Win32/Rootkit.Agent.ODG and maybe more [Solved] |
Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!
|
|
|
  |
 May 6 2009, 03:43 PM
Post
#1
|
|
|
Member  Posts: 28 OS: Windows XP  |
Two days ago I noticed computer started slowing down, folders took to long to open and an error message "Google installer had to shut down" kept popping up. Also, Spybot could not load. I followed the instructions in the Malware-Spyware-Cleaning-Guide. mbam found C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot. Rebooted as asked and run it again. Trojan.Agent was still there.
Then scanned with ESET, found Operating memory Win32/Rootkit.Agent.ODG trojan unable to clean. Ad-awre and Spybot (that now could load) found nothing that could not remove. Computer started speeding up, folders opened at once, so I thought I got rid of it. Then, I tried to burn a DVD (I had a new drive installed a few days ago). A message popped up "Ask the Administrator for permission to burn CDs/DVDs". I did that, rebooted as asked, but still could not burn any DVDs. I opened Disk Management only to find out that none of the Hard Drives are listed, only DVDrom drives. Also, noticed that file extentions are no longer shown (I always unmark the option "hide file extentions for known filetypes"). So I started all over again. mbam log Malwarebytes' Anti-Malware 1.36 Database version: 2085 Windows 5.1.2600 Service Pack 2 06/05/2009 23:22:11 mbam-log-2009-05-06 (23-22-11).txt Scan type: Quick Scan Objects scanned: 74511 Time elapsed: 1 minute(s), 16 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Delete on reboot. ESET scan Win32/Rootkit.Agent.ODG trojan is no longer found in my system. Rooter log Microsoft Windows XP Professional (5.1.2600) Service Pack 2 A:\ [Removable] (Total:0 Mo/Free:0 Mo) C:\ [Fixed] - NTFS - (Total:40962 Mo/Free:3032 Mo) D:\ [Fixed] - NTFS - (Total:111662 Mo/Free:593 Mo) E:\ [Fixed] - NTFS - (Total:476937 Mo/Free:1351 Mo) F:\ [Fixed] - NTFS - (Total:305242 Mo/Free:3851 Mo) G:\ [CD-Rom] (Total:0 Mo/Free:0 Mo) H:\ [Fixed] - NTFS - (Total:715402 Mo/Free:824 Mo) I:\ [Fixed] - NTFS - (Total:953867 Mo/Free:1970 Mo) J:\ [CD-Rom] (Total:0 Mo/Free:0 Mo) 07/05/2009| 0:06 ----------------------\\ Processes.. --Locked-- [System Process] ---------- System ---------- \SystemRoot\System32\smss.exe ---------- \??\C:\WINDOWS\system32\csrss.exe ---------- \??\C:\WINDOWS\system32\winlogon.exe ---------- C:\WINDOWS\system32\services.exe ---------- C:\WINDOWS\system32\lsass.exe ---------- C:\WINDOWS\system32\Ati2evxx.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\System32\svchost.exe ---------- C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe ---------- C:\WINDOWS\system32\Ati2evxx.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe ---------- C:\WINDOWS\system32\spoolsv.exe ---------- C:\WINDOWS\Explorer.EXE ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\Program Files\ESET\ESET Smart Security\ekrn.exe ---------- C:\WINDOWS\RTHDCPL.EXE ---------- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe ---------- C:\Program Files\Unlocker\UnlockerAssistant.exe ---------- C:\Program Files\ESET\ESET Smart Security\egui.exe ---------- C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE ---------- C:\WINDOWS\system32\ctfmon.exe ---------- C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe ---------- C:\Program Files\Java\jre6\bin\jqs.exe ---------- C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe ---------- C:\Program Files\TGTSoft\StyleXP\StyleXP.exe ---------- C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe ---------- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE ---------- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe ---------- C:\WINDOWS\system32\IoctlSvc.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\wdfmgr.exe ---------- C:\WINDOWS\system32\wbem\unsecapp.exe ---------- C:\WINDOWS\System32\alg.exe ---------- C:\WINDOWS\system32\wbem\wmiprvse.exe ---------- C:\Program Files\Windows Live\Contacts\wlcomm.exe ---------- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe ---------- C:\Program Files\OperaClean\opera.exe ---------- C:\WINDOWS\system32\NOTEPAD.EXE ---------- D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\DOWNLOAD_MANAGERS\RapidShare Manager\RapidShare Manager.exe ---------- C:\DOCUME~1\araxnaki\LOCALS~1\Temp\RarSFX0\RapidShareManager.exe ---------- C:\WINDOWS\system32\mmc.exe ---------- C:\WINDOWS\system32\dmremote.exe ---------- C:\WINDOWS\System32\dmadmin.exe ---------- C:\WINDOWS\system32\DllHost.exe ---------- C:\WINDOWS\system32\cmd.exe ---------- C:\Rooter$\RK.exe ----------------------\\ Search.. ----------------------\\ ROOTKIT !! 1 - "C:\Rooter$\Rooter_1.txt" - 07/05/2009| 0:06 ----------------------\\ Scan completed at 0:06 OTListIt2 Log Created only an OTListIt.txt and no Extras.txt OTListIt logfile created on: 07/05/2009 00:40:50 - Run 3 OTListIt2 by OldTimer - Version 2.0.15.3 Folder = C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000408 | Country: Ελλάδα | Language: ELL | Date Format: dd/MM/yyyy 2,00 Gb Total Physical Memory | 1,24 Gb Available Physical Memory | 62,19% Memory free 3,85 Gb Paging File | 3,30 Gb Available in Paging File | 85,66% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 40,00 Gb Total Space | 22,96 Gb Free Space | 57,39% Space Free | Partition Type: NTFS Drive D: | 109,05 Gb Total Space | 52,58 Gb Free Space | 48,22% Space Free | Partition Type: NTFS Drive E: | 465,76 Gb Total Space | 233,32 Gb Free Space | 50,09% Space Free | Partition Type: NTFS Drive F: | 298,09 Gb Total Space | 203,76 Gb Free Space | 68,36% Space Free | Partition Type: NTFS G: Drive not present or media not loaded Drive H: | 698,64 Gb Total Space | 584,81 Gb Free Space | 83,71% Space Free | Partition Type: NTFS Drive I: | 931,51 Gb Total Space | 1,92 Gb Free Space | 0,21% Space Free | Partition Type: NTFS Computer Name: ANARXAKI Current User Name: araxnaki Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Minimal File Age = 30 Days Company Name Whitelist: On ========== Processes (SafeList) ========== PRC - C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.) PRC - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe () PRC - C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.) PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft) PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation) PRC - C:\Program Files\ESET\ESET Smart Security\ekrn.exe (ESET) PRC - C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.) PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation) PRC - C:\Program Files\Unlocker\UnlockerAssistant.exe () PRC - C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET) PRC - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE () PRC - C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe (Microsoft Corporation) PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.) PRC - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.) PRC - C:\Program Files\TGTSoft\StyleXP\StyleXP.exe () PRC - C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe (TuneUp Software GmbH) PRC - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) PRC - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG) PRC - C:\WINDOWS\system32\IoctlSvc.exe (Prolific Technology Inc.) PRC - C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation) PRC - C:\WINDOWS\system32\wbem\unsecapp.exe (Microsoft Corporation) PRC - C:\WINDOWS\system32\wbem\wmiprvse.exe (Microsoft Corporation) PRC - C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation) PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft) PRC - D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\DOWNLOAD_MANAGERS\RapidShare Manager\RapidShare Manager.exe () PRC - C:\Documents and Settings\araxnaki\Local Settings\Temp\RarSFX0\RapidShareManager.exe (RapidShare AG) PRC - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG) PRC - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG) PRC - C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\OTListIt2.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation) SRV - (Ati HotKey Poller [Auto | Running]) -- C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.) SRV - (ATI Smart [Auto | Stopped]) -- C:\WINDOWS\system32\ati2sgag.exe () SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (EhttpSrv [On_Demand | Stopped]) -- C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe (ESET) SRV - (ekrn [Auto | Running]) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe (ESET) SRV - (FLEXnet Licensing Service [On_Demand | Stopped]) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.) SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation) SRV - (IJPLMSVC [Auto | Running]) -- C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE () SRV - (JavaQuickStarterService [Auto | Running]) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.) SRV - (Lavasoft Ad-Aware Service [Auto | Running]) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft) SRV - (MDM [Auto | Running]) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) SRV - (Nero BackItUp Scheduler 3 [Auto | Running]) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG) SRV - (NMIndexingService [On_Demand | Running]) -- C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG) SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (PLFlash DeviceIoControl Service [Auto | Running]) -- C:\WINDOWS\system32\IoctlSvc.exe (Prolific Technology Inc.) SRV - (StyleXPService [Auto | Running]) -- C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe () SRV - (TuneUp.Defrag [On_Demand | Stopped]) -- C:\WINDOWS\System32\TuneUpDefragService.exe (TuneUp Software GmbH) SRV - (UMWdf [Auto | Running]) -- C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation) SRV - (UxTuneUp [Auto | Running]) -- C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software GmbH) ========== Driver Services (SafeList) ========== DRV - (ati2mtag [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.) DRV - (eamon [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\eamon.sys (ESET) DRV - (ehdrv [System | Running]) -- C:\WINDOWS\system32\DRIVERS\ehdrv.sys (ESET) DRV - (epfw [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\epfw.sys (ESET) DRV - (Epfwndis [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\Epfwndis.sys (ESET) DRV - (epfwtdi [System | Running]) -- C:\WINDOWS\system32\DRIVERS\epfwtdi.sys (ESET) DRV - (HdAudAddService [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\AtiHdAud.sys (ATI Research Inc.) DRV - (HDAudBus [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider) DRV - (IntcAzAudAddService [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (Lbd [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB) DRV - (naqvswe [Unknown | Running]) -- File not found DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.) DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions) DRV - (RTLE8023xp [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys (Realtek Semiconductor Corporation ) DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys () DRV - (StyleXPHelper [System | Running]) -- C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe (Windows ® 2000 DDK provider) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...ER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/04/06 11:57:04 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/09 02:16:51 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/04/09 02:16:40 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\PROGRAM FILES\ESET\ESET SMART SECURITY\MOZILLA THUNDERBIRD [2009/04/09 02:18:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\araxnaki\Application Data\mozilla\Firefox\Profiles\bslm7ubj.default\extensions [2009/04/09 02:18:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\araxnaki\Application Data\mozilla\Firefox\Profiles\bslm7ubj.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a} [2009/04/09 02:16:43 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2009/04/09 02:16:40 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/04/09 02:16:43 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\talkback@mozilla.org [2008/04/07 10:37:09 | 00,067,696 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\jar50.dll [2008/04/07 10:37:09 | 00,054,376 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\jsd3250.dll [2008/04/07 10:37:09 | 00,034,952 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\myspell.dll [2008/04/07 10:37:09 | 00,046,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\spellchk.dll [2008/04/07 10:37:09 | 00,172,144 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\xpinstal.dll [2006/06/01 02:17:38 | 00,001,527 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml [2006/07/06 08:44:17 | 00,002,206 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml [2006/06/01 02:17:38 | 00,001,049 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml [2006/06/01 02:17:38 | 00,001,063 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml [2007/01/18 01:05:32 | 00,002,368 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2006/09/11 17:19:18 | 00,000,806 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml O1 HOSTS File: (306194 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 10536 more lines... O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Βοηθός εισόδου του Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Alcmtr] ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice (ESET) O4 - HKLM..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup (InstallShield Software Corporation) O4 - HKLM..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start (InstallShield Software Corporation) O4 - HKLM..\Run: [RTHDCPL] RTHDCPL.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SkyTel] SkyTel.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" () O4 - HKCU..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (Microsoft Corporation) O4 - HKCU..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (Microsoft Corporation) O4 - HKCU..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide () O4 - HKCU..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" autostart (TuneUp Software GmbH) O4 - HKCU..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (Yahoo! Inc.) O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html (Adobe Systems Incorporated) O8 - Extra context menu item: Ε&ξαγωγή στο Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation) O9 - Extra Button: Έρευνα - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKCU\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://go.microsoft.com/fwlink/?linkid=58813 (Office Genuine Advantage Validation Tool) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool) O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} http://go.microsoft.com/fwlink/?LinkId=82580 (Microsoft Genuine Advantage Self Support Tool) O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1238977614281 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab (MessengerStatsClient Class) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab (Minesweeper Flags Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Interfaces\{4C6BC589-1448-4AE5-A363-B44B58643875}\\NameServer = 194.219.227.2,193.92.150.3 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Τρέχουσα αρχική σελίδα) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/04/05 23:20:03 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{2afb16ea-2b6f-11de-87a0-003018aefc27}\Shell\AutoRun\command - "" = I:\setupSNK.exe -- File not found O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe () ========== Files/Folders - Created Within 30 Days ========== [1 C:\WINDOWS\System32\*.tmp files] [3 C:\WINDOWS\*.tmp files] [2009/05/07 00:24:16 | 00,501,248 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\OTListIt2.exe [2009/05/07 00:10:36 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\tdztf.sys [2009/05/07 00:05:06 | 00,000,000 | ---D | C] -- C:\Rooter$ [2009/05/07 00:04:58 | 00,267,612 | ---- | C] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\Rooter.exe [2009/05/06 23:19:44 | 02,967,800 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\mbam-setup.exe [2009/05/06 23:19:19 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\06-05-2009 [2009/05/06 23:18:45 | 00,000,611 | ---- | C] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\NTREGOPT.lnk [2009/05/06 23:18:45 | 00,000,592 | ---- | C] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\ERUNT.lnk [2009/05/06 23:18:14 | 00,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\erunt_setup.exe [2009/05/06 23:17:23 | 00,021,504 | ---- | C] (Doug Knox) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\SysRestorePoint.exe [2009/05/06 23:12:50 | 00,000,045 | ---- | C] () -- C:\TEST.XML [2009/04/26 17:23:31 | 00,000,000 | ---D | C] -- C:\Program Files\ReflexiveArcade [2009/04/18 20:13:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Τα έγγραφά μου\Downloads [2009/04/18 13:40:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Application Data\Google [2009/04/18 13:37:47 | 00,000,000 | ---D | C] -- C:\Program Files\Google [2009/04/12 02:07:16 | 00,000,081 | ---- | C] () -- C:\GTvSScript.ini [2009/04/12 02:07:10 | 00,000,000 | ---D | C] -- C:\WINDOWS\Subtitle Workshop GTvS Edition [2009/04/12 02:07:10 | 00,000,000 | ---D | C] -- C:\Program Files\URUSoft [2009/04/11 01:21:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\nzb [2009/04/11 01:21:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\ccf [2009/04/10 09:38:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Application Data\Canon [2009/04/09 02:17:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Application Data\Talkback [2009/04/09 02:16:53 | 00,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2009/04/09 02:16:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Application Data\Mozilla [2009/04/09 02:16:39 | 00,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2009/04/09 00:17:55 | 00,000,000 | ---D | C] -- C:\Program Files\PIM [2009/04/08 23:26:54 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Live Safety Center [2009/04/08 06:44:32 | 00,000,000 | ---D | C] -- C:\Program Files\OperaClean [2009/04/07 20:32:13 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009/04/07 18:52:06 | 00,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0 [2009/04/07 18:46:40 | 02,295,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\TUKernel.exe [2009/04/07 18:37:13 | 00,268,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll [2009/04/07 18:37:13 | 00,208,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\muweb.dll [2009/04/07 18:29:13 | 00,306,432 | ---- | C] (TuneUp Software GmbH) -- C:\WINDOWS\System32\TuneUpDefragService.exe [2009/04/07 18:29:10 | 00,029,440 | ---- | C] (TuneUp Software GmbH) -- C:\WINDOWS\System32\uxtuneup.dll [2009/04/07 18:24:46 | 00,000,472 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job [2009/04/07 18:24:06 | 24,921,544 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe [2009/04/07 18:19:29 | 00,000,000 | ---D | C] -- C:\Program Files\ESET [2009/04/07 18:15:38 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800} [2009/04/07 18:15:19 | 00,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy [2009/04/07 18:03:00 | 00,000,000 | ---D | C] -- C:\Program Files\IEInspector [2009/04/07 18:03:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Τα έγγραφά μου\IEInspector [2009/04/07 17:59:26 | 00,000,000 | ---D | C] -- C:\Program Files\HTTP Debugger Pro [2009/04/07 17:07:39 | 00,000,000 | ---D | C] -- C:\Program Files\ESET(2) [2009/04/07 16:19:19 | 00,000,000 | ---D | C] -- C:\Config.Msi [2009/04/07 14:17:50 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData [2009/04/07 04:18:15 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Application Data\Ancient Quest of Saqqarah__cminion [2009/04/07 04:18:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Application Data\StoneLoops! [2009/04/07 04:18:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Application