[Gator27]

I noticed today that a folder has appeared from nowhere and has been placed on my desktop named %SystemDrive%. When I follow the path C:\Documents and Settings\Gator\Desktop\%SystemDrive%\Documents and Settings\Gator\Application Data\Microsoft\CryptnetUrlCache I find two folders.

The first folder is named Content and within that folder is some kind of file which is named 74BFD122C0875EC75DBE5C6DB4C59019

The second folder is named MetaData within that folder is another file named
74BFD122C0875EC75DBE5C6DB4C59019

Both files have a creation date of today. Since noticing this folder and trying to search the web for solutions I have found my browser to be slow, I'm using IE 7 with Window XP Home Edition SP2.

When I follow the same path but start through MyComputer
C:\Documents and Settings\Gator\Application Data\Microsoft\CryptnetUrlCache\Content
and
C:\Documents and Settings\Gator\Application Data\Microsoft\CryptnetUrlCache\MetaData
I notice that there are alot more files, about 40 in each folder, named in a similar way. I assume that these are the legitimate files that should be there.
I have been through your five step process and will post the logs in order. For some reason the first application, AVG, would not give me a report after the scan, it said that "No Reports Were Available", even after it Quarantined 33 items.

Hope you can help me resolve this.

Step 1
AVG scanned and Quarantined 33 items, could not obtain report.


SUPERantiSpyware Log

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/16/2008 at 04:20 PM

Application Version : 3.9.1008

Core Rules Database Version : 3380
Trace Rules Database Version: 1374

Scan type : Complete Scan
Total Scan Time : 01:35:06

Memory items scanned : 710
Memory threats detected : 0
Registry items scanned : 7783
Registry threats detected : 1
File items scanned : 83013
File threats detected : 48

Adware.Tracking Cookie
C:\Documents and Settings\Gator\Cookies\[email protected][2].txt
C:\Documents and Settings\Gator\Cookies\gator@tribalfusion[3].txt
C:\Documents and Settings\Gator\Cookies\[email protected][1].txt
C:\Documents and Settings\Gator\Cookies\[email protected][1].txt
C:\Documents and Settings\Bubaloo\Cookies\[email protected][2].txt
C:\Documents and Settings\Bubaloo\Cookies\bubaloo@clicktorrent[1].txt
C:\Documents and Settings\Bubaloo\Cookies\bubaloo@imrworldwide[2].txt
C:\Documents and Settings\Bubaloo\Cookies\bubaloo@pathfinder[1].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][1].txt
C:\Documents and Settings\KaKa\Cookies\kaka@adcentriconline[1].txt
C:\Documents and Settings\KaKa\Cookies\kaka@adknowledge[1].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][1].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][2].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][2].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][2].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][1].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][1].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][1].txt
C:\Documents and Settings\KaKa\Cookies\kaka@atwola[2].txt
C:\Documents and Settings\KaKa\Cookies\kaka@azjmp[2].txt
C:\Documents and Settings\KaKa\Cookies\kaka@belnk[1].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][1].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][2].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][2].txt
C:\Documents and Settings\KaKa\Cookies\kaka@imrworldwide[2].txt
C:\Documents and Settings\KaKa\Cookies\kaka@interclick[2].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][2].txt
C:\Documents and Settings\KaKa\Cookies\kaka@manhattanmedia[1].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][1].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][1].txt
C:\Documents and Settings\KaKa\Cookies\kaka@media_center[1].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][2].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][2].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][1].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][1].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][2].txt
C:\Documents and Settings\KaKa\Cookies\kaka@socialmedia[1].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][2].txt
C:\Documents and Settings\KaKa\Cookies\kaka@superstats[2].txt
C:\Documents and Settings\KaKa\Cookies\kaka@toseeka[1].txt
C:\Documents and Settings\KaKa\Cookies\kaka@tracking[1].txt
C:\Documents and Settings\KaKa\Cookies\kaka@tracking[2].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][2].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][1].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][2].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][1].txt
C:\Documents and Settings\KaKa\Cookies\[email protected][1].txt

Adware.Avenue Media/Internet Optimizer
HKU\S-1-5-21-2478043090-1692588932-2926526861-1008\Software\Microsoft\Internet Explorer\URLSearchHooks#_{CFBFAE00-17A6-11D0-99CB-00C04FD64497}

