
|
|
 Trusted Helper  Posts: 7,987 OS: XP Pro |
Hello dogster,
Please download ComboFix from one of these locations: NOTE: If you are guest watching this topic. ComboFix is a very powerful tool. The disclaimer clearly states that you should not use it without supervision. There is good reason for this as ComboFix can, and sometimes does, run into conflict on a computer and render it unusable. Link 1 Link 2 Link 3 * IMPORTANT !!! Save ComboFix.exe to your Desktop
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply. |
|
|
|
|
Jul 2 2009, 05:31 PM
Post
#3
|
|
|
Member Posts: 13 OS: XP |
Hi emeraldnzl -- Ran the combofix. Here is the log. Thanks. ComboFix 09-07-02.02 - CT 07/02/2009 16:34.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.311 [GMT -7:00] Running from: c:\documents and settings\CT\Desktop\ComboFix.exe AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} * Resident AV is active . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\CT\x.exe c:\windows\Installer\5ca69.msi c:\windows\Installer\704e2de.msp c:\windows\system32\mlfcache.dat . ((((((((((((((((((((((((( Files Created from 2009-06-02 to 2009-07-02 ))))))))))))))))))))))))))))))) . 2009-06-29 03:36 . 2009-06-29 03:36 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2009-06-29 03:36 . 2009-06-29 03:36 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache 2009-06-28 05:37 . 2009-06-28 05:38 -------- d-----w- C:\Rooter$ 2009-06-28 03:31 . 2009-06-28 03:31 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2009-06-27 21:16 . 2009-06-27 21:16 -------- d-----w- c:\program files\MSBuild 2009-06-27 21:14 . 2009-06-27 21:15 -------- d-----w- C:\25e68d17eb7cd2c859ca08ad8887 2009-06-27 17:41 . 2008-10-16 21:06 268648 ----a-w- c:\windows\system32\mucltui.dll 2009-06-27 05:14 . 2009-06-27 05:14 -------- d-----w- c:\documents and settings\CT\Application Data\Malwarebytes 2009-06-27 05:14 . 2009-06-17 18:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-06-27 05:14 . 2009-06-27 05:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-06-27 05:14 . 2009-06-17 18:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-06-27 05:14 . 2009-06-27 05:14 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-06-27 05:11 . 2009-06-27 05:12 -------- d-----w- c:\program files\ERUNT 2009-06-27 01:56 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll 2009-06-27 01:56 . 2008-04-21 12:08 215552 ------w- c:\windows\system32\dllcache\wordpad.exe 2009-06-27 01:55 . 2009-06-27 01:55 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2 2009-06-27 00:59 . 2009-06-27 00:59 -------- d-----w- c:\windows\system32\scripting 2009-06-27 00:59 . 2009-06-27 00:59 -------- d-----w- c:\windows\l2schemas 2009-06-27 00:59 . 2009-06-27 00:59 -------- d-----w- c:\windows\system32\en 2009-06-27 00:59 . 2009-06-27 00:59 -------- d-----w- c:\windows\system32\bits 2009-06-27 00:51 . 2009-06-27 01:00 -------- d-----w- c:\windows\ServicePackFiles 2009-06-27 00:28 . 2009-06-27 00:28 -------- d-----w- c:\windows\EHome 2009-06-25 04:17 . 2009-06-25 04:17 -------- d-----w- c:\program files\Trend Micro 2009-06-24 01:39 . 2009-06-27 22:12 -------- d-----w- c:\documents and settings\CT\SecurityScans 2009-06-24 01:38 . 2009-06-24 01:38 -------- d-----w- c:\program files\Microsoft Baseline Security Analyzer 2 2009-06-24 00:57 . 2009-06-24 00:57 -------- d-----w- c:\program files\Belarc 2009-06-24 00:57 . 2008-02-27 20:49 3840 ----a-w- c:\windows\system32\drivers\BANTExt.sys 2009-06-23 00:14 . 2009-06-23 00:14 -------- d-----w- c:\documents and settings\Administrator\Application Data\Webroot 2009-06-08 22:12 . 2009-06-08 22:12 69632 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 4.30.17.0\SetupAdmin.exe 2009-06-06 05:36 . 2009-07-02 23:00 -------- d-----w- c:\documents and settings\CT\Application Data\Vidalia . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-02 23:10 . 2008-07-04 19:28 -------- d-----w- c:\documents and settings\CT\Application Data\tor 2009-06-28 06:38 . 