Data\Saqqarah [2009/04/07 04:18:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Application Data\MagicMatch [2009/04/07 04:17:52 | 00,000,000 | ---D | C] -- C:\Program Files\Ancient Quest of Saqqarah [2009/04/07 00:46:01 | 00,273,152 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthport.sys [2009/04/07 00:46:01 | 00,273,152 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthport.sys [2009/04/07 00:42:35 | 02,187,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntoskrnl.exe [2009/04/07 00:42:35 | 02,143,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlmp.exe [2009/04/07 00:42:35 | 02,064,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlpa.exe [2009/04/07 00:42:34 | 02,022,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrpamp.exe [2009/04/06 10:19:03 | 00,000,380 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009/04/06 10:14:07 | 00,041,472 | ---- | C] () -- C:\WINDOWS\System32\indexudf.dll [2009/04/06 10:13:56 | 00,010,752 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll [2009/02/21 08:25:20 | 00,691,592 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL [2004/09/07 13:00:00 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2004/09/07 13:00:00 | 00,000,653 | ---- | C] () -- C:\WINDOWS\win.ini [2004/09/07 13:00:00 | 00,000,259 | ---- | C] () -- C:\WINDOWS\system.ini [2003/04/24 15:47:04 | 00,005,697 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI ========== Files - Modified Within 30 Days ========== [1 C:\WINDOWS\System32\*.tmp files] [3 C:\WINDOWS\*.tmp files] [2009/05/07 00:24:20 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\OTListIt2.exe [2009/05/07 00:10:36 | 00,061,440 | ---- | M] () -- C:\WINDOWS\System32\drivers\tdztf.sys [2009/05/07 00:04:58 | 00,267,612 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\Rooter.exe [2009/05/06 23:27:57 | 00,002,228 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009/05/06 23:27:15 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\araxnaki\Local Settings\desktop.ini [2009/05/06 23:27:09 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009/05/06 23:19:51 | 02,967,800 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\mbam-setup.exe [2009/05/06 23:18:45 | 00,000,611 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\NTREGOPT.lnk [2009/05/06 23:18:45 | 00,000,592 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\ERUNT.lnk [2009/05/06 23:18:21 | 00,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\erunt_setup.exe [2009/05/06 23:17:23 | 00,021,504 | ---- | M] (Doug Knox) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\SysRestorePoint.exe [2009/05/06 23:12:50 | 00,000,045 | ---- | M] () -- C:\TEST.XML [2009/05/04 10:20:35 | 00,122,880 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\ΠΡΟΟΔΟΣ.xls [2009/05/01 17:16:32 | 00,000,382 | ---- | M] () -- C:\WINDOWS\tasks\1-Click Maintenance.job [2009/04/28 18:22:20 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job [2009/04/21 18:23:06 | 00,015,688 | ---- | M] () -- C:\WINDOWS\System32\lsdelete.exe [2009/04/21 18:22:41 | 00,064,160 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys [2009/04/17 12:24:54 | 02,071,327 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\DSC00951.JPG [2009/04/17 03:16:07 | 00,494,710 | ---- | M] () -- C:\WINDOWS\System32\perfh008.dat [2009/04/17 03:16:07 | 00,392,296 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009/04/17 03:16:07 | 00,080,562 | ---- | M] () -- C:\WINDOWS\System32\perfc008.dat [2009/04/17 03:16:07 | 00,058,596 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2009/04/17 03:16:06 | 01,037,742 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/04/17 03:04:07 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2009/04/12 02:07:16 | 00,000,081 | ---- | M] () -- C:\GTvSScript.ini [2009/04/09 02:16:53 | 00,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat [2009/04/07 19:22:53 | 00,247,904 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009/04/07 18:46:40 | 02,295,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\TUKernel.exe [2009/04/07 18:46:40 | 00,000,389 | RHS- | M] () -- C:\boot.ini [2009/04/07 18:29:13 | 00,306,432 | ---- | M] (TuneUp Software GmbH) -- C:\WINDOWS\System32\TuneUpDefragService.exe < End of report > Can you help me? This post has been edited by anarxaki: May 6 2009, 04:08 PM |
 |
 
|
|
May 6 2009, 04:21 PM
Post
#2
|
|
 GeekU Teacher  Posts: 35,079 From: Dublin OS: XP |
hello
Download ComboFix from one of these locations: Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:  Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply. |
|
|
|
|
May 6 2009, 04:49 PM
Post
#3
|
|
|
Member Posts: 28 OS: Windows XP |
Thank you for the immediate reply
 I downloaded and double clicked ComboFix. exe I wasn't asked about installing Microsoft Windows Recovery Console. When it shutted down the computer, an error message popped up "dwwin.exe failed". ComboFix Log ComboFix 09-05-06.02 - araxnaki 07/05/2009 1:41.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1253.30.1032.18.2046.1634 [GMT 3:00] Running from: c:\documents and settings\araxnaki\Επιφάνεια εργασίας\ComboFix.exe AV: ESET Smart Security 4.0 *On-access scanning disabled* (Outdated) AV: Lavasoft Ad-Watch Live! Anti-Virus *On-access scanning disabled* (Updated) FW: ESET Personal firewall *enabled* * Resident AV is active WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\drivers\UACqqegupdiuymmpgx.sys c:\windows\system32\UACcgixqnawoaivdkh.dll c:\windows\system32\UACexcjhlhxireruve.log c:\windows\system32\UACpjyhflxcgvhisil.dll c:\windows\system32\UACuemyvdrmajhmfcp.log c:\windows\system32\UACvtxuiufdcpcsqmo.dll c:\windows\system32\UACwaossionkwkwbgy.dll c:\windows\system32\UACxbeitmixcveivlo.dll c:\windows\system32\UACyeeumaemeuhamvc.dat c:\windows\system32\UACygxludywmhqvsae.log c:\windows\system32\UACyxrmctqfjqtcvlg.db c:\windows\system32\UACyyglgwlwoudejhp.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_UACd.sys ((((((((((((((((((((((((( Files Created from 2009-04-06 to 2009-05-06 ))))))))))))))))))))))))))))))) . 2009-05-02 11:53 . 2009-05-02 11:53 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\Google 2009-05-02 02:01 . 2009-05-02 02:01 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\ESET 2009-05-01 22:25 . 2009-05-01 22:25 -------- d-----w c:\documents and settings\araxnaki\Local Settings\Application Data\ESET 2009-04-26 14:25 . 2009-04-26 14:26 -------- d-----w c:\documents and settings\araxnaki\uspy 2009-04-26 14:23 . 2009-04-26 14:23 -------- d-----w c:\program files\ReflexiveArcade 2009-04-18 10:39 . 2009-04-18 10:39 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\Google 2009-04-18 10:39 . 2009-04-18 17:13 -------- d-----w c:\documents and settings\araxnaki\Local Settings\Application Data\Google 2009-04-18 10:37 . 2009-04-06 01:03 -------- d-----w c:\program files\Google 2009-04-11 23:07 . 2009-04-11 23:07 -------- d-----w c:\windows\Subtitle Workshop GTvS Edition 2009-04-11 23:07 . 2009-04-11 23:07 -------- d-----w c:\program files\URUSoft 2009-04-10 06:38 . 2009-04-10 06:38 -------- d-----w c:\documents and settings\araxnaki\Application Data\Canon 2009-04-08 23:17 . 2009-04-08 23:17 -------- d-----w c:\documents and settings\araxnaki\Application Data\Talkback 2009-04-08 23:16 . 2009-04-08 23:16 0 ----a-w c:\windows\nsreg.dat 2009-04-08 23:16 . 2009-04-08 23:16 -------- d-----w c:\documents and settings\araxnaki\Local Settings\Application Data\Mozilla 2009-04-08 21:17 . 2009-04-08 21:45 -------- d-----w c:\program files\PIM 2009-04-08 20:26 . 2009-05-03 22:19 -------- d-----w c:\program files\Windows Live Safety Center 2009-04-08 03:44 . 2009-05-06 22:29 -------- d-----w c:\program files\OperaClean 2009-04-07 20:05 . 2009-04-07 20:05 -------- d-----w c:\documents and settings\araxnaki\Local Settings\Application Data\containerex.info 2009-04-07 15:52 . 2009-04-07 15:52 -------- d-----w c:\program files\MSXML 4.0 2009-04-07 15:46 . 2009-04-07 15:46 2295296 ----a-w c:\windows\system32\TUKernel.exe 2009-04-07 15:37 . 2008-10-16 11:06 208744 ----a-w c:\windows\system32\muweb.dll 2009-04-07 15:37 . 2008-10-16 11:06 268648 ----a-w c:\windows\system32\mucltui.dll 2009-04-07 15:29 . 2009-04-07 15:29 306432 ----a-w c:\windows\system32\TuneUpDefragService.exe 2009-04-07 15:29 . 2007-12-20 07:41 29440 ----a-w c:\windows\system32\uxtuneup.dll 2009-04-07 15:19 . 2009-04-07 15:19 -------- d-----w c:\program files\ESET 2009-04-07 15:15 . 2009-04-07 15:15 -------- d--h--w c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800} 2009-04-07 15:15 . 2009-04-07 15:15 -------- d-----w c:\program files\Spybot - Search & Destroy 2009-04-07 15:03 . 2009-04-07 15:03 -------- d-----w c:\program files\IEInspector 2009-04-07 14:59 . 2009-04-07 15:22 -------- d-----w c:\program files\HTTP Debugger Pro 2009-04-07 14:07 . 2009-04-07 15:15 -------- d-----w c:\program files\ESET(2) 2009-04-07 11:17 . 2009-05-06 21:25 -------- d-----w c:\windows\system32\NtmsData 2009-04-07 01:18 . 2009-04-08 02:12 -------- d-----w c:\documents and settings\araxnaki\Application Data\Ancient Quest of Saqqarah__cminion 2009-04-07 01:18 . 2009-04-07 01:18 -------- d-----w c:\documents and settings\araxnaki\Application Data\MagicMatch 2009-04-07 01:18 . 2009-04-07 01:18 -------- d-----w c:\documents and settings\araxnaki\Application Data\StoneLoops! 2009-04-07 01:18 . 2009-04-07 01:18 -------- d-----w c:\documents and settings\araxnaki\Application Data\Saqqarah 2009-04-07 01:17 . 2009-04-08 02:09 -------- d-----w c:\program files\Ancient Quest of Saqqarah . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-05-06 20:20 . 2009-04-06 09:54 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-05-06 20:18 . 2009-04-06 09:52 -------- d-----w c:\program files\ERUNT 2009-05-02 13:55 . 2009-04-06 07:04 -------- d-----w c:\program files\SCREEN2EXE 2009-04-21 15:23 . 2009-04-06 10:03 15688 ----a-w c:\windows\system32\lsdelete.exe 2009-04-21 15:22 . 2009-04-06 09:45 64160 ----a-w c:\windows\system32\drivers\Lbd.sys 2009-04-17 00:16 . 