need help to get rid of Privacy Center [Solved] |
Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!
|
|
|
  |
  May 17 2009, 03:40 AM
Post
#1
|
|
 Member  Posts: 94 From: Vancouver BC, Canada OS: Microsoft Windows XP Home Edition, Service Pack 3  |
I got Privacy Center troyan
I need help to get it completely out of my laptop. Pleeeese |
 |
 
|
|
May 17 2009, 05:33 AM
Post
#2
|
|
 Malware Moderator / Malware Staff  Posts: 2,456 From: The Land Down Under OS: Windows XP pro |
Follow the instructions in this link then post the following results in your next reply.
|
|
|
|
|
May 17 2009, 02:45 PM
Post
#3
|
|
|
Member Posts: 94 From: Vancouver BC, Canada OS: Microsoft Windows XP Home Edition, Service Pack 3 |
Ok. Here is the MBAM log:
Malwarebytes' Anti-Malware 1.36 Database version: 2145 Windows 5.1.2600 Service Pack 3 5/17/2009 1:43:38 PM mbam-log-2009-05-17 (13-43-38).txt Scan type: Quick Scan Objects scanned: 89209 Time elapsed: 12 minute(s), 3 second(s) Memory Processes Infected: 1 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 1 Registry Data Items Infected: 1 Folders Infected: 11 Files Infected: 30 Memory Processes Infected: C:\Program Files\PCenter\agent.exe (Rogue.PCenter) -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\privacy center (Rogue.PCenter) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\agent.exe (Rogue.PCenter) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (C:\Program Files\PCenter\pc.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully. Folders Infected: C:\Program Files\PCenter (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\faq (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\faq\images (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\sounds (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\tools (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\tools\sc (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\tools\sp (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter\dbases (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter\keys (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter\temp (Rogue.PCenter) -> Quarantined and deleted successfully. Files Infected: C:\Program Files\PCenter\agent.exe (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Desktop\pmbok_download_forum.exe (Rogue.Installer) -> Quarantined and deleted successfully. C:\Program Files\PCenter\pc.exe (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\uninstall.exe (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\faq\guide.html (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\faq\images\gimg1.jpg (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\faq\images\gimg10.jpg (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\faq\images\gimg2.jpg (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\faq\images\gimg3.jpg (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\faq\images\gimg4.jpg (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\faq\images\gimg5.jpg (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\faq\images\gimg6.jpg (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\faq\images\gimg7.jpg (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\faq\images\gimg8.jpg (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\faq\images\gimg9.jpg (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\sounds\1.mp3 (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Program Files\PCenter\sounds\3.mp3 (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter\dbases\cg.dat (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter\dbases\mw.dat (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter\dbases\rd.dat (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter\dbases\sc.dat (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter\dbases\sm.dat (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter\dbases\sp.dat (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter\keys\cg.key (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter\keys\rd.key (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter\keys\sc.key (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter\keys\sp.key (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter\temp\settings.ini (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Application Data\PCenter\temp\spfilter (Rogue.PCenter) -> Quarantined and deleted successfully. C:\Documents and Settings\Michael\Desktop\PCenter.lnk (Rogue.PrivacyCenter) -> Quarantined and deleted successfully. |
|
|
|
|
May 17 2009, 05:45 PM
Post
#4
|
|
|
Member Posts: 94 From: Vancouver BC, Canada OS: Microsoft Windows XP Home Edition, Service Pack 3 |
here is the Rooter log:
Microsoft Windows XP Home Edition (5.1.2600) Service Pack 3 C:\ [Fixed] - NTFS - (Total:95205 Mo/Free:2015 Mo) D:\ [CD-Rom] (Total:0 Mo/Free:0 Mo) F:\ [Removable] (Total:7647 Mo/Free:852 Mo) Sun 05/17/2009|16:43 ----------------------\\ Processes.. --Locked-- [System Process] ---------- System ---------- \SystemRoot\System32\smss.exe ---------- \??\C:\WINDOWS\system32\csrss.exe ---------- \??\C:\WINDOWS\system32\winlogon.exe ---------- C:\WINDOWS\system32\services.exe ---------- C:\WINDOWS\system32\lsass.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\System32\svchost.exe ---------- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe ---------- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\system32\spoolsv.exe ---------- C:\WINDOWS\system32\svchost.exe --Locked-- avp.exe ---------- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe ---------- C:\WINDOWS\system32\DVDRAMSV.exe ---------- C:\Program Files\Google\Update\GoogleUpdate.exe ---------- C:\WINDOWS\system32\nvsvc32.exe ---------- C:\WINDOWS\system32\oodag.exe ---------- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe ---------- C:\WINDOWS\system32\svchost.exe ---------- C:\WINDOWS\System32\dmadmin.exe ---------- C:\Program Files\OO Software\DiskImage\oodiag.exe ---------- C:\WINDOWS\System32\alg.exe ---------- C:\WINDOWS\Explorer.EXE ---------- C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe ---------- C:\Program Files\Apoint2K\Apoint.exe ---------- C:\Program Files\TOSHIBA\TouchPad\TPTray.exe ---------- C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe ---------- C:\WINDOWS\system32\dla\tfswctrl.exe ---------- C:\WINDOWS\system32\TPSMain.exe ---------- C:\WINDOWS\system32\ZoomingHook.exe ---------- C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe ---------- C:\WINDOWS\system32\TCtrlIOHook.exe ---------- C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe ---------- C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe ---------- C:\Program Files\Apoint2K\Apntex.exe ---------- C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe ---------- C:\WINDOWS\System32\svchost.exe ---------- C:\Program Files\Toshiba\Tvs\TvsTray.exe ---------- C:\Program Files\ltmoh\Ltmoh.exe ---------- C:\WINDOWS\system32\TPSBattM.exe ---------- C:\WINDOWS\AGRSMMSG.exe --Locked-- avp.exe ---------- C:\WINDOWS\system32\oodtray.exe ---------- C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe ---------- C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe ---------- C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe ---------- C:\Program Files\Common Files\Hornet\MntrHrnt.exe ---------- C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe ---------- C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe ---------- C:\WINDOWS\system32\ctfmon.exe ---------- C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe ---------- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe ---------- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe ---------- C:\WINDOWS\system32\RAMASST.exe ---------- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe ---------- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe ---------- C:\Program Files\Windows Live\Contacts\wlcomm.exe ---------- C:\Program Files\Internet Explorer\iexplore.exe ---------- C:\Program Files\Internet Explorer\iexplore.exe ---------- C:\Program Files\Internet Explorer\iexplore.exe ---------- C:\Program Files\Internet Explorer\iexplore.exe ---------- C:\Program Files\Internet Explorer\iexplore.exe ---------- C:\Program Files\Internet Explorer\iexplore.exe ---------- C:\Program Files\Internet Explorer\iexplore.exe ---------- C:\Program Files\Internet Explorer\iexplore.exe ---------- C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat.exe ---------- C:\DOCUME~1\Michael\LOCALS~1\Temp\Adobelm_Cleanup.0001 ---------- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe ---------- C:\DOCUME~1\Michael\LOCALS~1\Temp\Adobelm_Cleanup.0001 ---------- C:\WINDOWS\system32\cmd.exe ---------- C:\Rooter$\RK.exe ----------------------\\ Search.. ----------------------\\ ROOTKIT !! ----------------------\\ Cracks & Keygens.. C:\DOCUME~1\Michael\Desktop\keygen.exe C:\DOCUME~1\Michael\Desktop\A7P\KeyGen\pdx-ac7p.exe C:\DOCUME~1\Michael\My Documents\Michael's\CrackDown22.zip C:\DOCUME~1\Michael\My Documents\Michael's\WindowsMe keygen\Windows ME.exe 1 - "C:\Rooter$\Rooter_1.txt" - Sun 05/17/2009|16:44 ----------------------\\ Scan completed at 16:44 |
|
|
|
|
May 17 2009, 05:53 PM
Post
#5
|
|
|
Member Posts: 94 From: Vancouver BC, Canada OS: Microsoft Windows XP Home Edition, Service Pack 3 |
and here is the OTListIt results:
OTListIt logfile created on: 5/17/2009 4:50:03 PM - Run 1 OTListIt2 by OldTimer - Version 2.0.15.8 Folder = C:\Documents and Settings\Michael\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.22 Gb Available Physical Memory | 61.26% Memory free 3.85 Gb Paging File | 3.19 Gb Available in Paging File | 83.06% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 92.97 Gb Total Space | 33.97 Gb Free Space | 36.53% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded Drive F: | 7.47 Gb Total Space | 4.83 Gb Free Space | 64.71% Space Free | Partition Type: FAT32 G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: LAPTOP-TOSHIBA Current User Name: Michael Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Minimal File Age = 30 Days Company Name Whitelist: On ========== Processes (SafeList) ========== PRC - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation) PRC - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation ) PRC - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION) PRC - C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.) PRC - C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.) PRC - C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation) PRC - C:\WINDOWS\system32\oodag.exe (O&O Software GmbH) PRC - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation) PRC - C:\Program Files\OO Software\DiskImage\oodiag.exe () PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation) PRC - C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.) PRC - C:\Program Files\Apoint2K\Apoint.exe (Alps Electric Co., Ltd.) PRC - C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.) PRC - C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe (TOSHIBA CORPORATION) PRC - C:\WINDOWS\system32\dla\tfswctrl.exe (Sonic Solutions) PRC - C:\WINDOWS\system32\TPSMain.exe (TOSHIBA Corporation) PRC - C:\WINDOWS\system32\ZoomingHook.exe (TOSHIBA) PRC - C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation) PRC - C:\WINDOWS\system32\TCtrlIOHook.exe (TOSHIBA) PRC - C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe (TOSHIBA Corporation) PRC - C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe (TOSHIBA) PRC - C:\Program Files\Apoint2K\Apntex.exe (Alps Electric Co., Ltd.) PRC - C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe (TOSHIBA) PRC - C:\Program Files\Toshiba\Tvs\TvsTray.exe (TOSHIBA Corporation) PRC - C:\Program Files\ltmoh\Ltmoh.exe (Agere Systems) PRC - C:\WINDOWS\system32\TPSBattM.exe (TOSHIBA Corporation) PRC - C:\WINDOWS\AGRSMMSG.exe (Agere Systems) PRC - C:\WINDOWS\system32\oodtray.exe (O&O Software GmbH) PRC - C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation) PRC - C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation) PRC - C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.) PRC - C:\Program Files\Common Files\Hornet\MntrHrnt.exe (Alcor Micro, Corp.) PRC - C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe (Intel Corporation) PRC - C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe (TOSHIBA) PRC - C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe (Microsoft Corporation) PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe (Hewlett-Packard Co.) PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard) PRC - C:\WINDOWS\system32\RAMASST.exe (Matsushita Electric Industrial Co., Ltd.) PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe (Hewlett-Packard Co.) PRC - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe (Hewlett-Packard Co.) PRC - C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation) PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) PRC - C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) PRC - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat.exe (Adobe Systems Incorporated) PRC - C:\Documents and Settings\Michael\Local Settings\Temp\Adobelm_Cleanup.0001 (Macrovision Europe Ltd.) PRC - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Systems) PRC - C:\Documents and Settings\Michael\Local Settings\Temp\Adobelm_Cleanup.0001 (Macrovision Europe Ltd.) PRC - C:\Documents and Settings\Michael\Desktop\OTListIt2.