Background Agent Application by Broderbund Software
C:\WINDOWS\BBSTORE\DSS\DSSAGENT.EXE


Will paste next step in new post, seem to have max out

CONTINUED

Step 2
Panda Software Log



Incident Status
Location

Potentially unwanted tool:Application/PRScheduler Not disinfected C:\Documents and Settings\Gator\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
Adware:adware/sahagent Not disinfected c:\SahAgent.log
Adware:adware/dyfuca Not disinfected Windows Registry
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Bubaloo\Cookies\bubaloo@go[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Gator\Cookies\gator@com[1].txt
Spyware:Cookie/360i Not disinfected C:\Documents and Settings\KaKa\Cookies\[email protected][1].txt
Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\KaKa\Cookies\kaka@did-it[2].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\KaKa\Cookies\kaka@go[2].txt
Adware:Adware/Trymedia Not disinfected C:\Downloads\BuzzwordsSetup-dm[1].exe
Step 3
Ran Windows Update - No Updates Available

Step 4
Rebooted - Folder is still on desktop

Step 5
Hijack This Log followed by Hijack This Uninstall List

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:00:03 PM, on 16/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Documents and Settings\Gator\Desktop\AVG - EWIDO ANTI-SPYWARE\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\IBM\Updater\jre\bin\javaw.exe
C:\IBMTOOLS\UTILS\ibmprc.exe
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\system32\SKDAEMON.EXE
C:\WINDOWS\system32\FSRremoS.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\Pelmiced.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Documents and Settings\Gator\Desktop\AVG - EWIDO ANTI-SPYWARE\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\Documents and Settings\Gator\Desktop\SUPER-ANTI-SPYWARE\SUPERAntiSpyware.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Oregon Scientific\SmartGlobe CA\SmartGlobeCA.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\IBM\Updater\ucgather.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Documents and Settings\Gator\Desktop\HJTHIS\HijackThis.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://start.sympatico.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\UIBHO.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [Hot Key Kbd Daemon] SKDAEMON.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Documents and Settings\Gator\Desktop\AVG - EWIDO ANTI-SPYWARE\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SansaDispatch] C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Documents and Settings\Gator\Desktop\SUPER-ANTI-SPYWARE\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: SmartGlobeCA.lnk = ?
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symant...ex/symdlmgr.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai...5/installer.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7F68283-273E-4C2F-B7E2-4F445B7B772B}: NameServer = 207.164.234.193 207.164.234.129
O20 - Winlogon Notify: !SASWinLogon - C:\Documents and Settings\Gator\Desktop\SUPER-ANTI-SPYWARE\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Documents and Settings\Gator\Desktop\AVG - EWIDO ANTI-SPYWARE\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 12272 bytes