2004-09-07 10:00 80562 ----a-w c:\windows\system32\perfc008.dat 2009-04-17 00:16 . 2004-09-07 10:00 494710 ----a-w c:\windows\system32\perfh008.dat 2009-04-12 06:58 . 2009-04-06 00:22 -------- d-----w c:\program files\Aspell 2009-04-08 01:45 . 2009-04-06 00:12 -------- d-----w c:\program files\Opera 2009-04-07 16:23 . 2009-04-05 23:31 65616 ----a-w c:\documents and settings\araxnaki\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-04-07 15:53 . 2009-04-06 08:37 -------- d-----w c:\program files\Microsoft Works 2009-04-07 15:29 . 2009-04-06 10:58 -------- d-----w c:\program files\TuneUp Utilities 2008 2009-04-07 13:37 . 2009-04-06 09:28 -------- d-----w c:\program files\Lavasoft 2009-04-07 10:24 . 2009-04-06 07:08 -------- d-----w c:\program files\AVI2Clipboard 2009-04-06 15:23 . 2009-04-06 15:17 -------- d-----w c:\program files\coolpro2 2009-04-06 12:32 . 2009-04-06 09:54 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-04-06 12:32 . 2009-04-06 09:54 15504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-04-06 10:57 . 2009-04-06 10:57 -------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-04-06 09:49 . 2009-04-06 07:15 -------- d-----w c:\program files\Unlocker 2009-04-06 09:03 . 2009-04-06 09:03 -------- d-----w c:\program files\NeroInstall.bak 2009-04-06 09:02 . 2009-04-06 09:01 -------- d-----w c:\program files\Common Files\Nero 2009-04-06 09:01 . 2009-04-06 09:01 -------- d-----w c:\program files\Nero 2009-04-06 08:57 . 2009-04-06 08:57 410984 ----a-w c:\windows\system32\deploytk.dll 2009-04-06 08:36 . 2009-04-06 08:36 -------- d-----w c:\program files\Microsoft.NET 2009-04-06 08:36 . 2009-04-06 08:01 -------- d-----w c:\program files\File Scavenger 3.2 2009-04-06 08:00 . 2009-04-06 00:22 -------- d-----w c:\program files\Java 2009-04-06 07:50 . 2009-04-06 07:29 -------- d-----w c:\program files\Common Files\Adobe 2009-04-06 07:35 . 2009-04-06 07:35 -------- d-----w c:\program files\Common Files\Macrovision Shared 2009-04-06 07:21 . 2009-04-06 07:21 -------- d-----w c:\program files\TGTSoft 2009-04-06 07:14 . 2009-04-06 07:14 -------- d-----w c:\program files\Dictionaries Explorer II 2009-04-06 07:06 . 2009-04-06 07:05 -------- d-----w c:\program files\The KMPlayer 2009-04-06 07:04 . 2009-04-06 07:04 -------- d-----w c:\program files\%ramdrv%Image_Grabber_II 2009-04-06 07:03 . 2009-04-06 07:03 -------- d-----w c:\program files\Common Files\ACD Systems 2009-04-06 07:03 . 2009-04-06 07:03 -------- d-----w c:\program files\ACD Systems 2009-04-06 07:00 . 2009-04-06 06:55 -------- d-----w c:\program files\Tunatic 2009-04-06 06:53 . 2009-04-06 06:52 -------- d-----w c:\program files\Winamp 2009-04-06 06:51 . 2009-04-06 06:51 -------- d-----w c:\program files\GrabIt 2009-04-06 06:29 . 2009-04-06 06:28 -------- d-----w c:\program files\uTorrent 2009-04-06 06:21 . 2009-04-06 06:21 -------- d-----w c:\program files\Yahoo! 2009-04-06 06:18 . 2009-04-06 00:49 -------- d-----w c:\program files\Messenger Plus! Live 2009-04-06 00:55 . 2009-04-06 00:55 -------- d-----w c:\program files\Microsoft 2009-04-06 00:55 . 2009-04-06 00:55 -------- d-----w c:\program files\Windows Live SkyDrive 2009-04-06 00:55 . 2009-04-06 00:41 -------- d-----w c:\program files\Windows Live 2009-04-06 00:54 . 2009-04-06 00:54 -------- d-----w c:\program files\Common Files\Windows Live 2009-04-06 00:44 . 2009-04-06 00:42 -------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller 2009-04-06 00:22 . 2009-04-06 00:22 -------- d-----w c:\program files\Common Files\Java 2009-04-05 23:56 . 2009-04-05 23:49 -------- d-----w c:\program files\Canon 2009-04-05 23:50 . 2009-04-05 23:50 -------- d--h--w c:\program files\CanonBJ 2009-04-05 23:36 . 2009-04-05 23:36 -------- d-----w c:\program files\Microsoft Hardware 2009-04-05 23:28 . 2009-04-05 23:28 0 ----a-w c:\windows\ativpsrm.bin 2009-04-05 23:21 . 2009-04-05 23:21 -------- d-----w c:\program files\MyGuard 2009-04-05 23:21 . 2009-04-05 23:12 -------- d--h--w c:\program files\InstallShield Installation Information 2009-04-05 23:21 . 2009-04-05 23:12 -------- d-----w c:\program files\Common Files\InstallShield 2009-04-05 23:20 . 2009-04-05 23:19 -------- d-----w c:\program files\Realtek 2009-04-05 23:18 . 2009-04-05 23:18 315392 ----a-w c:\windows\HideWin.exe 2009-04-05 23:12 . 2009-04-05 23:12 -------- d-----w c:\program files\ATI Technologies 2009-04-05 20:50 . 2009-04-05 20:19 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-04-05 20:20 . 2009-04-05 20:20 -------- d-----w c:\program files\microsoft frontpage 2009-04-05 20:19 . 2004-09-07 10:00 67 --sha-w c:\windows\Fonts\desktop.ini 2009-04-05 20:17 . 2009-04-05 20:17 22812 ----a-w c:\windows\system32\emptyregdb.dat 2009-03-19 08:45 . 2009-03-19 08:45 55768 ----a-w c:\windows\system32\drivers\epfwtdi.sys 2009-03-19 08:45 . 2009-03-19 08:45 33096 ----a-w c:\windows\system32\drivers\epfwndis.sys 2009-03-19 08:45 . 2009-03-19 08:45 131976 ----a-w c:\windows\system32\drivers\epfw.sys 2009-03-19 08:44 . 2009-03-19 08:44 107256 ----a-w c:\windows\system32\drivers\ehdrv.sys 2009-03-19 08:41 . 2009-03-19 08:41 113960 ----a-w c:\windows\system32\drivers\eamon.sys 2009-03-06 14:45 . 2004-09-07 10:00 286720 ----a-w c:\windows\system32\pdh.dll 2009-02-21 05:25 . 2009-02-21 05:25 691592 ----a-w c:\windows\system32\OGACheckControl.DLL 2009-02-20 08:31 . 2004-09-07 10:00 665088 ----a-w c:\windows\system32\wininet.dll 2009-02-20 08:31 . 2004-09-07 10:00 81920 ----a-w c:\windows\system32\ieencode.dll 2009-02-09 14:16 . 2004-09-07 10:00 1846528 ----a-w c:\windows\system32\win32k.sys 2009-02-09 11:49 . 2004-09-04 06:41 2022912 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-09 11:49 . 2004-09-07 10:00 2143232 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-09 10:19 . 2004-09-07 10:00 731648 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 10:19 . 2004-09-07 10:00 691712 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 10:19 . 2004-09-07 10:00 399360 ----a-w c:\windows\system32\rpcss.dll 2009-02-09 10:18 . 2004-09-07 10:00 751104 ----a-w c:\windows\system32\ntdll.dll 2009-02-09 10:07 . 2004-09-07 10:00 111104 ----a-w c:\windows\system32\services.exe 2009-02-06 16:54 . 2004-09-07 10:00 35328 ----a-w c:\windows\system32\sc.exe 2009-02-06 15:52 . 2009-02-06 15:52 49504 ----a-w c:\windows\system32\sirenacm.dll 2008-04-07 07:37 . 2009-04-08 23:16 67696 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-04-07 07:37 . 2009-04-08 23:16 54376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-04-07 07:37 . 2009-04-08 23:16 34952 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-04-07 07:37 . 2009-04-08 23:16 46720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-04-07 07:37 . 2009-04-08 23:16 172144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-09-07 15360] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-25 437160] "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704] "STYLEXP"="c:\program files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 1372160] "TuneUp MemOptimizer"="c:\program files\TuneUp Utilities 2008\MemOptimizer.exe" [2007-12-21 196864] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-08-09 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-08-09 81920] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872] "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-03-19 2029640] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-03-21 16126464] "SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2007-03-16 1822720] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-09-07 15360] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service] @="Service" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "Ad-Watch"=c:\program files\Lavasoft\Ad-Aware\AAWTray.exe "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" "NeroFilterCheck"=c:\program files\Common Files\Nero\Lib\NeroCheck.exe "CanonMyPrinter"=c:\program files\Canon\MyPrinter\BJMyPrt.exe /logon "CanonSolutionMenu"=c:\program files\Canon\SolutionMenu\CNSLMAIN.exe /logon "Device Detector"=DevDetect.exe -autorun "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" "IntelliType"="c:\program files\Microsoft Hardware\Keyboard\type32.exe" "WinampAgent"="c:\program files\Winamp\winampa.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Java\\jre1.6.0_03\\launch4j-tmp\\JDownloader.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\Program Files\\uTorrent\\utorrent.exe"= "d:\\ΠΡΟΓΡΑΜΜΑΤΑ\\-=INTERNET=-\\TORRENT CLIENTS\\utorrent\\utorrent 1.6 Leecher Pack 2\\utorrent__1.6__Leeching_Report_FakeUP_2x.exe"= R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [06/04/2009 12:45 64160] R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [19/03/2009 11:44 107256] R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [19/03/2009 11:44 731840] R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [06/04/2009 12:50 953168] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2afb16ea-2b6f-11de-87a0-003018aefc27}] \Shell\AutoRun\command - I:\setupSNK.exe . Contents of the 'Scheduled Tasks' folder 2009-05-01 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2008\OneClick.exe [2007-12-21 12:17] 2009-04-28 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-04-06 15:22] . . ------- Supplementary Scan ------- . IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Ε&ξαγωγή στο Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 TCP: {4C6BC589-1448-4AE5-A363-B44B58643875} = 194.219.227.2,193.92.150.3 FF - ProfilePath - . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-05-07 01:43 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1032) c:\windows\system32\Ati2evxx.dll . Completion time: 2009-05-06 1:44 ComboFix-quarantined-files.txt 2009-05-06 22:44 Pre-Run: 10 Κατάλογοι 24.591.048.704 διαθέσιμα byte Post-Run: 8 Κατάλογοι 24.583.774.208 διαθέσιμα byte 247 --- E O F --- 2009-04-30 00:01 |
|
|
|
|
May 6 2009, 04:51 PM
Post
#4
|
|
|
GeekU Teacher Posts: 35,079 From: Dublin OS: XP |
hello
Please download ATF Cleaner by Atribune.