2005-02-02 07:47 73856 ----a-w- c:\documents and settings\CT\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-06-28 03:55 . 2008-09-17 04:14 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2009-06-27 22:08 . 2009-06-27 22:08 160152 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat 2009-06-27 01:05 . 2004-08-10 19:13 77939 ----a-w- c:\windows\PCHEALTH\HELPCTR\OfflineCache\index.dat 2009-06-12 23:45 . 2005-02-03 06:40 -------- d-----w- c:\documents and settings\CT\Application Data\Apple Computer 2009-06-12 23:44 . 2008-12-19 00:07 -------- d-----w- c:\program files\Safari 2009-06-05 17:52 . 2009-03-16 20:18 -------- d-----w- c:\documents and settings\CT\Application Data\MSNInstaller 2009-05-21 21:56 . 2009-05-20 01:11 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-05-20 15:54 . 2009-05-20 01:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-05-16 15:52 . 2007-04-07 01:07 -------- d--h--w- c:\documents and settings\CT\Application Data\Move Networks 2009-05-15 06:32 . 2009-05-15 06:32 -------- d-----w- c:\documents and settings\CT\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1 2009-05-15 06:31 . 2009-05-15 06:31 -------- d-----w- c:\program files\Common Files\Adobe AIR 2009-05-15 06:31 . 2009-05-15 06:32 38208 ----a-w- c:\documents and settings\CT\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe 2009-05-13 05:15 . 2004-08-04 11:00 915456 ----a-w- c:\windows\system32\wininet.dll 2009-05-10 03:37 . 2009-05-10 03:36 -------- d-----w- c:\program files\iTunes 2009-05-10 03:37 . 2009-05-10 03:36 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-05-10 03:37 . 2005-02-03 06:37 -------- d-----w- c:\program files\iPod 2009-05-10 03:37 . 2007-07-14 19:58 -------- d-----w- c:\program files\Common Files\Apple 2009-05-10 03:31 . 2007-07-14 20:01 -------- d-----w- c:\program files\QuickTime 2009-05-10 03:20 . 2009-05-10 03:20 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe 2009-05-07 15:32 . 2004-08-04 11:00 345600 ----a-w- c:\windows\system32\localspl.dll 2009-04-17 12:26 . 2004-08-04 11:00 1847168 ----a-w- c:\windows\system32\win32k.sys 2009-04-15 14:51 . 2004-08-04 11:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll 2005-06-21 04:58 . 2005-06-21 04:58 5737784 ----a-w- c:\program files\xplay_2.1.5.0_enu_update.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Vidalia"="c:\program files\Vidalia Bundle\Vidalia\vidalia.exe" [2007-11-22 12889088] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-04-20 68856] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-27 1232896] "DellSupport"="c:\program files\Dell Support\DSAgnt.exe" [2004-07-19 306688] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "VerizonServicepoint.exe"="c:\program files\Verizon\VSP\VerizonServicepoint.exe" [2007-11-17 2065648] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "OSCD_Creator"="c:\dell\PreODM.EXE" [2004-10-31 408576] "Motive SmartBridge"="c:\progra~1\Verizon\SMARTB~1\MotiveSB.exe" [2006-06-23 438359] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Elements 5.0\apdproxy.exe" [2006-09-14 61440] "SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2008-01-05 5367664] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-27 1232896] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-12-29 24576] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 5:45 AM 13088] S3 hamachi_oem;PlayLinc Adapter;c:\windows\SYSTEM32\DRIVERS\gan_adapter.sys [9/27/2006 5:12 PM 10664] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\SYSTEM32\DRIVERS\nmwcdnsu.sys [7/1/2008 7:45 PM 138112] S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\SYSTEM32\DRIVERS\nmwcdnsuc.sys [7/1/2008 7:45 PM 8320] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-03-16 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2009-03-16 17:53] . - - - - ORPHANS REMOVED - - - - SafeBoot-svcWRSSSDK . ------- Supplementary Scan ------- . uStart Page = about:blank mSearch Bar = uSearchURL,(Default) = hxxp://www.google.com/search?q=%s Trusted Zone: aaa.com\www Trusted Zone: turbotax.com FF - ProfilePath - c:\documents and settings\CT\Application Data\Mozilla\Firefox\Profiles\jemu7mak.