Uninstall List

Access IBM
Access IBM Message Center
Ad-Aware 2007
Adobe Flash Player 9 ActiveX
Adobe Reader 7.0.9
Adobe Shockwave Player
AppCore
Apple Mobile Device Support
Apple Software Update
ArcSoft PhotoStudio 5
Arthur's Thinking Games
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
AV
AVG Anti-Spyware 7.5
Bookworm Deluxe 1.03
Broadcom Advanced Control Suite
Business Contact Manager for Outlook 2003
Caillou® Party Fun & Games™
Canon Camera Access Library
Canon Camera Support Core Library
Canon Camera Window DC_DV 5 for ZoomBrowser EX
Canon Camera Window DC_DV 6 for ZoomBrowser EX
Canon Camera Window DSLR 5 for ZoomBrowser EX
Canon Camera Window MC 6 for ZoomBrowser EX
Canon MovieEdit Task for ZoomBrowser EX
Canon PhotoRecord
Canon RAW Image Task for ZoomBrowser EX
Canon ZoomBrowser EX (E)
ccCommon
CCleaner (remove only)
CCScore
Clifford Musical Memory Games
Colour@Home II
Conexant SoftK56 Data Fax
Curious George Learning Games
Dinosaur Adventure 3-D
DiscAPI (Studio 10)
DivX
Doppler
Dr. Seuss Kindergarten
Dragon Tales: Dragon Land Festival
Efficient Networks SpeedStream DSL
ESSBrwr
ESSCDBK
ESScore
ESSgui
ESSini
ESSPCD
ESSPDock
ESSSONIC
ESSTOOLS
essvatgt
fflink
Franklin The Turtle Club
GearDrvs
HijackThis 2.0.2
Hot Wheels Stunt Track Challenge
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
HP Customer Participation Program 7.0
HP Document Viewer 7.0
HP Imaging Device Functions 7.0
HP Photosmart Premier Software 6.5
HP Photosmart, Officejet and Deskjet 7.0.A
HP Solution Center 7.0
HP Update
IBM 32-bit Runtime Environment for Java 2, v1.4.1
IBM DLA
IBM RecordNow!
IBM Rescue and Recovery with Rapid Restore
IBM Update Connector
IBM USB Enhanced Performance Keyboard
Indeo® Software
Intel A/V Codecs V2.0
InterVideo WinDVD
iTunes
J2SE Runtime Environment 5.0 Update 10
J2SE Runtime Environment 5.0 Update 11
J2SE Runtime Environment 5.0 Update 6
J2SE Runtime Environment 5.0 Update 9
Java™ 6 Update 2
Java™ 6 Update 3
Java™ SE Runtime Environment 6 Update 1
kgcbaby
kgcbase
kgchday
kgchlwn
kgcinvt
kgckids
kgcmove
kgcvday
Kodak EasyShare software
KSU
LimeWire PRO 4.14.10
LiveUpdate 3.2 (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Small Business Edition 2003
MixMeister BPM Analyzer 1.0
Mouse Suite
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
netbrdg
Norton 360
Norton 360
Norton 360
Norton 360 (Symantec Corporation)
Norton 360 Help
Norton Confidential Browser Component
Norton Confidential Web Authentification Component
Norton Confidential Web Protection Component
Notifier
OCR Software by I.R.I.S 7.0
OfotoXMI
Panda ActiveScan
PC-Doctor for Windows
Photo Story 3 for Windows
Putt-Putt Travels Through Time
Putt-Putt: Pep's Birthday Surprise
QuickBooks Pro Edition 2007
QuickTax 2004
QuickTax 2005
QuickTax 2006
QuickTime
RAPID (Studio 10)
RealPlayer G2
Rescue Heroes™ Lava Landslide
Sansa Media Converter
Sansa Updater
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
SFR
SHASTA
skin0001
SKINXSDK
SmartGlobe CA
SmartSound Quicktracks Plugin
SoundMAX
SPBBC 32bit
Spider-Man and Friends Superhero Adventure
SpongeBob SquarePants® Operation Krabby Patty
staticcr
Studio 10
SUPERAntiSpyware Free Edition
SuppSoft
Symantec Technical Support Controls
Symantec Technical Support Web Controls
SymNet
The Land Before Time Kindergarten Adventure
ThinkCentre Wallpaper
TOD
TONKA Search & Rescue 2
Tonka Search and Rescue
TONKA TOWN
tooltips
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Virtual Decorator Xpert : Crown Diamond
Virtual Decorator Xpert : Sico
Virtual Decorator Xpert 1.0
VPRINTOL
Winamp (remove only)
Windows Backup Utility
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB833407
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
WIRELESS

Edited by admin, 16 January 2008 - 11:38 PM.

[Advertisements]

Hello

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Download rootchk by Ejvindh to your desktop.

• Temporarily Disable Real Time Monitoring Programs you have running that are listed here, such as TeaTimer, Adwatch, and HIPs programs like Prevx, while we complete the fixes (see **Note below).
• Disconnect from the internet
• Double click rootchk.exe to run the program
• After a short time a logfile will open.
• Copy the contents of the log into your next reply.
• Re-enable active protection on any program you have disabled while completing the scan

**Note:If you are using the ZoneAlarm Pro firewall or any other security program that protects your registry (Teatimer, Adwatch, Prevx), rootchk may produce false positives. That is why it is important for you to disable these programs before running a rootchk scan. To prevent ZoneAlarm Pro conflicts, first enable the Windows Firewall (click start | Control Panel | Windows Firewall and select the checkbox to turn it on). Then disable ZoneAlarm Pro before running the rootchk. Also, disable any other active protection programs including HIPs that block registry write access. After the scan, be sure re-enable ZoneAlarm Pro and any other active protection programs you have temporarily disabled.