Under Main choose: Select All Click the Empty Selected button.
Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Please download Malwarebytes' Anti-Malware from Here Double Click mbam-setup.exe to install the application.
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly. Go to Kaspersky website and perform an online antivirus scan.
|
|
|
|
|
May 7 2009, 02:22 AM
Post
#5
|
|
|
Member Posts: 28 OS: Windows XP |
I left it over night to do the online scan. After 8 hours it reached 34%. Is there any faster way to do that?
|
|
|
|
|
May 7 2009, 03:55 AM
Post
#6
|
|
|
GeekU Teacher Posts: 35,079 From: Dublin OS: XP |
not really, it takes a while but is worth it if you can get it done
|
|
|
|
|
May 7 2009, 04:06 AM
Post
#7
|
|
|
Member Posts: 28 OS: Windows XP |
OK. I have nothing too urgent to do on my computer, so I'll let it scan. I'll come back in about 15-20 hours with the result.
Thank you. |
|
|
|
|
May 7 2009, 04:38 AM
Post
#8
|
|
|
GeekU Teacher Posts: 35,079 From: Dublin OS: XP |
perfect
|
|
|
|
|
May 7 2009, 06:05 AM
Post
#9
|
|
|
Member Posts: 28 OS: Windows XP |
Thank God my calculations were wrong. Scanning just finnished.
mbam log Malwarebytes' Anti-Malware 1.36 Database version: 2085 Windows 5.1.2600 Service Pack 2 07/05/2009 01:58:48 mbam-log-2009-05-07 (01-58-48).txt Scan type: Quick Scan Objects scanned: 74075 Time elapsed: 1 minute(s), 51 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Kaspersky Online Scan Log -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0 REPORT Thursday, May 7, 2009 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Wednesday, May 06, 2009 20:06:02 Records in database: 2138404 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ Scan statistics: Files scanned: 149275 Threat name: 13 Infected objects: 33 Suspicious objects: 0 Duration of the scan: 11:41:57 File name / Threat name / Threats count C:\Qoobox\Quarantine\C\WINDOWS\system32\UACcgixqnawoaivdkh.dll.vir Infected: Packed.Win32.Tdss.f 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\UACpjyhflxcgvhisil.dll.vir Infected: Packed.Win32.Tdss.f 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\UACvtxuiufdcpcsqmo.dll.vir Infected: Packed.Win32.Tdss.f 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\UACxbeitmixcveivlo.dll.vir Infected: Packed.Win32.Tdss.f 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\UACyyglgwlwoudejhp.dll.vir Infected: Packed.Win32.Tdss.f 1 D:\FUNNY\Exe\Trick.exe Infected: Hoax.Win32.BadJoke.FakeDel.e 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\DOWNLOAD_MANAGERS\CryptLoad\CryptLoad_1.0.3\router\FRITZ!Box\nc.exe Infected: not-a-virus:RemoteAdmin.Win32.NetCat.a 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\DOWNLOAD_MANAGERS\CryptLoad\CryptLoad_1.0.3.rar Infected: not-a-virus:RemoteAdmin.Win32.NetCat.a 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\DOWNLOAD_MANAGERS\CryptLoad\CryptLoad_1.1.4\router\FRITZ!Box\nc.exe Infected: not-a-virus:RemoteAdmin.Win32.NetCat.a 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\DOWNLOAD_MANAGERS\CryptLoad\CryptLoad_1.1.5.rar Infected: not-a-virus:RemoteAdmin.Win32.NetCat.a 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\DOWNLOAD_MANAGERS\CryptLoad\CryptLoad_1.1.6\router\FRITZ!Box\nc.exe Infected: not-a-virus:RemoteAdmin.Win32.NetCat.a 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\DOWNLOAD_MANAGERS\CryptLoad\CryptLoad_1.1.6.rar Infected: not-a-virus:RemoteAdmin.Win32.NetCat.a 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\DOWNLOAD_MANAGERS\CryptLoad.rar Infected: not-a-virus:RemoteAdmin.Win32.NetCat.a 4 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\DOWNLOAD_MANAGERS\FlashGet\FlashGet 0.94\jetcar.zip Infected: not-a-virus:AdWare.Win32.Aureate.a 5 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\MESSENGERS\MIRC\GAY-ANNA_(the_script_of_the_Damned)\anorimoi script\mirc32.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.59 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\MESSENGERS\MIRC\irc - BOT\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.614 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\MESSENGERS\MIRC\mIRC 6.2\mirc62.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.62 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\MESSENGERS\MIRC\mIRC 6.2.rar Infected: not-a-virus:Client-IRC.Win32.mIRC.62 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\MESSENGERS\MIRC\mirc[1].6.16.keygen-tsrh\mirc617.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.617 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\MESSENGERS\MIRC\polaris.zip Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=PROTECTION=-\Spyware removers\Spyware doctor\Spyware Doctor™ 4.0.0.2618\sdsetup.exe Infected: not-a-virus:Monitor.Win32.KeyLogger.dq 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=WINDOWS=-\MISC\Renaming\BatchRename Pro 3.21\batchrename.pro.3.21-NoPE.exe Infected: Trojan.Win32.Genome.pgm 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=WINDOWS=-\MISC\Windows Key Finder141.zip Infected: not-a-virus:PSWTool.Win32.RAS.a 2 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=WINDOWS=-\WIN XP\Windows Xp Genuine Validation\Η λύση του Tsol\change_windows_xp_serial_valid_serial\keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.g 1 D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=WINDOWS=-\WIN XP\Windows Xp Genuine Validation\Η λύση του Tsol\change_windows_xp_serial_valid_serial\keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.a 1 The selected area was scanned. |
|
|
|
|
May 7 2009, 06:44 AM
Post
#10
|
|
|
GeekU Teacher Posts: 35,079 From: Dublin OS: XP |
hello
Please download OTMoveIt3 by OldTimer
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. Please run the MGA Diagnostic Tool and post back the report it shall produce:
|
|
|
|
|
May 7 2009, 07:10 AM
Post
#11
|
|
|
Member Posts: 28 OS: Windows XP |
OTMoveIt3 log
========== PROCESSES ========== Process explorer.exe killed successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== D:\FUNNY\Exe\Trick.exe moved successfully. D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\MESSENGERS\MIRC\mirc[1].6.16.keygen-tsrh\mirc.6.16.keygen-tsrh moved successfully. D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\MESSENGERS\MIRC\mirc[1].6.16.keygen-tsrh moved successfully. D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=PROTECTION=-\Spyware removers\Spyware doctor\Spyware Doctor™ 4.0.0.2618\sdsetup.exe moved successfully. D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=WINDOWS=-\MISC\Renaming\BatchRename Pro 3.21\batchrename.pro.3.21-NoPE.exe moved successfully. ========== COMMANDS ========== File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\RarSFX0\Interop.IWshRuntimeLibrary.dll scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\RarSFX0\RapidShareManager.exe scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\Arj.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\avlib.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\Avp1.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\AvpMgr.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\btimages.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\CAB.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\dmap.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\dtreg.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\FsDrvPlg.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\FSSync.dll scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\HashCont.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\HashMD5.PPL scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\HCCMP.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\ichk2.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\iChkSA.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\Inflate.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\IWGen.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\kave.dll scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\kosglue-7.0.26.0.dll scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\lha.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\L_llio.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\mdb.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\MDMAP.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\MemModSc.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\MemScan.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\minizip.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\MKavIO.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\msoe.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\nfio.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\NTFSstrm.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\prKernel.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\prLoader.dll scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\prseqio.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\PrUtil.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\Quantum.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\rar.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\ScanningProcess.exe scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\sfdb.PPL scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\TempFile.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\thpimpl.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\UniArc.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\UnLZX.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\UnStored.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\WDiskIO.ppl scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\hsperfdata_araxnaki\1260 scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jar_cache5959764716151285817.tmp scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\Perflib_Perfdata_c84.dat scheduled to be deleted on reboot. User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\araxnaki\Local Settings\Temporary Internet Files\Content.IE5\OZE9WFGZ\CAEHWV8B scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\araxnaki\Local Settings\Temporary Internet Files\Content.IE5\8NSVIHAH\client_ad[1].htm scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\araxnaki\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. User's Temporary Internet Files folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. Network Service Temporary Internet Files folder emptied. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_964.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. FireFox cache emptied. Opera cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05072009_155738 Files moved on Reboot... DllUnregisterServer procedure not found in C:\DOCUME~1\araxnaki\LOCALS~1\Temp\RarSFX0\Interop.IWshRuntimeLibrary.dll C:\DOCUME~1\araxnaki\LOCALS~1\Temp\RarSFX0\Interop.IWshRuntimeLibrary.dll NOT unregistered. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\RarSFX0\Interop.IWshRuntimeLibrary.dll moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\RarSFX0\RapidShareManager.exe moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\Arj.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\avlib.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\Avp1.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\AvpMgr.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\btimages.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\CAB.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\dmap.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\dtreg.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\FsDrvPlg.ppl moved successfully. DllUnregisterServer procedure not found in C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\FSSync.dll C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\FSSync.dll NOT unregistered. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\FSSync.dll moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\HashCont.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\HashMD5.PPL moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\HCCMP.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\ichk2.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\iChkSA.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\Inflate.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\IWGen.ppl moved successfully. DllUnregisterServer procedure not found in C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\kave.dll C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\kave.dll NOT unregistered. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\kave.dll moved successfully. DllUnregisterServer procedure not found in C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\kosglue-7.0.26.0.dll C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\kosglue-7.0.26.0.dll NOT unregistered. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\kosglue-7.0.26.0.dll moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\lha.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\L_llio.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\mdb.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\MDMAP.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\MemModSc.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\MemScan.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\minizip.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\MKavIO.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\msoe.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\nfio.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\NTFSstrm.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\prKernel.ppl moved successfully. DllUnregisterServer procedure not found in C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\prLoader.dll C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\prLoader.dll NOT unregistered. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\prLoader.dll moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\prseqio.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\PrUtil.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\Quantum.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\rar.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\ScanningProcess.exe moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\sfdb.PPL moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\TempFile.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\thpimpl.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\UniArc.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\UnLZX.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\UnStored.ppl moved successfully. C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jkos-araxnaki\binaries\WDiskIO.ppl moved successfully. File C:\DOCUME~1\araxnaki\LOCALS~1\Temp\hsperfdata_araxnaki\1260 not found! File C:\DOCUME~1\araxnaki\LOCALS~1\Temp\jar_cache5959764716151285817.tmp not found! File C:\DOCUME~1\araxnaki\LOCALS~1\Temp\Perflib_Perfdata_c84.dat not found! File C:\Documents and Settings\araxnaki\Local Settings\Temporary Internet Files\Content.IE5\OZE9WFGZ\CAEHWV8B not found! File C:\Documents and Settings\araxnaki\Local Settings\Temporary Internet Files\Content.IE5\8NSVIHAH\client_ad[1].htm not found! File C:\WINDOWS\temp\Perflib_Perfdata_964.dat not found! MGADiag log Diagnostic Report (1.9.0006.1): ----------------------------------------- WGA Data--> Validation Status: Genuine Validation Code: 0 Online Validation Code: N/A Cached Validation Code: N/A Windows Product Key: *****-*****-3R89F-D2KXW-VPK3J Windows Product Key Hash: Ro/Y7HENE9CfW7lW+QtlNbYQEE8= Windows Product ID: 76487-640-8365391-23360 Windows Product ID Type: 1 Windows License Type: Volume Windows OS version: 5.1.2600.2.00010100.2.0.pro ID: {9CF1AB4F-D885-40F3-8956-859EA46E0B4A}(3) Is Admin: Yes TestCab: 0x0 WGA Version: Registered, 1.9.40.0 Signed By: Microsoft Product Name: N/A Architecture: N/A Build lab: N/A TTS Error: N/A Validation Diagnostic: 025D1FF3-230-1 Resolution Status: N/A WgaER Data--> ThreatID(s): N/A Version: N/A WGA Notifications Data--> Cached Result: 0 File Exists: Yes Version: 1.9.40.0 WgaTray.exe Signed By: Microsoft WgaLogon.dll Signed By: Microsoft OGA Notifications Data--> Cached Result: N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 WGATray.exe Signed By: Microsoft OGAAddin.dll Signed By: N/A, hr = 0x80070002 OGA Data--> Office Status: 114 Blocked VLK 2 Microsoft Office Professional Edition 2003 - 114 Blocked VLK 2 OGA Version: Registered, 1.7.111.0 Signed By: Microsoft Office Diagnostics: 025D1FF3-230-1 Browser Data--> Proxy settings: N/A User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe Download signed ActiveX controls: Prompt Download unsigned ActiveX controls: Disabled Run ActiveX controls and plug-ins: Allowed Initialize and script ActiveX controls not marked as safe: Disabled Allow scripting of Internet Explorer Webbrowser control: Disabled Active scripting: Allowed Script ActiveX controls marked as safe for scripting: Allowed File Scan Data--> Other data--> Office Details: <GenuineResults><MachineData><UGUID>{9CF1AB4F-D885-40F3-8956-859EA46E0B4A}</UGUID><Version>1.9.0006.1</Version><OS>5.1.2600.2.00010100.2.0.pro</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-VPK3J</PKey><PID>76487-640-8365391-23360</PID><PIDType>1</PIDType><SID>S-1-5-21-2052111302-1708537768-725345543</SID><SYSTEM><Manufacturer>Unknow</Manufacturer><Model>Unknow</Model></SYSTEM><BIOS><Manufacturer>Phoenix Technologies, LTD</Manufacturer><Version>6.00 PG</Version><SMBIOSVersion major="2" minor="5"/><Date>20071115000000.000000+000</Date></BIOS><HWID>6E46308701842078</HWID><UserLCID>0408</UserLCID><SystemLCID>0408</SystemLCID><TimeZone>Χειμερινή ώρα GTB(GMT+02:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/><GANotification><File Name="WgaTray.exe" Version="1.9.40.0"/><File Name="WgaLogon.dll" Version="1.9.40.0"/></GANotification></MachineData> <Software><Office><Result>114</Result><Products><Product GUID="{90110408-6000-11D3-8CFE-0150048383C9}"><LegitResult>114</LegitResult><Name>Microsoft Office Professional Edition 2003</Name><Ver>11</Ver><Val>59D1605114E3500</Val><Hash>vfZmaSmFPIYrLWTcZSZErUQg+Fo=</Hash><Pid>74002-640-0000106-57612</Pid><PidType>14</PidType></Product></Products><Applications><App Id="15" Version="11" Result="114"/><App Id="16" Version="11" Result="114"/><App Id="18" Version="11" Result="114"/><App Id="19" Version="11" Result="114"/><App Id="1A" Version="11" Result="114"/><App Id="1B" Version="11" Result="114"/><App Id="44" Version="11" Result="114"/></Applications></Office></Software></GenuineResults> Licensing Data--> N/A HWID Data--> N/A OEM Activation 1.0 Data--> BIOS string matches: no Marker string from BIOS: N/A Marker string from OEMBIOS.DAT: N/A, hr = 0x80004005 OEM Activation 2.0 Data--> N/A |
|
|
|
|
May 7 2009, 03:05 PM
Post
#12
|
|
|
GeekU Teacher Posts: 35,079 From: Dublin OS: XP |
post a new OTL log
|
|
|
|
|
May 7 2009, 03:14 PM
Post
#13
|
|
|
Member Posts: 28 OS: Windows XP |
Hi again! The new OTL log:
OTListIt logfile created on: 08/05/2009 00:11:00 - Run 4 OTListIt2 by OldTimer - Version 2.0.15.3 Folder = C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000408 | Country: Ελλάδα | Language: ELL | Date Format: dd/MM/yyyy 2,00 Gb Total Physical Memory | 1,05 Gb Available Physical Memory | 52,35% Memory free 3,85 Gb Paging File | 2,90 Gb Available in Paging File | 75,25% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 40,00 Gb Total Space | 18,53 Gb Free Space | 46,33% Space Free | Partition Type: NTFS Drive D: | 109,05 Gb Total Space | 52,58 Gb Free Space | 48,22% Space Free | Partition Type: NTFS Drive E: | 465,76 Gb Total Space | 233,32 Gb Free Space | 50,09% Space Free | Partition Type: NTFS Drive F: | 298,09 Gb Total Space | 203,76 Gb Free Space | 68,36% Space Free | Partition Type: NTFS G: Drive not present or media not loaded Drive H: | 698,64 Gb Total Space | 579,96 Gb Free Space | 83,01% Space Free | Partition Type: NTFS Drive I: | 931,51 Gb Total Space | 1,92 Gb Free Space | 0,21% Space Free | Partition Type: NTFS Computer Name: ANARXAKI Current User Name: araxnaki Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Minimal File Age = 30 Days Company Name Whitelist: On ========== Processes (SafeList) ========== PRC - C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.) PRC - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe () PRC - C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.) PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft) PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation) PRC - C:\Program Files\ESET\ESET Smart Security\ekrn.exe (ESET) PRC - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE () PRC - C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.) PRC - C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) PRC - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG) PRC - C:\WINDOWS\system32\IoctlSvc.exe (Prolific Technology Inc.) PRC - C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation) PRC - C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.) PRC - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation) PRC - C:\Program Files\Unlocker\UnlockerAssistant.exe () PRC - C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET) PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe (Microsoft Corporation) PRC - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.) PRC - C:\Program Files\TGTSoft\StyleXP\StyleXP.exe () PRC - C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe (TuneUp Software GmbH) PRC - C:\WINDOWS\system32\wbem\unsecapp.exe (Microsoft Corporation) PRC - C:\WINDOWS\system32\wbem\wmiprvse.exe (Microsoft Corporation) PRC - C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation) PRC - C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft) PRC - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG) PRC - D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\DOWNLOAD_MANAGERS\RapidShare Manager\RapidShare Manager.exe () PRC - C:\Documents and Settings\araxnaki\Local Settings\temp\RarSFX1\RapidShareManager.exe (RapidShare AG) PRC - D:\ΠΡΟΓΡΑΜΜΑΤΑ\-=INTERNET=-\DOWNLOAD_MANAGERS\CryptLoad\CryptLoad_1.1.6\CryptLoad.exe (http://cryptload.info) PRC - C:\Program Files\OperaClean\opera.exe (Opera Software) PRC - C:\Program Files\VSO\ConvertX\3\ConvertXtoDvd.exe (VSO Software SARL) PRC - C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\OTListIt2.