Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Cannot run DSS and Hijack This

Started by Shawn_Evans , Jul 11 2008 07:47 AM

  • Please log in to reply

#1
Shawn_Evans
Posted 11 July 2008 - 07:47 AM

Shawn_Evans

    New Member

  • Member
  • Pip
  • 8 posts
I am trying to run DSS and it keeps hangin up "Not Responding" while cleaning my temp files. Any suggestions..??

And here is my Kapersky scan. 5 threats 9 infected files.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, July 11, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Friday, July 11, 2008 11:39:59
Records in database: 941656
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - Critical Areas:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
C:\Documents and Settings\shaevans\Start Menu\Programs\Startup
C:\Program Files
C:\WINDOWS

Scan statistics:
Files scanned: 34742
Threat name: 5
Infected objects: 9
Suspicious objects: 0
Duration of the scan: 00:31:36


File name / Threat name / Threats count
C:\Program Files\VAV\vav.exe/C:\Program Files\VAV\vav.exe Infected: not-a-virus:FraudTool.Win32.UltimateAntivirus.q 1
C:\Program Files\SpyShredder\SpyShredder.exe/C:\Program Files\SpyShredder\SpyShredder.exe Infected: not-a-virus:FraudTool.Win32.DrAntispy.cr 1
C:\Program Files\PCHealthCenter\2.exe Infected: Trojan.Win32.Agent.twv 1
C:\Program Files\PCHealthCenter\5.exe Infected: not-a-virus:FraudTool.Win32.UltimateAntivirus.q 1
C:\Program Files\SpyShredder\SpyShredder.exe Infected: not-a-virus:FraudTool.Win32.DrAntispy.cr 1
C:\Program Files\SpyShredder\SpyShredder2.dll Infected: not-a-virus:AdWare.Win32.SearchAssistant.k 1
C:\Program Files\SpyShredder\SpyShredder3.dll Infected: not-a-virus:AdWare.Win32.SearchAssistant.l 1
C:\Program Files\VAV\vav.exe Infected: not-a-virus:FraudTool.Win32.UltimateAntivirus.q 1
C:\WINDOWS\Sys43.exe Infected: Trojan.Win32.Agent.twv 1

The selected area was scanned.
  • 0

Advertisements

#2
kahdah
Posted 11 July 2008 - 08:44 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Hello Shawn_Evans

Welcome to G2Go. :)
=====================
Please go to Start > Run> then copy\paste this in "%userprofile%\desktop\dss.exe" /config then hit ok.
Uncheck Temp File cleanup and System Restore.
Then Hit ok or scan.

Post those logs please.
  • 0

#3
Shawn_Evans
Posted 11 July 2008 - 08:54 AM

Shawn_Evans

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
HijackThis cannot install. Getting error. Firewall Issue?? If so, will DSS log suffice??
  • 0

#4
kahdah
Posted 11 July 2008 - 08:56 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
If you hit Cancel it will run a cloned version of Hijackthis also you should just allow it throught the firewall.
  • 0

#5
Shawn_Evans
Posted 11 July 2008 - 08:59 AM

Shawn_Evans

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Deckard's System Scanner v20071014.68
Run by shaevans on 2008-07-11 10:52:26
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------



-- Last 5 Restore Point(s) --
65: 2008-07-11 12:11:40 UTC - RP65 - Deckard's System Scanner Restore Point
64: 2008-07-10 15:09:12 UTC - RP64 - System Checkpoint
63: 2008-07-09 14:17:15 UTC - RP63 - System Checkpoint
62: 2008-07-08 13:58:30 UTC - RP62 - System Checkpoint
61: 2008-07-07 13:43:39 UTC - RP61 - System Checkpoint


-- First Restore Point --
1: 2008-04-21 13:39:14 UTC - RP1 - System Checkpoint


Backed up registry hives.