[Rorschach112]

Hello

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner and click Accept

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Extended (if available otherwise Standard)
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

Download rootchk by Ejvindh to your desktop.

• Temporarily Disable Real Time Monitoring Programs you have running that are listed here, such as TeaTimer, Adwatch, and HIPs programs like Prevx, while we complete the fixes (see **Note below).
• Disconnect from the internet
• Double click rootchk.exe to run the program
• After a short time a logfile will open.
• Copy the contents of the log into your next reply.
• Re-enable active protection on any program you have disabled while completing the scan

**Note:If you are using the ZoneAlarm Pro firewall or any other security program that protects your registry (Teatimer, Adwatch, Prevx), rootchk may produce false positives. That is why it is important for you to disable these programs before running a rootchk scan. To prevent ZoneAlarm Pro conflicts, first enable the Windows Firewall (click start | Control Panel | Windows Firewall and select the checkbox to turn it on). Then disable ZoneAlarm Pro before running the rootchk. Also, disable any other active protection programs including HIPs that block registry write access. After the scan, be sure re-enable ZoneAlarm Pro and any other active protection programs you have temporarily disabled.

[Gator27]

Thanks for replying, I have done as instructed - here are the logs attached.

I tried pasting them but they got cut off.

Hope this helps and thanks.

Attached Files

•  extra.txt   28.13KB   172 downloads
•  main.txt   24.75KB   305 downloads
•  Kaspersky_Scan.txt   30.95KB   106 downloads
•  rootlog.txt   582bytes   120 downloads

Edited by Gator27, 21 January 2008 - 09:18 PM.

[Rorschach112]

Hello

Please download the OTMoveIt2 by OldTimer.

• Save it to your desktop.
• Please double-click OTMoveIt2.exe to run it.
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  C:\Downloads\BuzzwordsSetup-dm[1].exe
  C:\WINDOWS\Tasks\BKUPAPR16.job

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light blue bar) and choose Paste.
  
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  purity

• Return to OTMoveIt2, right click in the "Paste List Of Files/Patterns To Search For and Move" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.



Also post a new DSS log(don't attach it) and tell me how your PC is running

[Gator27]

Hello,

I have carried out instructions and logs are below, note that when I ran the DSS scan it only provided me with the "Main" log - I did not get the "Extra" log.

PC seems to be working OK - although the browser is a little sluggish.

The mystery folder that appeared on the desktop, named %SystemDrive% is still there, with the mystery files inside it.

What should I do with this folder and the files ??

OTMoveIt2

C:\Downloads\BuzzwordsSetup-dm[1].exe moved successfully.
C:\WINDOWS\Tasks\BKUPAPR16.job moved successfully.
[Custom Input]
< purity >

OTMoveIt2 v1.0.14 log created on 01222008_205506

DSS Log

Deckard's System Scanner v20071014.68
Run by Gator on 2008-01-22 20:59:13
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Total Physical Memory: 511 MiB (512 MiB recommended).


-- HijackThis (run as Gator.exe) -----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:59:49 PM, on 22/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Documents and Settings\Gator\Desktop\AVG - EWIDO ANTI-SPYWARE\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\IBMTOOLS\UTILS\ibmprc.exe
C:\WINDOWS\system32\ICO.EXE
C:\WINDOWS\system32\SKDAEMON.EXE
C:\WINDOWS\system32\FSRremoS.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\Pelmiced.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Documents and Settings\Gator\Desktop\AVG - EWIDO ANTI-SPYWARE\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\Documents and Settings\Gator\Desktop\SUPER-ANTI-SPYWARE\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Oregon Scientific\SmartGlobe CA\SmartGlobeCA.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Gator\Desktop\dss.exe
C:\DOCUME~1\Gator\Desktop\HJTHIS\Gator.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://start.sympatico.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Sympatico
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\NppBho.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.7\UIBHO.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [Hot Key Kbd Daemon] SKDAEMON.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\\PSDrvCheck.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Documents and Settings\Gator\Desktop\AVG - EWIDO ANTI-SPYWARE\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SansaDispatch] C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Documents and Settings\Gator\Desktop\SUPER-ANTI-SPYWARE\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: SmartGlobeCA.lnk = ?
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symant...ex/symdlmgr.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai...5/installer.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7F68283-273E-4C2F-B7E2-4F445B7B772B}: NameServer = 207.164.234.193 207.164.234.129
O20 - Winlogon Notify: !SASWinLogon - C:\Documents and Settings\Gator\Desktop\SUPER-ANTI-SPYWARE\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Documents and Settings\Gator\Desktop\AVG - EWIDO ANTI-SPYWARE\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 11777 bytes