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.search.selectedEngine - Google FF - plugin: c:\documents and settings\CT\Application Data\Mozilla\Firefox\Profiles\jemu7mak.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-02 16:40 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(644) c:\windows\system32\WRLogonNTF.dll . Completion time: 2009-07-02 16:43 ComboFix-quarantined-files.txt 2009-07-02 23:43 Pre-Run: 16,458,563,584 bytes free Post-Run: 16,433,274,880 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 175 --- E O F --- 2009-06-28 06:50 |
|
|
|
|
Jul 3 2009, 01:03 AM
Post
#4
|
|
|
Trusted Helper Posts: 7,987 OS: XP Pro |
Hello dogster,
Your Adobe Acrobat Reader is out of date. Older versions are vunerable to attack. Please go to the link below to update. http://www.adobe.com/products/acrobat/readstep2.html Next Kaspersky on line scanner is very thorough. It can take a long time and for periods may seem not to be working. Just be patient and let it do its job. Kaspersky works with Internet Explorer and Firefox 3. It uses Java Runtime Environment (JRE) Java 1.6.0_7 or later.[/ If your version of Java does not comply, please download JavaRa to your desktop and unzip it to its own folder
Now go to Kaspersky website and perform an online antivirus scan. Note: you will need to turn off your security programs to allow Kaspersky to do its job.
|
|
|
|
|
Jul 3 2009, 01:05 AM
Post
#5
|
|
|
Trusted Helper Posts: 7,987 OS: XP Pro |
Hello dogster,
Your Adobe Acrobat Reader is out of date. Older versions are vunerable to attack. Please go to the link below to update. http://www.adobe.com/products/acrobat/readstep2.html Next Kaspersky on line scanner is very thorough. It can take a long time and for periods may seem not to be working. Just be patient and let it do its job. Kaspersky works with Internet Explorer and Firefox 3. It uses Java Runtime Environment (JRE) Java 1.6.0_7 or later.[/ If your version of Java does not comply, please download JavaRa to your desktop and unzip it to its own folder
Now go to Kaspersky website and perform an online antivirus scan. Note: you will need to turn off your security programs to allow Kaspersky to do its job.
|
|
|
|
|
Jul 3 2009, 01:07 AM
Post
#6
|
|
|
Trusted Helper Posts: 7,987 OS: XP Pro |
Hello dogster,
Your Adobe Acrobat Reader is out of date. Older versions are vunerable to attack. Please go to the link below to update. http://www.adobe.com/products/acrobat/readstep2.html Next Kaspersky on line scanner is very thorough. It can take a long time and for periods may seem not to be working. Just be patient and let it do its job. Kaspersky works with Internet Explorer and Firefox 3. It uses Java Runtime Environment (JRE) Java 1.6.0_7 or later.[/ If your version of Java does not comply, please download JavaRa to your desktop and unzip it to its own folder
Now go to Kaspersky website and perform an online antivirus scan. Note: you will need to turn off your security programs to allow Kaspersky to do its job.
|
|
|
|
|
Jul 3 2009, 10:22 PM
Post
#7
|
|
|
Member Posts: 13 OS: XP |
Hi emeraldnzl -- Ran the Kaspersky scan and no malware was found. I'm assuming since the scan was 'clean' that no log file was generated because when I clicked on 'view scan report' there was nothing listed. Am I assuming correctly or did I do something wrong? Also, I did update Adobe reader. Thanks for your time. |
|
|
|
|
Jul 3 2009, 11:47 PM
Post
#8
|
|
|
Trusted Helper Posts: 7,987 OS: XP Pro |
Hi dogster,
Sorry about the multiple posts. Seems to happen now and then... must be a bug in the system somewhere. QUOTE Am I assuming correctly or did I do something wrong? Usually it will produce a log, even if it is clean but not to worry, just as long as it was clean. Now You have used Malwarebytes before. If you still have it on your machine please update and run. Post the scan report back here. If you no-longer have Malwarebytes please download from Here Double Click mbam-setup.exe to install the application.