-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-07-11 10:55:57
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ActivIdentity\ActivClient\accoca.exe
C:\Program Files\Intel\AMT\atchksrv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\system32\DWRCS.EXE
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\IFXSPMGT.exe
C:\WINDOWS\system32\IFXTCS.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Intel\AMT\Lms.exe
C:\Program Files\Trend Micro\OfficeScan Client\NTRtScan.exe
C:\WINDOWS\system32\IfxPsdSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Intel\AMT\Uns.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Trend Micro\OfficeScan Client\TmListen.exe
C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe
C:\WINDOWS\Temp\RK1013.EXE
C:\Program Files\Hewlett-Packard\IAM\Bin\asghost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Intel\AMT\atchk.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
C:\kix\UTLite33.exe
C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\ActivIdentity\ActivClient\acevents.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe
C:\Program Files\Trend Micro\OfficeScan Client\PccNTMon.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Hewlett-Packard\Embedded Security Software\PSDrt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VAV\vav.exe
C:\Program Files\SpyShredder\SpyShredder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\PrintKey2000\Printkey2000.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\shaevans\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.fcinternal.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://nfuse.czncorp...auth/login.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [atchk] "C:\Program Files\Intel\AMT\atchk.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [PTHOSTTR] c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [IFXSPMGT] c:\WINDOWS\system32\ifxspmgt.exe /NotifyLogon
O4 - HKLM\..\Run: [accrdsub] "c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\Pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O4 - HKCU\..\Run: [SpyShredder] C:\Program Files\SpyShredder\SpyShredder.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: AutoCAD LT Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
O4 - Global Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Printkey2000.lnk = C:\Program Files\PrintKey2000\Printkey2000.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res:///3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=58813
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} (Shockwave ActiveX Control) - http://fpdownload.ma...director/sw.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgree...eensActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1198010915734
O16 - DPF: {82B56B47-90DC-4F58-9A7D-D27BA46D3C0F} (MyPhotoAlbum Easy Upload Tool Combo Control) - http://schleppy1975....geUploader4.cab
O16 - DPF: {B4A78D29-52B1-4A7B-BAC0-1471BEDF9836} () - http://xscanner.shre...tup/webinst.cab
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} (Office Update Installation Engine) - http://office.micros...ntent/opuc4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O16 - DPF: {DC11F230-5717-4C25-BAD7-37B879C19655} (MyPhotoAlbum Easy Upload Tool Combo Control) - http://schleppy1975....geUploader4.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD LT 2002\AcPreview.ocx
O17 - HKLM\Software\..\Telephony: DomainName = corp.pvt
O17 - HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: Domain = corp.pvt
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: Domain = corp.pvt
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O20 - AppInit_DLLs: APSHook.dll
O20 - Winlogon Notify: ackpbsc - C:\WINDOWS\system32\ackpbsc.dll
O20 - Winlogon Notify: acunlock - C:\Program Files\ActivIdentity\ActivClient\acunlock.dll
O20 - Winlogon Notify: DeviceNP - C:\WINDOWS\system32\DeviceNP.dll
O20 - Winlogon Notify: OneCard - C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
O23 - Service: ActivClient Middleware Service (accoca) - ActivIdentity - C:\Program Files\ActivIdentity\ActivClient\accoca.exe
O23 - Service: Intel® Active Management Technology System Status Service (atchksrv) - Intel Corporation - C:\Program Files\Intel\AMT\atchksrv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CCA Agent Stub (CCAAgentStub) - Unknown owner - C:\WINDOWS\system32\CCAAgentStub.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: iSeries Access for Windows Remote Command (Cwbrxd) - IBM Corporation - C:\WINDOWS\cwbrxd.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\system32\DWRCS.EXE
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: HP ProtectTools Device Locking / Auditing (FLCDLOCK) - Hewlett-Packard Ltd - C:\WINDOWS\system32\flcdlock.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\IFXSPMGT.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\IFXTCS.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Intel® Active Management Technology Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\AMT\Lms.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\NTRtScan.exe
O23 - Service: Personal Secure Drive service (PersonalSecureDriveService) - Infineon Technologies AG - C:\WINDOWS\system32\IfxPsdSv.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmListen.exe
O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe
O23 - Service: Intel® Active Management Technology User Notification Service (UNS) - Intel Corporation - C:\Program Files\Intel\AMT\Uns.exe


--
End of file - 14369 bytes

-- File Associations -----------------------------------------------------------

.scr - AutoCADLTScriptFile - shell\open\command - "C:\WINDOWS\system32\notepad.exe" "%1"


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

S3 NCHSSVAD (SoundTap Recorder) - c:\windows\system32\drivers\nchssvad.sys <Not Verified; NCH Swift Sound; NCH Swift Sound Virtual Audio Device>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 DWMRCS (DameWare Mini Remote Control) - c:\windows\system32\dwrcs.exe -service <Not Verified; DameWare Development LLC; DameWare Development DWRCS>
R2 RegSrvc (Intel® PROSet/Wireless Registry Service) - c:\program files\intel\wireless\bin\regsrvc.exe <Not Verified; Intel Corporation; Intel® PROSet/Wireless Registry Service>

S2 CCAAgentStub (CCA Agent Stub) - "c:\windows\system32\ccaagentstub.exe" (file missing)
S3 Cwbrxd (iSeries Access for Windows Remote Command) - c:\windows\cwbrxd.exe <Not Verified; IBM Corporation; IBM® iSeries ™ Access for Windows>
S3 FLCDLOCK (HP ProtectTools Device Locking / Auditing) - c:\windows\system32\flcdlock.exe <Not Verified; Hewlett-Packard Ltd; Device Access Manager>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Cisco Systems VPN Adapter
Device ID: ROOT\NET\0000
Manufacturer: Cisco Systems
Name: Cisco Systems VPN Adapter
PNP Device ID: ROOT\NET\0000
Service: CVirtA