-- Files created between 2007-12-22 and 2008-01-22 -----------------------------

2008-01-21 19:41:23 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-21 19:41:22 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-18 09:02:55 0 d-------- C:\Documents and Settings\KaKa\Application Data\Grisoft
2008-01-16 16:36:02 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-01-16 14:42:34 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-16 14:42:26 0 d-------- C:\Documents and Settings\Gator\Application Data\SUPERAntiSpyware.com
2008-01-16 12:29:10 0 d-------- C:\Documents and Settings\Gator\Application Data\Grisoft
2008-01-16 12:28:57 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-16 10:46:24 0 d-------- C:\Program Files\Lavasoft
2008-01-16 10:46:23 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-16 10:45:16 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-16 09:47:30 0 d-------- C:\WINDOWS\pss
2008-01-10 23:20:27 0 d-------- C:\Program Files\Doppler
2008-01-10 12:09:54 0 d-------- C:\Program Files\Common Files\ODBC
2008-01-04 08:50:32 0 d-------- C:\Program Files\Oregon Scientific
2008-01-04 08:50:31 0 d-------- C:\Program Files\Common Files\USB9KD
2007-12-31 19:03:42 0 d-------- C:\Program Files\Common Files\SWF Studio
2007-12-31 18:39:56 0 d-------- C:\Program Files\directx
2007-12-31 17:54:46 0 d-------- C:\Documents and Settings\All Users\Desktop
2007-12-31 17:35:28 0 d-------- C:\Program Files\JumpStart World
2007-12-31 17:31:33 0 d-------- C:\Documents and Settings\All Users\Application Data\Knowledge Adventure
2007-12-22 14:54:13 0 d-------- C:\Documents and Settings\KaKa\Application Data\Motive


-- Find3M Report ---------------------------------------------------------------

2008-01-22 21:00:04 0 d-------- C:\Program Files\Common Files\Symantec Shared
2008-01-22 20:58:26 42875 --a------ C:\logfile
2008-01-16 17:29:21 0 d-------- C:\Program Files\Norton 360
2008-01-16 17:23:20 0 d-------- C:\Program Files\iTunes
2008-01-16 10:47:00 0 d-------- C:\Program Files\Ad-aware
2008-01-16 10:46:58 0 d-------- C:\Documents and Settings\Gator\Application Data\Lavasoft
2008-01-16 10:45:16 0 d-------- C:\Program Files\Common Files
2008-01-16 09:22:43 0 d-------- C:\Program Files\Scholastic
2008-01-16 09:22:27 0 d-------- C:\Program Files\The Learning Company
2008-01-16 09:13:15 0 d-------- C:\Program Files\Picasa
2008-01-16 09:11:14 0 d-------- C:\Documents and Settings\Gator\Application Data\Vso
2008-01-16 09:11:14 33 --a------ C:\Documents and Settings\Gator\Application Data\pcouffin.log
2008-01-16 09:11:13 47360 --a------ C:\Documents and Settings\Gator\Application Data\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
2008-01-16 09:11:13 1144 --a------ C:\Documents and Settings\Gator\Application Data\pcouffin.inf
2008-01-16 09:11:13 7887 --a------ C:\Documents and Settings\Gator\Application Data\pcouffin.cat
2008-01-16 09:10:33 24 --a------ C:\WINDOWS\popcinfo.dat
2008-01-16 09:08:33 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-01-16 09:08:33 0 d-------- C:\Program Files\ArcSoft
2008-01-16 09:06:59 0 d-------- C:\Documents and Settings\Gator\Application Data\Arcsoft
2008-01-15 14:03:52 0 d-------- C:\Program Files\Nypn Uninstall
2008-01-13 17:01:22 0 d-------- C:\Program Files\Common Files\AnswerWorks 4.0
2008-01-04 16:27:01 0 d-------- C:\Documents and Settings\Gator\Application Data\Apple Computer
2007-12-31 18:39:35 0 d-------- C:\Program Files\THQ
2007-12-31 17:54:45 0 d-------- C:\Program Files\QuickTime
2007-12-22 16:01:12 0 d-------- C:\Program Files\Norton AntiVirus
2007-12-22 16:00:56 0 d-------- C:\Program Files\DivX
2007-12-22 16:00:39 0 d-------- C:\Program Files\Common Files\Motive
2007-12-22 10:40:35 0 d-------- C:\Documents and Settings\Gator\Application Data\Symantec
2007-12-10 23:04:38 0 d-------- C:\Program Files\Symantec
2007-12-04 23:31:51 0 d-------- C:\Program Files\Kodak
2007-12-04 23:30:13 0 d-------- C:\Program Files\Common Files\Kodak
2007-11-29 19:27:54 0 d-------- C:\Program Files\Common Files\Intuit
2007-11-29 19:27:28 0 d-------- C:\Program Files\Intuit
2007-11-25 13:02:15 0 d-------- C:\Program Files\Java