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation) SRV - (Ati HotKey Poller [Auto | Running]) -- C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.) SRV - (ATI Smart [Auto | Stopped]) -- C:\WINDOWS\system32\ati2sgag.exe () SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (EhttpSrv [On_Demand | Stopped]) -- C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe (ESET) SRV - (ekrn [Auto | Running]) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe (ESET) SRV - (FLEXnet Licensing Service [On_Demand | Stopped]) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.) SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation) SRV - (IJPLMSVC [Auto | Running]) -- C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE () SRV - (JavaQuickStarterService [Auto | Running]) -- C:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.) SRV - (Lavasoft Ad-Aware Service [Auto | Running]) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft) SRV - (MDM [Auto | Running]) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation) SRV - (Nero BackItUp Scheduler 3 [Auto | Running]) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe (Nero AG) SRV - (NMIndexingService [On_Demand | Running]) -- C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe (Nero AG) SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (PLFlash DeviceIoControl Service [Auto | Running]) -- C:\WINDOWS\system32\IoctlSvc.exe (Prolific Technology Inc.) SRV - (StyleXPService [Auto | Running]) -- C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe () SRV - (TuneUp.Defrag [On_Demand | Stopped]) -- C:\WINDOWS\System32\TuneUpDefragService.exe (TuneUp Software GmbH) SRV - (UMWdf [Auto | Running]) -- C:\WINDOWS\system32\wdfmgr.exe (Microsoft Corporation) SRV - (UxTuneUp [Auto | Running]) -- C:\WINDOWS\System32\uxtuneup.dll (TuneUp Software GmbH) ========== Driver Services (SafeList) ========== DRV - (ati2mtag [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.) DRV - (eamon [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\eamon.sys (ESET) DRV - (ehdrv [System | Running]) -- C:\WINDOWS\system32\DRIVERS\ehdrv.sys (ESET) DRV - (epfw [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\epfw.sys (ESET) DRV - (Epfwndis [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\Epfwndis.sys (ESET) DRV - (epfwtdi [System | Running]) -- C:\WINDOWS\system32\DRIVERS\epfwtdi.sys (ESET) DRV - (HdAudAddService [On_Demand | Stopped]) -- C:\WINDOWS\system32\drivers\AtiHdAud.sys (ATI Research Inc.) DRV - (HDAudBus [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider) DRV - (IntcAzAudAddService [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (Lbd [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB) DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.) DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions) DRV - (RTLE8023xp [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys (Realtek Semiconductor Corporation ) DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys () DRV - (StyleXPHelper [System | Running]) -- C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe (Windows ® 2000 DDK provider) DRV - (pcouffin [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\pcouffin.sys (VSO Software) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...ER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p...&ar=msnhome IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009/05/07 02:40:59 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009/04/09 02:16:51 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.14\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009/05/07 02:41:12 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\PROGRAM FILES\ESET\ESET SMART SECURITY\MOZILLA THUNDERBIRD [2009/04/09 02:18:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\araxnaki\Application Data\mozilla\Firefox\Profiles\bslm7ubj.default\extensions [2009/04/09 02:18:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\araxnaki\Application Data\mozilla\Firefox\Profiles\bslm7ubj.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a} [2009/05/07 02:41:13 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2009/04/09 02:16:40 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/05/07 02:41:13 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2009/04/09 02:16:43 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\talkback@mozilla.org [2008/04/07 10:37:09 | 00,067,696 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\jar50.dll [2008/04/07 10:37:09 | 00,054,376 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\jsd3250.dll [2008/04/07 10:37:09 | 00,034,952 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\myspell.dll [2008/04/07 10:37:09 | 00,046,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\spellchk.dll [2008/04/07 10:37:09 | 00,172,144 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\xpinstal.dll [2006/06/01 02:17:38 | 00,001,527 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml [2006/07/06 08:44:17 | 00,002,206 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml [2006/06/01 02:17:38 | 00,001,049 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml [2006/06/01 02:17:38 | 00,001,063 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml [2007/01/18 01:05:32 | 00,002,368 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml [2006/09/11 17:19:18 | 00,000,806 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml O1 HOSTS File: (306194 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 10536 more lines... O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (Βοηθός εισόδου του Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O4 - HKLM..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice (ESET) O4 - HKLM..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup (InstallShield Software Corporation) O4 - HKLM..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start (InstallShield Software Corporation) O4 - HKLM..\Run: [RTHDCPL] RTHDCPL.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SkyTel] SkyTel.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.) O4 - HKLM..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" () O4 - HKCU..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (Microsoft Corporation) O4 - HKCU..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (Microsoft Corporation) O4 - HKCU..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide () O4 - HKCU..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2008\MemOptimizer.exe" autostart (TuneUp Software GmbH) O4 - HKCU..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (Yahoo! Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html (Adobe Systems Incorporated) O8 - Extra context menu item: Ε&ξαγωγή στο Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation) O9 - Extra Button: Έρευνα - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 49 domain(s) and sub-domain(s) not assigned to a zone. O15 - HKCU\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://go.microsoft.com/fwlink/?linkid=58813 (Office Genuine Advantage Validation Tool) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool) O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} http://go.microsoft.com/fwlink/?LinkId=82580 (Microsoft Genuine Advantage Self Support Tool) O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/...b?1238977614281 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab (MessengerStatsClient Class) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab (Minesweeper Flags Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Interfaces\{4C6BC589-1448-4AE5-A363-B44B58643875}\\NameServer = 194.219.227.2,193.92.150.3 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Τρέχουσα αρχική σελίδα) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/04/05 23:20:03 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{2afb16ea-2b6f-11de-87a0-003018aefc27}\Shell\AutoRun\command - "" = I:\setupSNK.exe -- File not found O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe () ========== Files/Folders - Created Within 30 Days ========== [3 C:\WINDOWS\*.tmp files] [2009/05/08 00:10:31 | 00,501,248 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\OTListIt2.exe [2009/05/07 23:15:46 | 00,234,580 | ---- | C] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\2007_shrek_the_third_001.jpg [2009/05/07 23:15:37 | 00,152,054 | ---- | C] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\2007_shrek_the_third_wallpaper_022.jpg [2009/05/07 22:50:45 | 00,016,896 | -HS- | C] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\Thumbs.db [2009/05/07 22:46:36 | 00,000,063 | ---- | C] () -- C:\Documents and Settings\araxnaki\Application Data\vso_ts_preview.xml [2009/05/07 22:46:24 | 01,016,457 | ---- | C] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\ENTbenji2.jpg [2009/05/07 22:45:56 | 00,330,058 | ---- | C] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\2008_the_curious_case_of_benjamin_button_025.jpg [2009/05/07 22:29:19 | 00,000,000 | ---D | C] -- C:\Program Files\Fast AVI MPEG Joiner [2009/05/07 22:26:38 | 00,000,000 | ---D | C] -- C:\WINDOWS\LastGood [2009/05/07 22:26:28 | 00,087,608 | ---- | C] () -- C:\Documents and Settings\araxnaki\Application Data\inst.exe [2009/05/07 22:26:28 | 00,047,360 | ---- | C] (VSO Software) -- C:\WINDOWS\System32\drivers\pcouffin.sys [2009/05/07 22:26:28 | 00,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\araxnaki\Application Data\pcouffin.sys [2009/05/07 22:26:28 | 00,007,887 | ---- | C] () -- C:\Documents and Settings\araxnaki\Application Data\pcouffin.cat [2009/05/07 22:26:28 | 00,001,144 | ---- | C] () -- C:\Documents and Settings\araxnaki\Application Data\pcouffin.inf [2009/05/07 22:26:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Τα