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (Adobe LM Service [On_Demand | Running]) -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Systems) SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (Microsoft Corporation) SRV - (Ati HotKey Poller [Auto | Stopped]) -- C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.) SRV - (AVP [Auto | Running]) -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (Kaspersky Lab) SRV - (CFSvcs [Auto | Running]) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION) SRV - (DVD-RAM_Service [Auto | Running]) -- C:\WINDOWS\system32\DVDRAMSV.exe (Matsushita Electric Industrial Co., Ltd.) SRV - (EvtEng [Auto | Running]) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (Intel Corporation) SRV - (gupdate1c9c1febc9aa478 [Auto | Stopped]) -- C:\Program Files\Google\Update\GoogleUpdate.exe (Google Inc.) SRV - (gusvc [Auto | Stopped]) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google) SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation) SRV - (NVSvc [Auto | Running]) -- C:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation) SRV - (O&O Defrag [Auto | Running]) -- C:\WINDOWS\system32\oodag.exe (O&O Software GmbH) SRV - (O&O DiskImage [Auto | Running]) -- C:\Program Files\OO Software\DiskImage\oodiag.exe () SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (Pml Driver HPZ12 [On_Demand | Stopped]) -- C:\WINDOWS\system32\HPZipm12.exe (HP) SRV - (RegSrvc [Auto | Running]) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (Intel Corporation) SRV - (S24EventMonitor [Auto | Running]) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (Intel Corporation ) SRV - (WMPNetworkSvc [On_Demand | Stopped]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (61883 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\61883.sys (Microsoft Corporation) DRV - (AegisP [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\AegisP.sys (Meetinghouse Data Communications) DRV - (AgereSoftModem [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\AGRSM.sys (Agere Systems) DRV - (ALCXWDM [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.) DRV - (ApfiltrService [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\Apfiltr.sys (Alps Electric Co., Ltd.) DRV - (ati2mtag [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ati2mtag.sys (ATI Technologies Inc.) DRV - (Avc [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\avc.sys (Microsoft Corporation) DRV - (drvmcdb [Boot | Running]) -- C:\WINDOWS\system32\drivers\drvmcdb.sys (Sonic Solutions) DRV - (drvnddm [Auto | Running]) -- C:\WINDOWS\system32\drivers\drvnddm.sys (Sonic Solutions) DRV - (EMSCR [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\EMS7SK.sys (ENE Technology Inc.) DRV - (ESDCR [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ESD7SK.sys (ENE Technology Inc.) DRV - (ESMCR [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ESM7SK.sys (ENE Technology Inc.) DRV - (HPZid412 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\HPZid412.sys (HP) DRV - (HPZipr12 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\HPZipr12.sys (HP) DRV - (HPZius12 [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\HPZius12.sys (HP) DRV - (ialm [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ialmnt5.sys (Intel Corporation) DRV - (Iviaspi [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\iviaspi.sys (InterVideo, Inc.) DRV - (kl1 [Boot | Running]) -- C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Lab) DRV - (klbg [Boot | Running]) -- C:\WINDOWS\system32\drivers\klbg.sys (Kaspersky Lab) DRV - (KLFLTDEV [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\klfltdev.sys (Kaspersky Lab) DRV - (KLIF [System | Running]) -- C:\WINDOWS\system32\DRIVERS\klif.sys (Kaspersky Lab) DRV - (klim5 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\klim5.sys (Kaspersky Lab) DRV - (meiudf [System | Running]) -- C:\WINDOWS\System32\Drivers\meiudf.sys (Matsushita Electric Industrial Co.,Ltd.) DRV - (MSDV [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\msdv.sys (Microsoft Corporation) DRV - (Netdevio [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\netdevio.sys (TOSHIBA Corporation.) DRV - (nv [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys (NVIDIA Corporation) DRV - (oodisr [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\oodisr.sys (O&O Software GmbH) DRV - (oodisrh [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\oodisrh.sys (O&O Software GmbH) DRV - (oodivd [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\oodivd.sys (O&O Software GmbH) DRV - (oodivdh [Boot | Running]) -- C:\WINDOWS\system32\DRIVERS\oodivdh.sys (O&O Software GmbH) DRV - (OVT511Plus [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\omcamvid.sys (OmniVision Technologies, Inc.) DRV - (pcouffin [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\pcouffin.sys (VSO Software) DRV - (Pfc [On_Demand | Running]) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.) DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.) DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions) DRV - (RTL8023xp [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys (Realtek Semiconductor Corporation ) DRV - (s24trans [Auto | Running]) -- C:\WINDOWS\system32\DRIVERS\s24trans.sys (Intel Corporation) DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) DRV - (Ser2pl [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\ser2pl.sys (Prolific Technology Inc.) DRV - (SerTVOutCtlr [System | Running]) -- C:\WINDOWS\system32\drivers\EPIOMngr.sys (COMPAL ELECTRONIC INC.) DRV - (softctrl [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\softctrl.sys (Alcor Micro Corp.) DRV - (SrvcEKIOMngr [System | Running]) -- C:\WINDOWS\System32\Drivers\EKIoMngr.sys (COMPAL ELECTRONIC INC.) DRV - (SrvcSSIOMngr [System | Running]) -- C:\WINDOWS\System32\Drivers\SSIoMngr.sys (COMPAL ELECTRONIC INC.) DRV - (sscdbhk5 [System | Running]) -- C:\WINDOWS\system32\drivers\sscdbhk5.sys (Sonic Solutions) DRV - (ssrtln [System | Running]) -- C:\WINDOWS\system32\drivers\ssrtln.sys (Sonic Solutions) DRV - (TBiosDrv [On_Demand | Stopped]) -- C:\WINDOWS\system32\Drivers\Tbiosdrv.sys () DRV - (tfsnboio [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsnboio.sys (Sonic Solutions) DRV - (tfsncofs [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsncofs.sys (Sonic Solutions) DRV - (tfsndrct [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsndrct.sys (Sonic Solutions) DRV - (tfsndres [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsndres.sys (Sonic Solutions) DRV - (tfsnifs [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsnifs.sys (Sonic Solutions) DRV - (tfsnopio [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsnopio.sys (Sonic Solutions) DRV - (tfsnpool [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsnpool.sys (Sonic Solutions) DRV - (tfsnudf [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsnudf.sys (Sonic Solutions) DRV - (tfsnudfa [Auto | Running]) -- C:\WINDOWS\system32\dla\tfsnudfa.sys (Sonic Solutions) DRV - (TPwSav [System | Running]) -- C:\WINDOWS\System32\Drivers\TPwSav.sys (TOSHIBA ) DRV - (Tvs [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\Tvs.sys (TOSHIBA Corporation) DRV - (usbser [On_Demand | Stopped]) -- C:\WINDOWS\system32\DRIVERS\usbser.sys (Microsoft Corporation) DRV - (w29n51 [On_Demand | Running]) -- C:\WINDOWS\system32\DRIVERS\w29n51.sys (Intel® Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = www.live.com [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\PROGRAM FILES\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2009\THBEXT [2009/02/08 02:23:14 | 00,000,000 | ---D | M] O1 HOSTS File: (734 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll (Kaspersky Lab) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - Reg Error: Key error. File not found O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions) O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.) O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.) O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - Reg Error: Key error. File not found O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" (Adobe Systems Inc.) O4 - HKLM..\Run: [AGRSMMSG] AGRSMMSG.exe (Agere Systems) O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe (ATI Technologies, Inc.) O4 - HKLM..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" (Kaspersky Lab) O4 - HKLM..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe (COMPAL ELECTRONIC INC.) O4 - HKLM..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe (Sonic Solutions) O4 - HKLM..\Run: [HornetMonitor] C:\Program Files\Common Files\Hornet\MntrHrnt.exe (Alcor Micro, Corp.) O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\TOSHIBA Applet\HWSetup.exe hwSetUP (TOSHIBA CO.,LTD.) O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation) O4 - HKLM..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless (Intel Corporation) O4 - HKLM..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" (Intel Corporation) O4 - HKLM..\Run: [LtMoh] C:\\Program Files\\ltmoh\\Ltmoh.exe () O4 - HKLM..\Run: [NDSTray.exe] NDSTray.exe File not found O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh) O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] nwiz.exe /install File not found O4 - HKLM..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe (O&O Software GmbH) O4 - HKLM..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe (TOSHIBA) O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.) O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\Toshiba\Windows Utilities\SVPWUTIL.exe SVPwUTIL (TOSHIBA) O4 - HKLM..\Run: [TCtryIOHook] TCtrlIOHook.exe (TOSHIBA) O4 - HKLM..\Run: [TFncKy] TFncKy.exe File not found O4 - HKLM..\Run: [TOSHIBA Accessibility] C:\Program Files\TOSHIBA\Accessibility\FnKeyHook.exe (TOSHIBA) O4 - HKLM..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe (COMPAL ELECTRONIC INC.) O4 - HKLM..\Run: [TPSMain] TPSMain.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [ZoomingHook] ZoomingHook.exe (TOSHIBA) O4 - HKCU..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background (Microsoft Corporation) O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKCU..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe (TOSHIBA) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe () O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe (Hewlett-Packard Co.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe (Matsushita Electric Industrial Co., Ltd.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm () O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html (Adobe Systems Incorporated) O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html (Adobe Systems Incorporated) O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll (Sun Microsystems, Inc.) O9 - Extra Button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll (Kaspersky Lab) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0) O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\mzvkbd.dll (Kaspersky Lab) O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\mzvkbd3.dll (Kaspersky Lab) O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\adialhk.dll (Kaspersky Lab) O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\kloehk.dll (Kaspersky Lab) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - HKCU Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\system32\igfxsrvc.dll (Intel Corporation) O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab) O24 - Desktop Components:0 (My Current Home Page) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2005/05/12 15:34:28 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - * [2009/05/17 16:45:56 | 00,000,000 | ---D | M] O34 - HKLM BootExecute: (OODBS) - C:\WINDOWS\System32\OODBS.exe (O&O Software GmbH) ========== Files/Folders - Created Within 30 Days ========== [2 C:\WINDOWS\*.tmp files] [2009/05/17 16:45:56 | 00,501,248 | ---- | C] (OldTimer Tools) -- C:\DOCUME~1\Michael\Desktop\OTListIt2.exe [2009/05/17 16:42:54 | 00,000,000 | ---D | C] -- C:\Rooter$ [2009/05/17 16:42:50 | 00,267,612 | ---- | C] () -- C:\DOCUME~1\Michael\Desktop\Rooter.exe [2009/05/17 13:12:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Michael\Application Data\Malwarebytes [2009/05/17 13:12:50 | 00,015,504 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2009/05/17 13:12:50 | 00,000,746 | ---- | C] () -- C:\DOCUME~1\ALLUSE~1\Desktop\Malwarebytes' Anti-Malware.lnk [2009/05/17 13:12:47 | 00,038,496 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2009/05/17 13:12:45 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2009/05/17 13:12:45 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2009/05/17 12:08:03 | 00,045,568 | ---- | C] () -- C:\DOCUME~1\Michael\Desktop\keygen.exe [2009/05/17 01:39:24 | 00,001,886 | ---- | C] () -- C:\DOCUME~1\ALLUSE~1\Desktop\Google Earth.lnk [2009/05/15 13:46:54 | 00,200,192 | ---- | C] () -- C:\DOCUME~1\Michael\Desktop\1490.051109.xls [2009/05/15 11:25:12 | 00,000,426 | -H-- | C] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{36DFDF38-6651-4DC8-B85D-6929BFFCD8D5}.job [2009/05/13 22:58:02 | 00,043,062 | ---- | C] () -- C:\DOCUME~1\Michael\My Documents\UserImages.bmp [2009/05/12 20:02:11 | 00,024,064 | ---- | C] () -- C:\DOCUME~1\Michael\My Documents\3208 East 43rd Ave.doc [2009/05/12 20:02:11 | 00,000,162 | -H-- | C] () -- C:\DOCUME~1\Michael\My Documents\~$08 East 43rd Ave.doc [2009/05/12 19:56:10 | 00,000,000 | ---D | C] -- C:\WINDOWS\ie8updates [2009/05/12 19:52:17 | 00,000,000 | -H-D | C] -- C:\WINDOWS\ie8 [2009/05/12 19:51:32 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2009/05/12 19:51:03 | 00,000,000 | -H-D | C] -- C:\WINDOWS\msdownld.tmp [2009/05/12 19:46:54 | 00,102,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iecompat.dll [2009/05/09 21:12:43 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Michael\Application Data\vlc [2009/05/09 21:12:17 | 00,000,769 | ---- | C] () -- C:\DOCUME~1\ALLUSE~1\Desktop\VLC