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [15/05/2004 11:10 PM]
"UC_Start"="C:\Program Files\IBM\Updater\\ucstartup.exe" [30/09/2003 05:39 PM]
"UC_SMB"="" []
"@"="" []
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [28/01/2004 03:04 AM]
"IBMPRC"="C:\IBMTOOLS\UTILS\ibmprc.exe" [19/03/2004 02:12 PM]
"Mouse Suite 98 Daemon"="ICO.EXE" [20/11/2003 04:08 PM C:\WINDOWS\system32\ico.exe]
"Hot Key Kbd Daemon"="SKDAEMON.EXE" [29/03/2004 06:02 PM C:\WINDOWS\system32\SKDAEMON.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [25/09/2007 01:11 AM]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" []
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [10/06/2005 10:44 AM]
"PinnacleDriverCheck"="C:\WINDOWS\system32\\PSDrvCheck.exe" [11/03/2004 01:26 AM]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [28/11/2007 07:51 PM]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [17/07/2007 08:54 PM]
"!AVG Anti-Spyware"="C:\Documents and Settings\Gator\Desktop\AVG - EWIDO ANTI-SPYWARE\AVG Anti-Spyware 7.5\avgas.exe" [11/06/2007 04:25 AM]
"SansaDispatch"="C:\Program Files\SanDisk\Sansa Updater\SansaDispatch.exe" [02/05/2007 06:00 PM]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [29/06/2007 05:24 AM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [14/09/2007 09:00 AM]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [19/02/2006 01:41 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/08/2004 02:56 AM]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\Xtras\mssysmgr.exe" []
"ibmmessages"="C:\Program Files\IBM\Messages By IBM\ibmmessages.exe" [20/04/2004 04:01 AM]
"SUPERAntiSpyware"="C:\Documents and Settings\Gator\Desktop\SUPER-ANTI-SPYWARE\SUPERAntiSpyware.exe" [21/06/2007 02:06 PM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

C:\Documents and Settings\Gator\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [19/03/2007 6:07:35 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [23/09/2005 9:05:26 PM]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [19/02/2006 3:21:22 AM]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [10/02/2006 6:56:20 AM]
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [21/06/2007 10:56:14 PM]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [29/11/2007 7:28:46 PM]
SmartGlobeCA.lnk - C:\Program Files\Oregon Scientific\SmartGlobe CA\SmartGlobeCA.exe [04/01/2008 8:50:33 AM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Documents and Settings\Gator\Desktop\SUPER-ANTI-SPYWARE\SASSEH.DLL [20/12/2006 01:55 PM 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Documents and Settings\Gator\Desktop\SUPER-ANTI-SPYWARE\SASWINLO.dll 19/04/2007 01:41 PM 294912 C:\Documents and Settings\Gator\Desktop\SUPER-ANTI-SPYWARE\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"= scecli pwdmon

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

*Newly Created Service* - COMHOST



-- End of Deckard's System Scanner: finished at 2008-01-22 21:00:36 ------------

Thanks

[Rorschach112]

Can you give me more information about this folder since your logs are clean

What is the name of it ?