-- Process Modules -------------------------------------------------------------

C:\WINDOWS\system32\winlogon.exe (pid 1408)
2007-02-26 05:49:00 70144 -ra------ C:\WINDOWS\system32\APSHook.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-05-03 19:51:16 112640 --a------ C:\WINDOWS\system32\ackpbsc.dll <Not Verified; ActivIdentity; ActivClient Services>
2007-05-03 19:51:16 118784 --a------ C:\WINDOWS\system32\aclog.dll <Not Verified; ActivIdentity; Library - Logging>
2007-05-03 19:52:08 655360 --a------ C:\WINDOWS\system32\aclibeay.dll <Not Verified; ActivIdentity; The OpenSSL Toolkit>
2007-05-03 19:51:42 100864 --a------ C:\WINDOWS\system32\acevtsub.dll <Not Verified; ActivIdentity; ActivClient Services>
2007-05-03 19:51:28 325120 --a------ C:\WINDOWS\system32\asphat32.dll <Not Verified; ActivIdentity; Smart Card Middleware>
2007-05-03 19:51:16 29696 --a------ C:\WINDOWS\system32\acerrmes.dll <Not Verified; ActivIdentity; Smart Card Middleware>
2007-05-03 19:51:30 87040 --a------ C:\WINDOWS\system32\aspcom.dll <Not Verified; ActivIdentity; Smart Card Middleware>
2007-12-19 12:23:31 64512 --a------ C:\Program Files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll <Not Verified; ActivIdentity; Smart Card Middleware>
2007-12-19 12:23:31 53760 --a------ C:\Program Files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll <Not Verified; ActivIdentity; Smart Card Middleware>
2007-03-14 07:03:00 74752 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-06-15 03:47:00 586240 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ItMsg.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-05-03 19:51:12 281088 --a------ C:\Program Files\ActivIdentity\ActivClient\acunlock.dll <Not Verified; ActivIdentity; ActivClient>
2007-05-03 19:49:30 224768 --a------ C:\WINDOWS\system32\aipingui.dll <Not Verified; ActivIdentity; ActivClient>
2007-12-19 12:23:36 254464 --a------ C:\Program Files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll <Not Verified; ActivIdentity; ActivClient>
2007-05-03 19:51:50 206848 --a------ C:\Program Files\ActivIdentity\ActivClient\Resources\acCobAPIrc.dll <Not Verified; ActivIdentity; Smart Card Middleware>
2007-12-19 12:23:37 56832 --a------ C:\Program Files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll <Not Verified; ActivIdentity; ActivClient>
2007-04-30 09:19:04 49152 --a------ C:\WINDOWS\system32\DeviceNP.dll <Not Verified; Hewlett-Packard Limited; HP ProtectTools Device Management>
2007-10-08 15:11:52 208896 --a------ C:\WINDOWS\system32\NetProvCredMan.dll <Not Verified; Intel Corporation; NetProvCredMan Dynamic Link Library>

C:\WINDOWS\system32\svchost.exe (pid 1684)
2007-02-26 05:49:00 70144 -ra------ C:\WINDOWS\system32\APSHook.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-03-14 07:03:00 74752 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-06-15 03:47:00 586240 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ItMsg.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2006-06-22 07:14:00 131584 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ASChnl.dll <Not Verified; Cognizance Corporation; Cognizance Identity Manager>
2007-06-08 11:33:42 485888 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ItDAC.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-03-02 05:20:00 157184 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ItReports.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-07-20 20:00:20 512512 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\AuthWiz.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-03-29 05:31:00 263680 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ItAuth.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-01-09 04:18:00 168960 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\HPBrand.dll <Not Verified; Hewlett-Packard Company; Cognizance Identity Manager>
2007-07-20 19:38:54 224256 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\TpmAuth.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-03-22 10:23:00 142848 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ItVCServer.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-03-07 04:40:00 290816 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ItVCard.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-02-20 01:45:00 172032 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\NetAdmin.dll <Not Verified; Cognizance Corporation; Cognizance Identity Manager>
2007-05-28 04:19:00 94208 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\BioAuthSrv.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>

C:\WINDOWS\system32\svchost.exe (pid 1712)
2007-02-26 05:49:00 70144 -ra------ C:\WINDOWS\system32\APSHook.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>

C:\WINDOWS\system32\svchost.exe (pid 2008)
2007-02-26 05:49:00 70144 -ra------ C:\WINDOWS\system32\APSHook.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>

C:\WINDOWS\system32\svchost.exe (pid 192)
2007-02-26 05:49:00 70144 -ra------ C:\WINDOWS\system32\APSHook.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>

C:\WINDOWS\system32\svchost.exe (pid 548)
2007-02-26 05:49:00 70144 -ra------ C:\WINDOWS\system32\APSHook.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>

C:\WINDOWS\explorer.exe (pid 3020)
2007-02-26 05:49:00 70144 -ra------ C:\WINDOWS\system32\APSHook.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-10-08 15:11:52 208896 --a------ C:\WINDOWS\system32\NetProvCredMan.dll <Not Verified; Intel Corporation; NetProvCredMan Dynamic Link Library>
2007-02-06 15:40:54 65536 --a------ C:\WINDOWS\system32\BTNCopy.dll <Not Verified; Broadcom Corporation.; Bluetooth Software>
2007-02-06 16:19:44 77824 --a------ C:\WINDOWS\system32\BtMmHook.dll <Not Verified; Broadcom Corporation.; Bluetooth Software>
2007-02-06 16:16:06 53248 --a------ C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll
2007-01-23 21:13:08 200704 --a------ C:\WINDOWS\system32\PSDShExt.dll <Not Verified; Infineon Technologies AG; Infineon TPM Software>
2007-01-23 20:22:18 2453504 --a------ C:\WINDOWS\system32\IFXSPArc.dll <Not Verified; Infineon Technologies AG; Infineon TPM Software>
2007-01-23 21:16:14 229376 --a------ C:\Program Files\Hewlett-Packard\Embedded Security Software\PsdRsUS.dll <Not Verified; Infineon Technologies AG; Infineon TPM Software>