media player.lnk [2009/05/09 21:11:52 | 00,000,000 | ---D | C] -- C:\Program Files\VideoLAN [2009/05/06 12:27:34 | 00,000,000 | ---D | C] -- C:\DOCUME~1\Michael\My Documents\Downloads [2009/04/20 14:28:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Michael\Application Data\Google [2009/04/20 14:28:37 | 00,001,823 | ---- | C] () -- C:\DOCUME~1\ALLUSE~1\Desktop\Google Chrome.lnk [2009/04/20 14:27:00 | 00,000,882 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job [2009/04/20 14:26:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Google Updater [2009/04/20 14:25:59 | 00,000,868 | ---- | C] () -- C:\WINDOWS\tasks\Google Software Updater.job [2009/04/20 14:25:56 | 00,000,000 | ---D | C] -- C:\Program Files\Google [2009/03/04 13:47:53 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009/02/16 02:17:28 | 00,036,352 | R--- | C] () -- C:\WINDOWS\System32\langlib.dll [2009/02/16 02:17:28 | 00,000,092 | ---- | C] () -- C:\WINDOWS\Er.ini [2009/02/16 01:36:18 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2009/02/10 02:33:50 | 00,000,214 | ---- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini [2009/02/08 13:52:33 | 00,000,000 | ---- | C] () -- C:\WINDOWS\OODCNT.INI [2009/02/08 06:00:03 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [2009/02/08 05:34:20 | 00,000,410 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI [2009/02/08 01:17:29 | 00,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini [2009/02/08 01:17:29 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll [2009/02/08 01:17:29 | 00,010,165 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini [2009/02/08 01:17:29 | 00,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini [2009/02/08 01:16:46 | 00,006,528 | ---- | C] () -- C:\WINDOWS\System32\drivers\Tbiosdrv.sys [2005/05/13 05:52:58 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2005/05/13 04:46:34 | 00,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2005/05/13 04:42:23 | 00,034,048 | ---- | C] () -- C:\WINDOWS\System32\drivers\WOWXT_kern_i386.sys [2005/05/13 04:42:23 | 00,029,184 | ---- | C] () -- C:\WINDOWS\System32\drivers\TSXT_kern_i386.sys [2005/05/13 04:38:28 | 00,000,000 | ---- | C] () -- C:\WINDOWS\NDSTray.INI [2005/05/13 04:35:56 | 00,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2005/05/13 04:35:55 | 00,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2005/05/13 04:35:55 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2005/05/13 04:35:55 | 00,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2005/05/13 04:35:55 | 00,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2005/05/13 04:35:55 | 00,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2005/05/13 04:30:09 | 00,356,352 | ---- | C] () -- C:\WINDOWS\EMCRI.dll [2005/05/13 04:29:02 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\EBLib.DLL [2005/05/13 04:27:48 | 00,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2005/05/12 15:38:20 | 00,000,780 | ---- | C] () -- C:\WINDOWS\orun32.ini [2005/05/12 15:14:58 | 00,002,388 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2005/05/12 15:14:41 | 00,000,658 | ---- | C] () -- C:\WINDOWS\win.ini [2005/05/12 15:14:39 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini [2005/04/25 11:51:32 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\TPeculiarity.dll [2005/04/20 15:59:06 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\TCtrlIO.dll [2005/04/01 15:39:56 | 00,024,576 | ---- | C] () -- C:\WINDOWS\System32\EKECioCtl.dll [2005/04/01 15:37:54 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\HWS_Ctrl.dll [2005/04/01 15:37:48 | 00,024,576 | ---- | C] () -- C:\WINDOWS\System32\SPCtl.dll [2005/03/22 05:56:44 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2003/03/09 22:31:04 | 00,561,152 | ---- | C] () -- C:\WINDOWS\System32\hpotscl.dll [2001/09/18 13:00:00 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\bmpproc.dll ========== Files - Modified Within 30 Days ========== [5 C:\WINDOWS\System32\*.tmp files] [2 C:\WINDOWS\*.tmp files] [2009/05/17 16:45:59 | 00,501,248 | ---- | M] (OldTimer Tools) -- C:\DOCUME~1\Michael\Desktop\OTListIt2.exe [2009/05/17 16:42:53 | 00,267,612 | ---- | M] () -- C:\DOCUME~1\Michael\Desktop\Rooter.exe [2009/05/17 16:29:28 | 00,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job [2009/05/17 15:42:04 | 00,000,394 | ---- | M] () -- C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1239748883.job [2009/05/17 15:40:45 | 03,917,344 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat [2009/05/17 15:40:43 | 00,031,684 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx [2009/05/17 14:51:26 | 00,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job [2009/05/17 14:23:43 | 00,002,335 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk [2009/05/17 14:23:18 | 00,021,876 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2009/05/17 14:22:54 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Michael\Local Settings\desktop.ini [2009/05/17 14:22:31 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009/05/17 14:22:27 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009/05/17 14:22:24 | 21,458,98496 | -HS- | M] () -- C:\hiberfil.sys [2009/05/17 14:22:22 | 00,095,775 | ---- | M] () -- C:\WINDOWS\System32\oodbs.lor [2009/05/17 14:21:06 | 00,581,664 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.dat [2009/05/17 14:21:06 | 00,003,068 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.idx [2009/05/17 13:22:44 | 00,023,040 | -HS- | M] () -- C:\DOCUME~1\Michael\My Documents\Thumbs.db [2009/05/17 13:12:50 | 00,000,746 | ---- | M] () -- C:\DOCUME~1\ALLUSE~1\Desktop\Malwarebytes' Anti-Malware.lnk [2009/05/17 12:08:07 | 00,045,568 | ---- | M] () -- C:\DOCUME~1\Michael\Desktop\keygen.exe [2009/05/17 11:01:33 | 00,000,426 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{36DFDF38-6651-4DC8-B85D-6929BFFCD8D5}.job [2009/05/17 01:39:24 | 00,001,886 | ---- | M] () -- C:\DOCUME~1\ALLUSE~1\Desktop\Google Earth.lnk [2009/05/15 13:47:41 | 00,200,192 | ---- | M] () -- C:\DOCUME~1\Michael\Desktop\1490.051109.xls [2009/05/15 11:20:28 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009/05/13 23:07:55 | 00,000,092 | ---- | M] () -- C:\WINDOWS\Er.ini [2009/05/13 22:58:02 | 00,043,062 | ---- | M] () -- C:\DOCUME~1\Michael\My Documents\UserImages.bmp [2009/05/12 20:14:50 | 00,024,064 | ---- | M] () -- C:\DOCUME~1\Michael\My Documents\3208 East 43rd Ave.doc [2009/05/12 20:04:18 | 00,000,078 | -HS- | M] () -- C:\DOCUME~1\Michael\My Documents\desktop.ini [2009/05/12 20:02:11 | 00,000,162 | -H-- | M] () -- C:\DOCUME~1\Michael\My Documents\~$08 East 43rd Ave.doc [2009/05/12 19:55:18 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2009/05/11 18:33:52 | 00,001,823 | ---- | M] () -- C:\DOCUME~1\ALLUSE~1\Desktop\Google Chrome.lnk [2009/05/09 21:30:08 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009/05/09 21:12:17 | 00,000,769 | ---- | M] () -- C:\DOCUME~1\ALLUSE~1\Desktop\VLC media player.lnk [2009/05/08 15:33:13 | 00,001,599 | ---- | M] () -- C:\DOCUME~1\Michael\Desktop\06.18.2009_04DDCB19.key [2009/05/07 00:16:30 | 24,699,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe [2009/04/28 09:49:02 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2009/04/24 22:30:39 | 00,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iecompat.dll < End of report > |