Can you name some of the files inside it, preferably the exe ones


Go to this site and scan a few of the exe or other files in the folder and post the reports here


Go to this site:
http://www.virustotal.com/
On top you'll find 'Browse'
Click the browse button and browse to the file:

FILE HERE, eg : C:\WINDOWS\system32\drivers\core.sys

Click open.
Then click the 'Send' button next to it.
This will scan the file. Please be patient.
Once scanned, copy and paste the results as well in your next reply.

[Gator27]

I noticed today that a folder has appeared from nowhere and has been placed on my desktop named %SystemDrive%. When I follow the path C:\Documents and Settings\Gator\Desktop\%SystemDrive%\Documents and Settings\Gator\Application Data\Microsoft\CryptnetUrlCache I find two folders.

The first folder is named Content and within that folder is some kind of file which is named 74BFD122C0875EC75DBE5C6DB4C59019

The second folder is named MetaData within that folder is another file named
74BFD122C0875EC75DBE5C6DB4C59019

Both files have a creation date of today. Since noticing this folder and trying to search the web for solutions I have found my browser to be slow, I'm using IE 7 with Window XP Home Edition SP2.

When I follow the same path but start through MyComputer
C:\Documents and Settings\Gator\Application Data\Microsoft\CryptnetUrlCache\Content
and
C:\Documents and Settings\Gator\Application Data\Microsoft\CryptnetUrlCache\MetaData
I notice that there are alot more files, about 40 in each folder, named in a similar way. I assume that these are the legitimate files that should be there.

I will perform the scan of these files tonight and post the results for you.

Thanks.

[Gator27]

OK I scanned the first file which is located in this path:

C:\Documents and Settings\Gator\Desktop\%SystemDrive%\Documents and Settings\Gator\Application Data\Microsoft\CryptnetUrlCache\Content

Here are the results - the results of the secondfile will be at the end.

File 74BFD122C0875EC75DBE5C6DB4C59019 received on 01.24.2008 03:21:35 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED


Result: 0/32 (0%)
Loading server information...
Your file is queued in position: 4.
Estimated start time is between 47 and 68 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:


Antivirus Version Last Update Result
AhnLab-V3 2008.1.24.10 2008.01.23 -
AntiVir 7.6.0.48 2008.01.23 -
Authentium 4.93.8 2008.01.24 -
Avast 4.7.1098.0 2008.01.23 -
AVG 7.5.0.516 2008.01.23 -
BitDefender 7.2 2008.01.24 -
CAT-QuickHeal 9.00 2008.01.23 -
ClamAV 0.91.2 2008.01.23 -
DrWeb 4.44.0.09170 2008.01.23 -
eSafe 7.0.15.0 2008.01.16 -
eTrust-Vet 31.3.5481 2008.01.23 -
Ewido 4.0 2008.01.23 -
FileAdvisor 1 2008.01.24 -
Fortinet 3.14.0.0 2008.01.23 -
F-Prot 4.4.2.54 2008.01.24 -
F-Secure 6.70.13260.0 2008.01.23 -
Ikarus T3.1.1.20 2008.01.24 -
Kaspersky 7.0.0.125 2008.01.24 -
McAfee 5214 2008.01.23 -
Microsoft 1.3109 2008.01.24 -
NOD32v2 2818 2008.01.23 -
Norman 5.80.02 2008.01.23 -
Panda 9.0.0.4 2008.01.23 -
Prevx1 V2 2008.01.24 -
Rising 20.28.22.00 2008.01.23 -
Sophos 4.24.0 2008.01.24 -
Sunbelt 2.2.907.0 2008.01.23 -
Symantec 10 2008.01.24 -
TheHacker 6.2.9.196 2008.01.23 -
VBA32 3.12.2.5 2008.01.21 -
VirusBuster 4.3.26:9 2008.01.23 -
Webwasher-Gateway 6.6.2 2008.01.23 -

Additional information
File size: 423731 bytes
MD5: bfa35380544d42200a7dd07ad5c8d23d
SHA1: 7b908b5449c6b8df547730f22d4719c6cd8c7f5d
PEiD: -