-- Scheduled Tasks -------------------------------------------------------------

2008-06-13 07:32:31 414 --a------ C:\WINDOWS\Tasks\Norton Security Scan.job


-- Files created between 2008-06-11 and 2008-07-11 -----------------------------

2008-07-11 08:11:06 0 d-------- V:\Deckard
2008-07-10 15:23:53 0 d-------- C:\Program Files\SpyShredder
2008-07-10 15:23:16 28672 --a------ C:\WINDOWS\xpupdate.exe
2008-07-10 14:28:48 23040 --a------ C:\WINDOWS\Sys45.exe
2008-07-10 14:28:48 23040 --a------ C:\WINDOWS\Sys44.exe
2008-07-10 14:28:48 23552 --a------ C:\WINDOWS\Sys43.exe
2008-07-10 14:28:48 0 d-------- C:\Program Files\VAV
2008-07-10 14:28:47 24064 --a------ C:\WINDOWS\Sys42.exe
2008-07-10 14:28:46 0 d-------- C:\Program Files\PCHealthCenter
2008-07-08 08:23:38 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\InstallShield
2008-07-08 08:23:38 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Infineon
2008-07-08 08:23:38 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Identities
2008-07-08 08:23:38 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\hpqLog
2008-07-08 08:23:38 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\CiscoCAA
2008-07-08 08:23:38 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\AdobeUM
2008-07-08 08:23:38 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Adobe
2008-07-08 08:23:37 0 dr-h----- C:\Documents and Settings\SMSCliSvcAcct&\Recent
2008-07-08 08:23:37 0 d--h----- C:\Documents and Settings\SMSCliSvcAcct&\PrintHood
2008-07-08 08:23:37 0 d--h----- C:\Documents and Settings\SMSCliSvcAcct&\NetHood
2008-07-08 08:23:37 0 dr------- C:\Documents and Settings\SMSCliSvcAcct&\My Documents
2008-07-08 08:23:37 0 d--h----- C:\Documents and Settings\SMSCliSvcAcct&\Local Settings
2008-07-08 08:23:37 0 dr------- C:\Documents and Settings\SMSCliSvcAcct&\Favorites
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Desktop
2008-07-08 08:23:37 0 d---s---- C:\Documents and Settings\SMSCliSvcAcct&\Cookies
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Bluetooth Software
2008-07-08 08:23:37 0 dr-h----- C:\Documents and Settings\SMSCliSvcAcct&\Application Data
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Sun
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\OfficeUpdate12
2008-07-08 08:23:37 0 d---s---- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Microsoft
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Microsoft Web Folders
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Macromedia
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\InterVideo
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Intel
2008-07-08 08:23:36 0 d---s---- C:\Documents and Settings\SMSCliSvcAcct&\UserData
2008-07-08 08:23:36 0 d--h----- C:\Documents and Settings\SMSCliSvcAcct&\Templates
2008-07-08 08:23:36 0 dr------- C:\Documents and Settings\SMSCliSvcAcct&\Start Menu
2008-07-08 08:23:36 0 dr-h----- C:\Documents and Settings\SMSCliSvcAcct&\SendTo
2008-07-08 08:23:36 1572864 --ah----- C:\Documents and Settings\SMSCliSvcAcct&\NTUSER.DAT
2008-07-07 16:01:26 0 d-------- C:\WINDOWS\system32\NtmsData
2008-07-07 14:41:33 0 d-------- C:\Documents and Settings\shaevans\.housecall6.6
2008-07-07 07:27:18 0 dr-h----- C:\Documents and Settings\shaevans\Recent
2008-06-19 10:15:36 94208 --a------ C:\WINDOWS\system32\pskill.exe <Not Verified; Sysinternals - www.sysinternals.com; Systems Internals pkill>
2008-06-19 10:15:36 94720 --a------ C:\WINDOWS\system32\MsiZap.exe <Not Verified; Microsoft Corporation; Windows Installer - Unicode>
2008-06-19 10:15:36 43 --a------ C:\WINDOWS\system32\2.bat
2008-06-13 07:32:27 0 d-------- C:\Program Files\Norton Security Scan
2008-06-13 07:31:29 0 d-------- C:\WINDOWS\system32\Adobe
2008-06-12 15:47:42 0 d-------- C:\Documents and Settings\shaevans\Application Data\Snapfish


-- Find3M Report ---------------------------------------------------------------

2008-07-10 21:46:52 0 d-------- C:\Program Files\Trillian
2008-07-09 13:54:33 0 d-------- C:\Documents and Settings\shaevans\Application Data\U3
2008-07-02 07:55:51 0 d-------- C:\Program Files\Java
2008-06-20 13:12:49 0 d-------- C:\Program Files\ADTRAN DSL Assistant
2008-06-13 10:47:56 0 d-------- C:\Documents and Settings\shaevans\Application Data\Amazon
2008-06-09 17:03:27 45964 -----n--- V:\warwickpricing
2008-06-09 16:04:32 0 d-------- C:\Program Files\Common Files
2008-06-01 19:49:35 0 d-------- C:\Program Files\NCH Swift Sound
2008-06-01 19:48:45 0 d-------- C:\Program Files\NCH Software
2008-06-01 19:48:14 0 d-------- C:\Documents and Settings\shaevans\Application Data\NCH Swift Sound
2008-05-13 15:02:06 0 d-------- C:\Documents and Settings\shaevans\Application Data\Autodesk
2008-05-13 14:41:10 0 d-------- C:\Program Files\Common Files\L&H
2008-05-13 14:40:39 0 d-------- C:\Program Files\Microsoft.NET
2008-05-13 14:35:05 0 d-------- C:\Program Files\Common Files\Autodesk Shared
2008-05-13 14:35:04 0 d-------- C:\Program Files\AutoCAD LT 2002
2008-05-13 14:25:57 0 d-------- C:\Program Files\AutoCAD LT 2006
2008-05-13 14:25:41 0 d-------- C:\Program Files\AnswerWorks 4.0
2008-05-13 14:20:26 0 d-------- C:\Program Files\Autodesk
2008-05-12 09:17:54 0 d--h----- C:\Program Files\Zero G Registry
2008-05-12 09:16:54 0 d-------- C:\Program Files\Actelis Networks
2008-05-09 14:18:38 23408 --a------ C:\Documents and Settings\shaevans\Application Data\Comma Separated Values (Windows).ADR
2008-05-06 16:16:48 9405 --a------ C:\Documents and Settings\shaevans\Application Data\Comma Separated Values (Windows).EML