|
|
|
|
May 17 2009, 05:55 PM
Post
#6
|
|
|
Member Posts: 94 From: Vancouver BC, Canada OS: Microsoft Windows XP Home Edition, Service Pack 3 |
and the last log is Extras:
OTListIt Extras logfile created on: 5/17/2009 4:50:03 PM - Run 1 OTListIt2 by OldTimer - Version 2.0.15.8 Folder = C:\Documents and Settings\Michael\Desktop Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.22 Gb Available Physical Memory | 61.26% Memory free 3.85 Gb Paging File | 3.19 Gb Available in Paging File | 83.06% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 92.97 Gb Total Space | 33.97 Gb Free Space | 36.53% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded Drive F: | 7.47 Gb Total Space | 4.83 Gb Free Space | 64.71% Space Free | Partition Type: FAT32 G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: LAPTOP-TOSHIBA Current User Name: Michael Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Minimal File Age = 30 Days Company Name Whitelist: On ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] "DisableMonitoring" = 1 "" = [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile "EnableFirewall" = 0 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List "1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008 "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation) C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call (Microsoft Corporation) C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation) C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger (Microsoft Corporation) C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call (Microsoft Corporation) C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger (Microsoft Corporation) C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype (Skype Technologies S.A.) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{008D69EB-70FF-46AB-9C75-924620DF191A}" = TOSHIBA Speech System SR Engine(U.S.) Version1.0 "{02EED746-8C5A-43C8-BB3D-D29C8B363A4D}" = TOSHIBA Zooming Utility "{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger "{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView "{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA "{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver "{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist "{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool "{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime "{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT "{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe "{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0 "{2FCE4FC5-6930-40E7-A4F1-F862207424EF}" = InterVideo WinDVD Creator 2 "{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0 "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{3560CE5A-C4EF-4DB0-9ECC-BA035FE309C5}" = MSN Toolbar "{3A57482F-BEBC-47E4-ADA1-6302403C7E50}" = TOSHIBA Accessibility "{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform "{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA "{3FBF6F99-8EC6-41B4-8527-0A32241B5496}" = TOSHIBA Speech System TTS Engine(U.S.) Version1.0 "{48CF9A66-5F03-4025-ABD0-B3A3FA095A59}" = TOSHIBA SD Memory Card Format "{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password "{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup "{534806D0-E887-4B7A-8572-63B8F82B511D}" = O&O DiskImage Professional "{5BCA8D15-BCB6-421E-9654-238B43456A4F}" = TOSHIBA Controls "{5D96E2B1-D9AC-46E0-9073-425C5F63E338}" = Touch and Launch "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{6ECB39BD-73C2-44DD-B1A0-898207C58D8B}" = HP Photo and Imaging 2.0 - All-in-One Drivers "{7900D3A6-A9E8-4954-ACCB-AB15867978BF}" = TOSHIBA Hotkey Utility "{80977342-27E8-4FF7-8B6A-D8D89461DA7F}" = TouchPad On/Off Utility "{84B2CF01-194D-2284-B313-F2E0D78D1033}" = Nero 7 Demo "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8B12BA86-ADAC-4BA6-B441-FFC591087252}" = TOSHIBA Virtual Sound "{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr "{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp "{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}" = Kaspersky Internet Security 2009 "{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard "{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage "{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz "{90CC4231-94AC-45CD-991A-0253BFAC0650}" = mDrWiFi "{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD for TOSHIBA "{91A10409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office OneNote 2003 "{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant "{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig "{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow! "{9867A917-5D17-40DE-83BA-BEA5293194B1}" = HP Photo and Imaging 2.0 - All-in-One "{9CC89556-3578-48DD-8408-04E66EBEF401}" = mXML "{9D765FA6-F2BC-40AF-8145-50808F9BDF4E}" = DVD-RAM Driver "{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver "{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer "{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI "{A38D57D1-5F29-4691-B3DD-FE4B3A7B3AFE}" = TOSHIBA Power Saver "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-1033-0000-7760-000000000002}" = Adobe Acrobat 7.0 Professional "{B39C475A-77A7-446D-B423-8051E976D910}" = USB to Serial Bridge Controller "{B4AB2BF1-AE6B-46AF-8809-56743597CCAF}" = Russian Phonetic YaZHert - RusWin.net "{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree "{C45F4811-31D5-4786-801D-F79CD06EDD85}" = SD Secure Module "{C6CA8874-5F22-4AF0-9BE3-016BF299C536}" = Windows Live Essentials "{C900EF06-2E76-49C7-8DB0-41F629B21DC5}" = hp psc 1200 series "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CC016F21-3970-11DE-B878-005056806466}" = Google Earth "{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore "{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial "{EE033C1F-443E-41EC-A0E2-559B539A4E4D}" = TOSHIBA Speech System Applications "{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse "{F530581E-12FE-43B4-A28D-E5257AAD63E6}" = O&O Defrag Professional "{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call "{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio "{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe "Adobe Acrobat 5.0" = Adobe Acrobat 5.0 "Adobe Acrobat 7.0 Professional" = Adobe Acrobat 7.1.0 Professional "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Photoshop 