Extra Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. When you return please post
|
|
|
|
|
Jul 4 2009, 10:33 AM
Post
#9
|
|
|
Member Posts: 13 OS: XP |
Hi emeraldnzl Malwarebyte's scan is clean (yea!). I no longer see the odd file names when I shut down the computer. The one issue that did bother me is that I never saw a slow down in my computer when my computer was infected. Thanks for your time. Malwarebytes' Anti-Malware 1.38 Database version: 2372 Windows 5.1.2600 Service Pack 3 7/4/2009 9:53:08 AM mbam-log-2009-07-04 (09-53-07).txt Scan type: Quick Scan Objects scanned: 102225 Time elapsed: 11 minute(s), 34 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) |
|
|
|
|
Jul 4 2009, 03:59 PM
Post
#10
|
|
|
Trusted Helper Posts: 7,987 OS: XP Pro |
Hello again dogster,
I think your machine is clean now.  We have a couple of last steps to perform and then you're all set.  Follow these steps to uninstall Combofix and tools used in the removal of malware. This will also clean out and reset your Restore Points.
Step 2
MBAM can be uninstalled via control panel add/remove but it may be a useful tool to keep. Erunt can also be uninstalled via the add/remove programs utility, for some though, it may be a useful backup program to hold on to. ------------------------------------------------------------------------------------------------------------------- A reminder now: Remember to turn back on any anti-malware programs you may have turned off during the cleaning process. ------------------------------------------------------------------------------------------------------------------- Now that you are clean here are some things I think are worth having a look at: --------------------------------------------------------------------------------------------------------------------- Be sure and give the Temp folders a cleaning out now and then. This helps with security and your computer will run more efficiently. I clean mine once a week. For ease of use, you might consider the following free program: -------------------------------------------------------------------------------------------------------------------- A great way to check that your Microsoft and Java have the latest updates is to go to Software Inspector at Secunia. I do this weekly. Not only do they tell you which programs need updating but they give you the link to follow. To bolster your security go to Secunia.com to ensure essential programs are up to date. --------------------------------------------------------------------------------------------------------------------- Make Internet Explorer more secure
* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future. * Consider using an alternate browser. Mozilla's Firefox browser is excellant; it is more secure than Internet Explorer. Firefox is my default browser but I retain Internet Explorer as well so that I can access the very few sites that require it. Firefox may be downloaded from Here ----------------------------------------------------------------------------------------------------------------------- Startuplite is a tool to help you stop some programs not needed when you start your computer from loading. They will begin automatically only when needed. ----------------------------------------------------------------------------------------------------------------------- To help protect your computer in the future here are some free programs you can look at:
To learn more about how to protect yourself while on the internet read this article by Tony Klein: So how did I get infected in the first place? Have a safe and happy computing day! |
|
|
|
|
Jul 5 2009, 06:35 PM
Post
#11
|
|
|
Member Posts: 13 OS: XP |
Great! Thanks again!!! |
|
|
|
|
Jul 5 2009, 07:27 PM
Post
#12
|
|
|
Trusted Helper Posts: 7,987 OS: XP Pro |
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic. |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
Similar Topics
| Topic Title | Replies / Views | Topic Information | |||||
|---|---|---|---|---|---|---|---|
 |
2 / 337 | 16th August 2007 - 11:39 AM ghrgrimreaper started - last by ghrgrimreaper |
|||||
 |
 |
17 / 677 | 22nd November 2008 - 11:47 PM Valoni started - last by Jimmy2012 |
||||
|
1 / 137 | 2nd March 2009 - 08:58 PM delao started - last by delao |
|||||
|
16 / 596 | 27th March 2009 - 02:29 PM tomj25 started - last by Rorschach112 |
|||||
|
Time is now: 7th November 2009 - 08:18 PM |
Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks mentioned on this page are the property of their respective owners.
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy | Advertising