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [09/15/2007 03:29 AM]
"atchk"="C:\Program Files\Intel\AMT\atchk.exe" [05/01/2007 05:52 PM]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [03/01/2007 02:18 PM]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [10/08/2007 03:18 PM]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [10/08/2007 03:13 PM]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [07/13/2006 09:12 AM]
"PTHOSTTR"="c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.exe" [01/09/2007 04:52 PM]
"CognizanceTS"="c:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [12/22/2003 07:12 PM]
"IFXSPMGT"="c:\WINDOWS\system32\ifxspmgt.exe" [02/15/2007 02:00 PM]
"@"="" []
"accrdsub"="c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe" [05/03/2007 07:51 PM]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [01/05/2007 06:36 PM]
"Cpqset"="C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe" [01/02/2007 04:46 PM]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [05/18/2007 10:50 PM]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [05/18/2007 10:50 PM]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [05/18/2007 10:50 PM]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [11/06/2007 05:34 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"Client Access Service"="C:\Program Files\IBM\Client Access\cwbsvstr.exe" [05/07/2002 06:20 AM]
"Client Access Help Update"="C:\Program Files\IBM\Client Access\cwbinhlp.exe" [05/07/2002 06:20 AM]
"Client Access Check Version"="C:\Program Files\IBM\Client Access\cwbckver.exe" [05/07/2002 06:20 AM]
"Client Access Express Welcome"="C:\Program Files\IBM\Client Access\cwbwlwiz.exe" [05/07/2002 06:20 AM]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [12/17/2002 01:28 PM]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\OfficeScan Client\Pccntmon.exe" [12/11/2007 07:31 PM]
"Antivirus"="C:\Program Files\VAV\vav.exe" [07/10/2008 01:33 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [03/30/2006 05:45 PM]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [04/30/2008 08:16 AM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 01:56 AM]
"Antivirus"="C:\Program Files\VAV\vav.exe" [07/10/2008 01:33 AM]
"Windows update loader"="C:\Windows\xpupdate.exe" [07/10/2008 03:23 PM]
"SpyShredder"="C:\Program Files\SpyShredder\SpyShredder.exe" [07/10/2008 03:23 PM]

C:\Documents and Settings\shaevans\Start Menu\Programs\Startup\
Trillian.lnk - C:\Program Files\Trillian\trillian.exe [5/19/2008]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
AutoCAD LT Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [3/5/2005 9:18:22 AM]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2/6/2007 4:14:00 PM]
Clean Access Agent.lnk - C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe [9/7/2007 12:13:06 AM]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [4/30/2008 8:16:50 AM]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1/21/2000 4:15:54 AM]
Printkey2000.lnk - C:\Program Files\PrintKey2000\Printkey2000.exe [4/22/2008 10:52:10 AM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"Wallpaper"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceStartMenuLogOff"=1 (0x1)
"NoWelcomeScreen"=1 (0x1)
"ForceActiveDesktopOn"=1 (0x1)
"NoActiveDesktop"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc]
c:\WINDOWS\system32\ackpbsc.dll 05/03/2007 07:51 PM 112640 c:\WINDOWS\system32\ackpbsc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock]
c:\Program Files\ActivIdentity\ActivClient\acunlock.dll 05/03/2007 07:51 PM 281088 c:\Program Files\ActivIdentity\ActivClient\acunlock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
DeviceNP.dll 04/30/2007 09:19 AM 49152 C:\WINDOWS\system32\DeviceNP.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll 03/14/2007 07:03 AM 74752 c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=APSHook.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"= scecli ASWLNPkg

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 Pml Driver HPZ12 Net Driver HPZ12
Cognizance ASBroker ASChannel


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57bd5546-adaa-11dc-bbbe-b02c9a8bec2e}]
AutoRun\command- E:\setup.exe




-- End of Deckard's System Scanner: finished at 2008-07-11 10:58:29 ------------


Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel® Core™2 Duo CPU T7700 @ 2.40GHz
CPU 1: Intel® Core™2 Duo CPU T7700 @ 2.40GHz
Percentage of Memory in Use: 42%
Physical Memory (total/avail): 2039.23 MiB / 1172.77 MiB
Pagefile Memory (total/avail): 3931.61 MiB / 3200.78 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1886.88 MiB

C: is Fixed (NTFS) - 74.53 GiB total, 52.28 GiB free.
D: is CDROM (No Media)
K: is Network (NTFS)
M: is Network (NTFS)
N: is Network (NTFS)
S: is Network (NTFS)
T: is Network (NTFS)
U: is Network (NTFS)
V: is Network (NTFS)

\\.\PHYSICALDRIVE0 - Hitachi HTS722080K9SA00 - 74.53 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 74.53 GiB - C:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

FirstRunDisabled is set.