7.0" = Adobe Photoshop 7.0 "Creative Video Blaster WebCam Control" = Creative Video Blaster WebCam Control "DVD Shrink_is1" = DVD Shrink 3.2 "DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5_is1" = DVDFab (Platinum/Gold/HD Decrypter) (Option: Mobile) 5.2.3.2 "FileZilla Client" = FileZilla Client 3.2.2.1 "Fn-esse" = TOSHIBA Fn-esse "Google Chrome" = Google Chrome "Google Updater" = Google Updater "HP PSC 1200 Series" = HP Photo and Imaging 2.0 - hp psc 1200 series "IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs "ie7" = Windows Internet Explorer 7 "ie8" = Windows Internet Explorer 8 "InstallShield_{02EED746-8C5A-43C8-BB3D-D29C8B363A4D}" = TOSHIBA Zooming Utility "InstallShield_{3A57482F-BEBC-47E4-ADA1-6302403C7E50}" = TOSHIBA Accessibility "InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password "InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup "InstallShield_{5BCA8D15-BCB6-421E-9654-238B43456A4F}" = TOSHIBA Controls "InstallShield_{7900D3A6-A9E8-4954-ACCB-AB15867978BF}" = TOSHIBA Hotkey Utility "InstallShield_{80977342-27E8-4FF7-8B6A-D8D89461DA7F}" = TouchPad On/Off Utility "InstallShield_{A38D57D1-5F29-4691-B3DD-FE4B3A7B3AFE}" = TOSHIBA Power Saver "InstallShield_{B39C475A-77A7-446D-B423-8051E976D910}" = USB to Serial Bridge Controller "InstallWIX_{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}" = Kaspersky Internet Security 2009 "Language Teacher 2000 Eng-Rus" = Language Teacher 2000 Eng-Rus "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "NVIDIA Drivers" = NVIDIA Drivers "PC Diagnostic Tool" = TOSHIBA PC Diagnostic Tool "ProInst" = Intel® PROSet/Wireless Software "TOSHIBA Software Modem" = TOSHIBA Software Modem "Toshiba Tbiosdrv Driver" = Toshiba Tbiosdrv Driver "VLC media player" = VLC media player 0.9.6 "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Windows Media Player 11 "Windows XP Service Pack" = Windows XP Service Pack 3 "WinLiveSuite_Wave3" = Windows Live Essentials "WinRAR archiver" = WinRAR archiver "WinZip" = WinZip "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0 ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 4/14/2009 3:18:50 PM | Computer Name = LAPTOP-TOSHIBA | Source = Application Hang | ID = 1002 Description = Hanging application msnmsgr.exe, version 14.0.8064.206, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 4/14/2009 3:18:56 PM | Computer Name = LAPTOP-TOSHIBA | Source = Application Hang | ID = 1002 Description = Hanging application msnmsgr.exe, version 14.0.8064.206, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 4/14/2009 3:18:59 PM | Computer Name = LAPTOP-TOSHIBA | Source = Application Hang | ID = 1002 Description = Hanging application msnmsgr.exe, version 14.0.8064.206, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 4/14/2009 3:19:00 PM | Computer Name = LAPTOP-TOSHIBA | Source = Application Hang | ID = 1002 Description = Hanging application msnmsgr.exe, version 14.0.8064.206, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 4/14/2009 3:19:01 PM | Computer Name = LAPTOP-TOSHIBA | Source = Application Hang | ID = 1002 Description = Hanging application msnmsgr.exe, version 14.0.8064.206, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 5/11/2009 9:57:38 PM | Computer Name = LAPTOP-TOSHIBA | Source = Application Hang | ID = 1002 Description = Hanging application OUTLOOK.EXE, version 10.0.6838.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 5/12/2009 1:16:04 PM | Computer Name = LAPTOP-TOSHIBA | Source = Application Hang | ID = 1002 Description = Hanging application OUTLOOK.EXE, version 10.0.6838.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 5/12/2009 7:15:17 PM | Computer Name = LAPTOP-TOSHIBA | Source = Application Hang | ID = 1002 Description = Hanging application msnmsgr.exe, version 14.0.8064.206, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 5/16/2009 1:59:46 AM | Computer Name = LAPTOP-TOSHIBA | Source = Application Hang | ID = 1002 Description = Hanging application OUTLOOK.EXE, version 10.0.6838.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Error - 5/17/2009 3:16:27 AM | Computer Name = LAPTOP-TOSHIBA | Source = Application Hang | ID = 1002 Description = Hanging application OUTLOOK.EXE, version 10.0.6838.0, hang module hungapp, version 0.0.0.0, hang address 0x00000000. [ System Events ] Error - 5/3/2009 5:39:48 PM | Computer Name = LAPTOP-TOSHIBA | Source = Dhcp | ID = 1000 Description = Your computer has lost the lease to its IP address 192.168.1.100 on the Network Card with network address 0013CE23563F. Error - 5/3/2009 5:39:57 PM | Computer Name = LAPTOP-TOSHIBA | Source = Dhcp | ID = 1001 Description = Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0013CE23563F. The following error occurred: %%1223. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. Error - 5/3/2009 7:00:34 PM | Computer Name = LAPTOP-TOSHIBA | Source = Dhcp | ID = 1001 Description = Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0013CE23563F. The following error occurred: %%1223. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. Error - 5/4/2009 7:08:11 PM | Computer Name = LAPTOP-TOSHIBA | Source = W32Time | ID = 39452689 Description = Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751) Error - 5/4/2009 7:08:11 PM | Computer Name = LAPTOP-TOSHIBA | Source = W32Time | ID = 39452701 Description = The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time. Error - 5/9/2009 2:57:00 AM | Computer Name = LAPTOP-TOSHIBA | Source = Service Control Manager | ID = 7011 Description = Timeout (30000 milliseconds) waiting for a transaction response from the Netman service. Error - 5/11/2009 1:24:07 AM | Computer Name = LAPTOP-TOSHIBA | Source = Service Control Manager | ID = 7011 Description = Timeout (30000 milliseconds) waiting for a transaction response from the WZCSVC service. Error - 5/14/2009 1:25:30 AM | Computer Name = LAPTOP-TOSHIBA | Source = Dhcp | ID = 1000 Description = Your computer has lost the lease to its IP address 192.168.1.100 on the Network Card with network address 0013CE23563F. Error - 5/17/2009 5:20:18 PM | Computer Name = LAPTOP-TOSHIBA | Source = Dhcp | ID = 1001 Description = Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0013CE23563F. The following error occurred: %%1223. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. Error - 5/17/2009 5:23:00 PM | Computer Name = LAPTOP-TOSHIBA | Source = Service Control Manager | ID = 7026 Description = The following boot-start or system-start driver(s) failed to load: IntelIde < End of report > |
|
|
|
|
May 18 2009, 05:52 AM
Post
#7
|
|
|
Malware Moderator / Malware Staff Posts: 2,456 From: The Land Down Under OS: Windows XP pro |
Restart the computer Please go to Kaspersky website and perform an online antivirus scan. This will take some time to complete so please be patient and let it finish.