Second file located at:
C:\Documents and Settings\Gator\Desktop\%SystemDrive%\Documents and Settings\Gator\Application Data\Microsoft\CryptnetUrlCache\Content\MetaData

File 74BFD122C0875EC75DBE5C6DB4C59019 received on 01.24.2008 03:31:37 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED


Result: 0/32 (0%)
Loading server information...
Your file is queued in position: 7.
Estimated start time is between 57 and 81 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:


Antivirus Version Last Update Result
AhnLab-V3 2008.1.24.10 2008.01.23 -
AntiVir 7.6.0.48 2008.01.23 -
Authentium 4.93.8 2008.01.24 -
Avast 4.7.1098.0 2008.01.23 -
AVG 7.5.0.516 2008.01.23 -
BitDefender 7.2 2008.01.24 -
CAT-QuickHeal 9.00 2008.01.23 -
ClamAV 0.91.2 2008.01.23 -
DrWeb 4.44.0.09170 2008.01.23 -
eSafe 7.0.15.0 2008.01.16 -
eTrust-Vet 31.3.5481 2008.01.23 -
Ewido 4.0 2008.01.23 -
FileAdvisor 1 2008.01.24 -
Fortinet 3.14.0.0 2008.01.23 -
F-Prot 4.4.2.54 2008.01.24 -
F-Secure 6.70.13260.0 2008.01.24 -
Ikarus T3.1.1.20 2008.01.24 -
Kaspersky 7.0.0.125 2008.01.24 -
McAfee 5214 2008.01.23 -
Microsoft 1.3109 2008.01.24 -
NOD32v2 2818 2008.01.23 -
Norman 5.80.02 2008.01.23 -
Panda 9.0.0.4 2008.01.23 -
Prevx1 V2 2008.01.24 -
Rising 20.28.22.00 2008.01.23 -
Sophos 4.24.0 2008.01.24 -
Sunbelt 2.2.907.0 2008.01.23 -
Symantec 10 2008.01.24 -
TheHacker 6.2.9.196 2008.01.23 -
VBA32 3.12.2.5 2008.01.21 -
VirusBuster 4.3.26:9 2008.01.23 -
Webwasher-Gateway 6.6.2 2008.01.23 -

Additional information
File size: 124 bytes
MD5: 18c982bae0a36604489d447b1d9cbf56
SHA1: c408769ae94f780d0fe0a6a2afa80325641aefc5
PEiD: -

Where do we go from here ? Actually, my browser seems to be moving at a faster pace today.

[Rorschach112]

I wouldn't worry about those folders, they are legitimate

Your logs are clean ! We need to do a few things

You now need to update your Java and remove your older versions.

Please follow these steps to remove older version Java components.

* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.

Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here



Your using an old version of Adobe Acrobat Reader, this can leave your pc open to vulnerabilities, you can update it here :
http://www.adobe.com.../readstep2.html



Now we need to create a new System Restore point.

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

Next goto Start Menu > Run > type

cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.



Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts.

Make Internet Explorer more secure

• Click Start > Run
• Type Inetcpl.cpl & click OK
• Click on the Security tab
• Click Reset all zones to default level
• Make sure the Internet Zone is selected & Click Custom level
• In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
• Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.

[Gator27]

Hello,

You say that these folders are legitimate, but if that is the case why would the folder %SystemDrive% appear on the desktop - it wasn't there before.

There is another %SystemDrive% folder, but to get to it you have to go through My Computer and the path is slightly different (See First Post).

I don't want to have this folder on the desktop, but if I delete it I will delete the two files inside of it. Can I not move it to the recycle bin and see if it causes any ill effects ??

Thanks

[Rorschach112]

Some program or setting is responsible.

It is definitely a legitimate folder so I would be careful deleting it.

Can I not move it to the recycle bin and see if it causes any ill effects ??

Removing any legitimate folders can cause ill effects.

I would personally leave it or move it to somewhere else, like C:\My Documents


Any more questions ?

[Gator27]

No more questions.

Thanks for all your help and advice - this truly has been an eye opening experience.

I am amazed by how much junk gets installed on my PC by innocent surfing.

I feel alot safer, knowing that my files are clean and now having the knowledge of applications that can keep them clean.

Thank you so much.

[Rorschach112]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.