AV: Trend Micro OfficeScan Antivirus v8.0 (TrendAntiVirus)
AV: Trend Micro OfficeScan Antivirus v8.0 (TrendAntiVirus)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft Office\\Office\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office\\OUTLOOK.EXE:*:Enabled:OUTLOOK.EXE"
"C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Enabled:conf.exe"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\SMSADMIN\\bin\\i386\\statview.exe"="C:\\SMSADMIN\\bin\\i386\\statview.exe:*:Enabled:SMS 2.0 Utility - Status Message Viewer"
"C:\\SMSADMIN\\bin\\i386\\SETUP.EXE"="C:\\SMSADMIN\\bin\\i386\\SETUP.EXE:*:Enabled:SMS Setup"
"C:\\WINDOWS\\system32\\wbem\\unsecapp.exe"="C:\\WINDOWS\\system32\\wbem\\unsecapp.exe:*:Enabled:unsecapp.exe"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\WINDOWS\\system32\\mmc.exe"="C:\\WINDOWS\\system32\\mmc.exe:*:Enabled:Microsoft Management Console"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\WINDOWS\\system32\\VoissAssistant.exe"="C:\\WINDOWS\\system32\\VoissAssistant.exe:*:Enabled:VoissAssistant"
"C:\\Program Files\\Microsoft Office\\OFFICE11\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\OFFICE11\\OUTLOOK.EXE:*:Enabled:OUTLOOK.EXE"
"C:\\Program Files\\NET6\\net6vpn.exe"="C:\\Program Files\\NET6\\net6vpn.exe:*:Enabled:Citrix Secure Access Agent"
"C:\\Program Files\\Java\\j2re1.4.2_03\\bin\\javaw.exe"="C:\\Program Files\\Java\\j2re1.4.2_03\\bin\\javaw.exe:*:Enabled:javaw"
"C:\\Program Files\\Viryanet\\MicroServer\\VCM.exe"="C:\\Program Files\\Viryanet\\MicroServer\\VCM.exe:*:Enabled:VCM"
"C:\\WINDOWS\\explorer.exe"="C:\\WINDOWS\\explorer.exe:*:Disabled:Windows Explorer"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\SmartFTP\\SmartFTP.exe"="C:\\Program Files\\SmartFTP\\SmartFTP.exe:*:Enabled:SmartFTP"
"C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Enabled:conf.exe"
"C:\\Program Files\\Microsoft Office\\Office\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office\\OUTLOOK.EXE:*:Enabled:OUTLOOK.EXE"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Documents and Settings\\mwj974\\Local Settings\\Temporary Internet Files\\Content.IE5\\0L6VGXAV\\CitrixSAClient[1].exe"="C:\\Documents and Settings\\mwj974\\Local Settings\\Temporary Internet Files\\Content.IE5\\0L6VGXAV\\CitrixSAClient[1].exe:*:Enabled:Citrix Secure Access Agent"
"C:\\Program Files\\NET6\\net6vpn.exe"="C:\\Program Files\\NET6\\net6vpn.exe:*:Enabled:Citrix Secure Access Agent"
"C:\\WINDOWS\\system32\\wbem\\unsecapp.exe"="C:\\WINDOWS\\system32\\wbem\\unsecapp.exe:*:Enabled:WMI"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\shaevans\Application Data
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=NYMTJSLXP041364
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=V:
HOMEPATH=\
HOMESHARE=\\nymt00s2kfp01\ShaEvans$
LOGONSERVER=\\PAWB00S03DC01
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;c:\Program Files\Hewlett-Packard\IAM\bin;c:\Program Files\ActivIdentity\ActivClient\;C:\PROGRA~1\IBM\CLIENT~1;C:\PROGRA~1\IBM\CLIENT~1\Shared;C:\PROGRA~1\IBM\CLIENT~1\Emulator;C:\Program Files\Common Files\Adaptec Shared\System;C:\Program Files\Common Files\Autodesk Shared\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 11, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f0b
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SMS_LOCAL_DIR=C:\WINDOWS
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\shaevans\LOCALS~1\Temp
TMP=C:\DOCUME~1\shaevans\LOCALS~1\Temp
USERDNSDOMAIN=CORP.PVT
USERDOMAIN=CORP
USERNAME=shaevans
USERPROFILE=C:\Documents and Settings\shaevans
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