|
|
|
|
|
May 20 2009, 02:37 AM
Post
#8
|
|
|
Member Posts: 94 From: Vancouver BC, Canada OS: Microsoft Windows XP Home Edition, Service Pack 3 |
I did instal the latest version of Java Runtime Environment (JRE) 6 Update 13
When I did go to Kaspersky website and it started to download the scanner , an ERROR message poped out telling : "you cannot run Kaspersky Online Scanner 7.0 because you already have Kaspesky Internet Security 8.0(9.0) installed on the computer" I did run the scan with my Kaspesky Internet Security 8.0 and it found a virus called HEUR:Exploit.Script.Generic . I did check on several forums and this seems to be not a virus at all. Is this corect? What else I need to do? Thanks |
|
|
|
|
May 20 2009, 06:39 AM
Post
#9
|
|
|
Malware Moderator / Malware Staff Posts: 2,456 From: The Land Down Under OS: Windows XP pro |
I would like to see where the detected infection is, as this is an Heuristc detection it can sometimes simply be a suspicious script in a web page.
In Kaspersky, click Detected and select all detected malware in the dropdown list. Expand Virus and take a screenshot of it and attach it here using Imageshack or another similar image hosting site. |
|
|
|
|
May 21 2009, 02:56 PM
Post
#10
|
||
|
Member Posts: 94 From: Vancouver BC, Canada OS: Microsoft Windows XP Home Edition, Service Pack 3 |
[attachment=30338:Kaspersk...een_shot.JPG]Here is the screen shot
This post has been edited by mraskin: May 21 2009, 03:01 PM
Attached thumbnail(s)
|
|
|
|
|
|
May 22 2009, 01:59 AM
Post
#11
|
|
|
Malware Moderator / Malware Staff Posts: 2,456 From: The Land Down Under OS: Windows XP pro |
Please download ATF Cleaner by Atribune. Ignore the download step if you already have this downloaded on your computer.
Caution: This program is for Windows 2000, XP and Vista only
Under Main choose: Select All Click the Empty Selected button.
Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Please download the OTM by OldTimer.
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. If those results come back ok, then I can give you the final clean-up instructions. |
|
|
|
|
May 26 2009, 07:08 PM
Post
#12
|
|
|
Member Posts: 94 From: Vancouver BC, Canada OS: Microsoft Windows XP Home Edition, Service Pack 3 |
Here is the OTM log:
Error: Unable to interpret <========== FILES ==========> in the current context! Error: Unable to interpret <File/Folder C:\_Backup\_Backup_Misha\toshiba_laptop_Old\User\Local Settings\Temporary Internet Files\Content.IE5\X7ZN11SE\1[1].pdf not found.> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <OTM by OldTimer - Version 2.1.0.0 log created on 05262009_180357> in the current context! OTM by OldTimer - Version 2.1.0.0 log created on 05262009_180707 |
|
|
|
|
May 27 2009, 06:26 AM
Post
#13
|
|
|
Malware Moderator / Malware Staff Posts: 2,456 From: The Land Down Under OS: Windows XP pro |
QUOTE Error: Unable to interpret <File/Folder C:\_Backup\_Backup_Misha\toshiba_laptop_Old\User\Local Settings\Temporary Internet Files\Content.IE5\X7ZN11SE\1[1].pdf not found.> in the current context! The part in red doesn't look right... Did you enter the script exactly as it was in the Code Box in the instructions that I posted? |
|
|
|
|
May 28 2009, 01:21 PM
Post
#14
|
|
|
Member Posts: 94 From: Vancouver BC, Canada OS: Microsoft Windows XP Home Edition, Service Pack 3 |
yes I did exactly as per your instructions,
I entered this: :Files C:\_Backup\_Backup_Misha\toshiba_laptop_Old\User\Local Settings\Temporary Internet Files\Content.IE5\X7ZN11SE\1[1].pdf |
|
|
|
|
May 31 2009, 01:55 AM
Post
#15
|
|
|
Malware Moderator / Malware Staff Posts: 2,456 From: The Land Down Under OS: Windows XP pro |
My apologies for the late response, something went haywire and I didn't receive a reply notification.
 The file I was previously concerned about appears to be a temporary internet file that Kaspersky was picking up with Heuristic scanning, which means that the file may not have been malicious just that a script in the file was detected as suspicious. I would like you to update MBAM and perform a Full Scan.
Extra Note: If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly. Post the MBAM results and let me know how the computer is now running in your next reply. |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
Similar Topics
| Topic Title | Replies / Views | Topic Information | |||||
|---|---|---|---|---|---|---|---|
 |
1 / 299 | 25th January 2008 - 06:04 PM ARC Trooper 111 started - last by Major Payne |
|||||
|
|
1 / 820 | 6th November 2008 - 08:14 AM mraskin started - last by Rorschach112 |
||||
|
|
1 / 1,918 | 12th November 2008 - 02:40 PM mraskin started - last by mraskin |
||||
|
0 / 339 | 7th June 2009 - 08:40 AM Tiffytot started - last by Tiffytot |
|||||
|
Time is now: 21st November 2009 - 02:35 AM |
Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks mentioned on this page are the property of their respective owners.
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy | Advertising