έγγραφά μου\PcSetup [2009/05/07 22:26:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Application Data\Vso [2009/05/07 22:26:19 | 01,645,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\gdiplus.dll [2009/05/07 22:26:19 | 01,184,984 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wvc1dmod.dll [2009/05/07 22:26:19 | 00,626,688 | ---- | C] (On2.com) -- C:\WINDOWS\System32\vp7vfw.dll [2009/05/07 22:26:17 | 00,000,000 | ---D | C] -- C:\Program Files\VSO [2009/05/07 22:08:18 | 00,001,840 | ---- | C] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\hfd.ccf [2009/05/07 22:08:04 | 00,069,875 | ---- | C] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\hfd.srt [2009/05/07 19:03:07 | 36,019,200 | ---- | C] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\ess_nt32_enu.msi [2009/05/07 16:08:29 | 01,561,992 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\MGADiag.exe [2009/05/07 15:57:38 | 00,000,000 | ---D | C] -- C:\_OTMoveIt [2009/05/07 15:56:06 | 00,389,632 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\OTMoveIt3.exe [2009/05/07 01:54:36 | 00,000,000 | -HSD | C] -- C:\RECYCLER [2009/05/07 01:44:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Local Settings\temp [2009/05/07 01:27:43 | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2009/05/07 01:27:43 | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2009/05/07 01:27:43 | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2009/05/07 01:27:43 | 00,117,248 | ---- | C] () -- C:\WINDOWS\vFind.exe [2009/05/07 01:27:43 | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2009/05/07 01:27:43 | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2009/05/07 01:27:43 | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2009/05/07 01:27:43 | 00,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2009/05/07 01:27:33 | 00,000,000 | ---D | C] -- C:\ComboFix [2009/05/07 01:27:30 | 00,000,000 | ---D | C] -- C:\Qoobox [2009/05/07 01:23:27 | 03,018,120 | R--- | C] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\ComboFix.exe [2009/05/06 23:19:44 | 02,967,800 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\mbam-setup.exe [2009/05/06 23:19:19 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\06-05-2009 [2009/05/06 23:18:45 | 00,000,611 | ---- | C] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\NTREGOPT.lnk [2009/05/06 23:18:45 | 00,000,592 | ---- | C] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\ERUNT.lnk [2009/05/06 23:18:14 | 00,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\erunt_setup.exe [2009/05/06 23:17:23 | 00,021,504 | ---- | C] (Doug Knox) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\SysRestorePoint.exe [2009/05/06 23:12:50 | 00,000,045 | ---- | C] () -- C:\TEST.XML [2009/04/26 17:23:31 | 00,000,000 | ---D | C] -- C:\Program Files\ReflexiveArcade [2009/04/18 20:13:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Τα έγγραφά μου\Downloads [2009/04/18 13:40:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Application Data\Google [2009/04/18 13:37:47 | 00,000,000 | ---D | C] -- C:\Program Files\Google [2009/04/12 02:07:16 | 00,000,081 | ---- | C] () -- C:\GTvSScript.ini [2009/04/12 02:07:10 | 00,000,000 | ---D | C] -- C:\WINDOWS\Subtitle Workshop GTvS Edition [2009/04/12 02:07:10 | 00,000,000 | ---D | C] -- C:\Program Files\URUSoft [2009/04/11 01:21:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\nzb [2009/04/11 01:21:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\ccf [2009/04/10 09:38:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Application Data\Canon [2009/04/09 02:17:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Application Data\Talkback [2009/04/09 02:16:53 | 00,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2009/04/09 02:16:47 | 00,000,000 | ---D | C] -- C:\Documents and Settings\araxnaki\Application Data\Mozilla [2009/04/09 02:16:39 | 00,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2009/04/09 00:17:55 | 00,000,000 | ---D | C] -- C:\Program Files\PIM [2009/04/08 23:26:54 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Live Safety Center [2009/04/08 06:44:32 | 00,000,000 | ---D | C] -- C:\Program Files\OperaClean [2009/04/07 20:32:13 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009/04/06 10:19:03 | 00,000,380 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009/04/06 10:14:07 | 00,041,472 | ---- | C] () -- C:\WINDOWS\System32\indexudf.dll [2009/04/06 10:13:56 | 00,010,752 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll [2009/02/21 08:25:20 | 00,691,592 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.DLL [2004/09/07 13:00:00 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2004/09/07 13:00:00 | 00,000,653 | ---- | C] () -- C:\WINDOWS\win.ini [2004/09/07 13:00:00 | 00,000,255 | ---- | C] () -- C:\WINDOWS\system.ini [2003/04/24 15:47:04 | 00,005,697 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI ========== Files - Modified Within 30 Days ========== [1 C:\WINDOWS\System32\*.tmp files] [3 C:\WINDOWS\*.tmp files] [2009/05/08 00:10:49 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\OTListIt2.exe [2009/05/07 23:36:24 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009/05/07 23:15:46 | 00,234,580 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\2007_shrek_the_third_001.jpg [2009/05/07 23:15:37 | 00,152,054 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\2007_shrek_the_third_wallpaper_022.jpg [2009/05/07 22:50:47 | 00,016,896 | -HS- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\Thumbs.db [2009/05/07 22:46:36 | 00,000,063 | ---- | M] () -- C:\Documents and Settings\araxnaki\Application Data\vso_ts_preview.xml [2009/05/07 22:46:24 | 01,016,457 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\ENTbenji2.jpg [2009/05/07 22:45:56 | 00,330,058 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\2008_the_curious_case_of_benjamin_button_025.jpg [2009/05/07 22:26:28 | 00,087,608 | ---- | M] () -- C:\Documents and Settings\araxnaki\Application Data\inst.exe [2009/05/07 22:26:28 | 00,047,360 | ---- | M] (VSO Software) -- C:\WINDOWS\System32\drivers\pcouffin.sys [2009/05/07 22:26:28 | 00,047,360 | ---- | M] (VSO Software) -- C:\Documents and Settings\araxnaki\Application Data\pcouffin.sys [2009/05/07 22:26:28 | 00,007,887 | ---- | M] () -- C:\Documents and Settings\araxnaki\Application Data\pcouffin.cat [2009/05/07 22:26:28 | 00,001,144 | ---- | M] () -- C:\Documents and Settings\araxnaki\Application Data\pcouffin.inf [2009/05/07 22:08:22 | 00,001,840 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\hfd.ccf [2009/05/07 22:08:04 | 00,069,875 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\hfd.srt [2009/05/07 19:05:31 | 36,019,200 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\ess_nt32_enu.msi [2009/05/07 16:08:43 | 00,002,228 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009/05/07 16:08:32 | 01,561,992 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\MGADiag.exe [2009/05/07 16:02:50 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\araxnaki\Local Settings\desktop.ini [2009/05/07 16:02:45 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009/05/07 15:56:06 | 00,389,632 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\OTMoveIt3.exe [2009/05/07 01:55:53 | 02,967,800 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\mbam-setup.exe [2009/05/07 01:43:18 | 00,000,255 | ---- | M] () -- C:\WINDOWS\system.ini [2009/05/07 01:26:44 | 03,018,120 | R--- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\ComboFix.exe [2009/05/06 23:18:45 | 00,000,611 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\NTREGOPT.lnk [2009/05/06 23:18:45 | 00,000,592 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\ERUNT.lnk [2009/05/06 23:18:21 | 00,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\erunt_setup.exe [2009/05/06 23:17:23 | 00,021,504 | ---- | M] (Doug Knox) -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\SysRestorePoint.exe [2009/05/06 23:12:50 | 00,000,045 | ---- | M] () -- C:\TEST.XML [2009/05/04 10:20:35 | 00,122,880 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\ΠΡΟΟΔΟΣ.xls [2009/05/01 17:16:32 | 00,000,382 | ---- | M] () -- C:\WINDOWS\tasks\1-Click Maintenance.job [2009/05/01 15:36:46 | 00,117,248 | ---- | M] () -- C:\WINDOWS\vFind.exe [2009/04/28 18:22:20 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job [2009/04/21 18:23:06 | 00,015,688 | ---- | M] () -- C:\WINDOWS\System32\lsdelete.exe [2009/04/21 18:22:41 | 00,064,160 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys [2009/04/20 12:56:28 | 00,031,232 | ---- | M] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2009/04/17 12:24:54 | 02,071,327 | ---- | M] () -- C:\Documents and Settings\araxnaki\Επιφάνεια εργασίας\DSC00951.JPG [2009/04/17 03:16:07 | 00,494,710 | ---- | M] () -- C:\WINDOWS\System32\perfh008.dat [2009/04/17 03:16:07 | 00,392,296 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009/04/17 03:16:07 | 00,080,562 | ---- | M] () -- C:\WINDOWS\System32\perfc008.dat [2009/04/17 03:16:07 | 00,058,596 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2009/04/17 03:16:06 | 01,037,742 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009/04/17 03:04:07 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2009/04/12 02:07:16 | 00,000,081 | ---- | M] () -- C:\GTvSScript.ini [2009/04/09 02:16:53 | 00,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat < End of report > |
|
|
|
|
May 7 2009, 03:15 PM
Post
#14
|
|
|
GeekU Teacher Posts: 35,079 From: Dublin OS: XP |
Your logs are clean
Follow these steps to uninstall Combofix and tools used in the removal of malware
Below I have included a number of recommendations for how to protect your computer against malware infections.
Thank you for your patience, and performing all of the procedures requested. |
|
|
|
|
May 7 2009, 04:37 PM
Post
#15
|
|
|
Member Posts: 28 OS: Windows XP |
Thanks for everything!
One last question before you lock this topic: can I keep mbam too? |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
Similar Topics
| Topic Title | Replies / Views | Topic Information | |||||
|---|---|---|---|---|---|---|---|
 |
5 / 1,582 | 5th May 2009 - 05:07 AM markosabo started - last by Rorschach112 |
|||||
 |
23 / 1,344 | 23rd August 2009 - 01:35 PM michael -123 started - last by Transience |
|||||
|
 |
23 / 837 | 26th August 2009 - 04:14 AM Zet started - last by Rorschach112 |
||||
|
29 / 1,327 | 16th September 2009 - 02:07 AM suryavarma143 started - last by emeraldnzl |
|||||
|
Time is now: 20th November 2009 - 08:27 PM |
Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks mentioned on this page are the property of their respective owners.
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy | Advertising