frontier (admin)
SMSCliSvcAcct& (admin)
Administrator (admin)
shaevans (admin)
gsc943 (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> C:\Program Files\InstallShield Installation Information\{69333A04-5134-40A5-A055-9166A7AA1EC8}\setup.exe -runfromtemp -l0x0009 -removeonly
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\AFPViewr\DeIsL1.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL10.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL11.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL12.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL13.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL14.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL2.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL3.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL4.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL5.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL6.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL7.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL8.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL9.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\Emulator\DeIsL1.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\Emulator\DeIsL2.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\Emulator\DeIsL4.isu"
--> MsiExec.exe /I{977FBE6C-AE9A-4429-B249-814F0B3A4CB1}
--> MsiExec.exe /X{87079BC7-1A1E-4520-B5C3-9AF582FA26FD}
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
ActivClient 6.1 x86 --> MsiExec.exe /I{AC194855-F7AC-4D04-B4C9-07BA46FCB697}
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 7.0.9 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70900000002}
Adobe Shockwave Player 11 --> C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
ADTRAN DSL Assistant --> "C:\Program Files\ADTRAN DSL Assistant\UninstallerData\Uninstall DSLAsstistant3.exe"
Amazon MP3 Downloader 1.0.3 --> C:\Program Files\Amazon\MP3 Downloader\Uninstall.exe
AnswerWorks Runtime --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\WexTech\AnswerWorks\Uninst.isu"
AuthenTec Fingerprint Sensor Minimum Install --> MsiExec.exe /I{EB4DF30B-102B-4F0C-927A-D50E037A325D}
AutoCAD LT 2006 - English --> MsiExec.exe /I{5783F2D7-4009-0409-0002-0060B0CE6BBA}
Autodesk Design Review 2009 - SP1 --> C:\Program Files\Autodesk\Autodesk Design Review\Setup\Setup.exe /P {450063AA-643B-417C-8CF5-405BA3F4EF40} /M ADR
Autodesk DWF Viewer --> C:\PROGRA~1\Autodesk\AUTODE~2\Setup.exe /remove
BIOS Configuration for HP ProtectTools --> MsiExec.exe /X{C74D0FA0-1D49-464F-A707-B427EE3385C1}
Broadcom 802.11 Wireless LAN Adapter --> "C:\Program Files\Broadcom\Broadcom 802.11\Driver\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Broadcom\Broadcom 802.11\Driver"
Cisco Clean Access Agent --> MsiExec.exe /X{41C18715-AFF0-49E9-B940-287A50532D33}
Cisco Systems VPN Client 5.0.01.0600 --> MsiExec.exe /X{14FCFE7C-AB86-428A-9D2E-BFB6F5A7AA6E}
Credential Manager for HP ProtectTools --> MsiExec.exe /X{C15F7F16-941E-414B-A676-40190CD621D5}
Device Access Manager for HP ProtectTools --> MsiExec.exe /X{55B52830-024A-443E-AF61-61E1E71AFA1B}
Easy CD Creator 5 Basic --> MsiExec.exe /I{609F7AC8-C510-11D4-A788-009027ABA5D0}
Embedded Security for HP ProtectTools --> MsiExec.exe /I{20A1D306-CE83-492A-8525-D6DF50B5944A}
FLEXR 7.81 --> C:\WINDOWS\IsUninst.exe -fC:\FLEXR781\Uninst.isu
Google Earth --> MsiExec.exe /I{97C0EA4A-1A0B-4C53-ACEB-49984DA79C90}
Google Toolbar for Internet Explorer --> MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
Google Updater --> "C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
HP 3D DriveGuard --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{429E92A4-159F-4AEC-85A1-D693E1E4274D}\Setup.exe" -l0x9 UNINSTALL
HP Integrated Module with Bluetooth wireless technology --> MsiExec.exe /X{84814E6B-2581-46EC-926A-823BD1C670F6}
HP ProtectTools Security Manager --> MsiExec.exe /I{2DB165DC-DDB4-403F-B985-19F3EC7D0357}
HP Quick Launch Buttons 6.40 B2 --> C:\Program Files\InstallShield Installation Information\{34D2AB40-150D-475D-AE32-BD23FB5EE355}\Setup.exe -runfromtemp -l0x0009 -removeonly uninst
HP Wireless Assistant --> MsiExec.exe /I{D32067CD-7409-4792-BFA0-1469BCD8F0C8}
IBM iSeries Access for Windows --> "C:\Program Files\IBM\Client Access\cwbinarp.exe"
Intel® Active Management Technology Device Software --> C:\WINDOWS\system32\mesoludlg.exe -uninstall
Intel® Graphics Media Accelerator Driver --> C:\WINDOWS\system32\igxpun.exe -uninstall
Intel® PRO Network Connections Drivers --> Prounstl.exe
Intel® PROSet/Wireless Software --> C:\WINDOWS\Installer\iProInst.exe
InterVideo WinDVD --> "C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL
J2SE Runtime Environment 5.0 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150000}
Java 2 Runtime Environment, SE v1.4.2_03 --> MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142030}
Java Card Security for HP ProtectTools --> MsiExec.exe /I{77130095-2039-424F-A633-4FAF0261258A}
Java™ 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Macromedia Authorware Web Player --> C:\WINDOWS\system32\Macromed\AUTHORWA\UNWISE.EXE C:\WINDOWS\system32\Macromed\AUTHORWA\Install.log
Macromedia Flash Player 8 --> C:\WINDOWS\system32\Macromed\Flash\UninstFl.exe
mCore --> MsiExec.exe /I{E81667C6-2856-46D6-ABEA-6A2F42166779}
mDrWiFi --> MsiExec.exe /I{F6090A17-0967-4A8A-B3C3-422A1B514D49}
MetaASSIST View --> "C:\Program Files\Actelis Networks\MetaASSIST View\Uninstall_MetaASSIST View\Uninstall MetaASSIST View.exe"
MetaFrame Presentation Server Client --> MsiExec.exe /I{E92B7A19-5FD5-4AEE-9FEF-7AD5DD3A675E}
mHelp --> MsiExec.exe /I{8C6BB412-D3A8-4AAE-A01B-35B681789D68}
Microsoft Access 2000 SR-1 --> MsiExec.exe /I{00100409-78E1-11D2-B60F-006097C998E7}
Microsoft Base Smart Card Cryptographic Service Provider Package --> "C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe"
Microsoft Compression Client Pack 1.0 for Windows XP --
  • 0

#6
kahdah
Posted 11 July 2008 - 09:18 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    C:\Windows\xpupdate.exe
C:\Program Files\VAV
C:\Program Files\SpyShredder
C:\Program Files\PCHealthCenter
C:\WINDOWS\Sys43.exe 
C:\WINDOWS\Sys45.exe
C:\WINDOWS\Sys44.exe
C:\WINDOWS\Sys42.exe
C:\WINDOWS\system32\2.bat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Antivirus
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Antivirus
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Windows update loader
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\SpyShredder
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\\NoWelcomeScreen
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\\ForceStartMenuLogOff
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\\NoWelcomeScreen
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\\ForceActiveDesktopOn
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\\NoActiveDesktop
emptytemp
  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light Yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • OTMoveit2 will create a log of moved files in the C:\_OTMoveIt\MovedFiles folder. The log's name will appear as the date and time it was created, with the format mmddyyyy_hhmmss.log. Open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
==================================
Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatley.
====================
Post these logs:
Ot Move it log
MalwareBytes log
New dss log
  • 0

#7
Shawn_Evans
Posted 11 July 2008 - 09:42 AM

Shawn_Evans

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
You would not happen to have a FIREWALL friendly host site would you. I cannot get the Oldtimer software and my wireless connection is.
  • 0

#8
kahdah
Posted 11 July 2008 - 09:56 AM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
I will attach it see the file below.

[attachment=21984:OT_Move_it.zip]
  • 0

#9
Shawn_Evans
Posted 11 July 2008 - 11:36 AM

Shawn_Evans

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Pop ups are gone.. 4 logs to follow:

OTMoveit2LOG
C:\Windows\xpupdate.exe moved successfully.
C:\Program Files\VAV moved successfully.
Folder move failed. C:\Program Files\SpyShredder scheduled to be moved on reboot.
C:\Program Files\PCHealthCenter moved successfully.
C:\WINDOWS\Sys43.exe moved successfully.
C:\WINDOWS\Sys45.exe moved successfully.
C:\WINDOWS\Sys44.exe moved successfully.
C:\WINDOWS\Sys42.exe moved successfully.
C:\WINDOWS\system32\2.bat moved successfully.
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Antivirus >
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Antivirus deleted successfully.
< HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Antivirus >
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Antivirus deleted successfully.
< HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Windows update loader >
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\Windows update loader deleted successfully.
< HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\SpyShredder >
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\SpyShredder deleted successfully.
< HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\\NoWelcomeScreen >
Registry value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\\NoWelcomeScreen deleted successfully.
< HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\\ForceStartMenuLogOff >
Registry value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\\ForceStartMenuLogOff deleted successfully.
< HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\\NoWelcomeScreen >
Registry value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\\NoWelcomeScreen deleted successfully.
< HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\\ForceActiveDesktopOn >
Registry value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\\ForceActiveDesktopOn deleted successfully.
< HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\\NoActiveDesktop >
Registry value HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\\NoActiveDesktop deleted successfully.
< emptytemp >
File delete failed. C:\DOCUME~1\shaevans\LOCALS~1\Temp\ExchangePerflog_8484fa3114bff3cedcd6c672.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\shaevans\LOCALS~1\Temp\Perflib_Perfdata_10c.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\shaevans\LOCALS~1\Temp\Perflib_Perfdata_9f4.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\shaevans\LOCALS~1\Temp\~DFEDEE.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\shaevans\LOCALS~1\Temp\Temporary Directory 1 for OT_Move_it.zip\OTMoveIt2.exe scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\atchk.log scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\atchksrv.log scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\VO24F6.EXE scheduled to be deleted on reboot.
Temp folders emptied.
IE temp folders emptied.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07112008_131011

Files moved on Reboot...
C:\Program Files\SpyShredder moved successfully.
C:\DOCUME~1\shaevans\LOCALS~1\Temp\ExchangePerflog_8484fa3114bff3cedcd6c672.dat moved successfully.
File C:\DOCUME~1\shaevans\LOCALS~1\Temp\Perflib_Perfdata_10c.dat not found!
File C:\DOCUME~1\shaevans\LOCALS~1\Temp\Perflib_Perfdata_9f4.dat not found!
C:\DOCUME~1\shaevans\LOCALS~1\Temp\~DFEDEE.tmp moved successfully.
C:\DOCUME~1\shaevans\LOCALS~1\Temp\Temporary Directory 1 for OT_Move_it.zip\OTMoveIt2.exe moved successfully.
C:\WINDOWS\temp\atchk.log moved successfully.
File move failed. C:\WINDOWS\temp\atchksrv.log scheduled to be moved on reboot.
File C:\WINDOWS\temp\VO24F6.EXE not found!

MBAM_Log
Malwarebytes' Anti-Malware 1.20
Database version: 940
Windows 5.1.2600 Service Pack 2

1:21:53 PM 7/11/2008
mbam-log-7-11-2008 (13-21-53).txt

Scan type: Quick Scan
Objects scanned: 50269
Time elapsed: 5 minute(s), 6 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 2
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 6

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{b4a78d29-52b1-4a7b-bac0-1471bedf9836} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ModuleUsage\c:/windows/downloaded program files/setup.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{b4a78d29-52b1-4a7b-bac0-1471bedf9836} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\spyshredder (Rogue.SpyShredder) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\Downloaded Program Files\setup.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ADP (Rogue.Multiple) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\Documents and Settings\shaevans\Start Menu\Programs\SpyShredder (Rogue.SpyShredder) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\Downloaded Program Files\setup.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\shaevans\Start Menu\Programs\SpyShredder\SpyShredder.lnk (Rogue.SpyShredder) -> Quarantined and deleted successfully.
C:\Documents and Settings\shaevans\Start Menu\Programs\SpyShredder\Uninstall.lnk (Rogue.SpyShredder) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sex1.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sex2.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vav.cpl (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.

DSS_Logs
Deckard's System Scanner v20071014.68
Run by shaevans on 2008-07-11 13:32:20
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------



-- Last 5 Restore Point(s) --
65: 2008-07-11 12:11:40 UTC - RP65 - Deckard's System Scanner Restore Point
64: 2008-07-10 15:09:12 UTC - RP64 - System Checkpoint
63: 2008-07-09 14:17:15 UTC - RP63 - System Checkpoint
62: 2008-07-08 13:58:30 UTC - RP62 - System Checkpoint
61: 2008-07-07 13:43:39 UTC - RP61 - System Checkpoint


-- First Restore Point --
1: 2008-04-21 13:39:14 UTC - RP1 - System Checkpoint




-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-07-11 13:32:30
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ActivIdentity\ActivClient\accoca.exe
C:\Program Files\Intel\AMT\atchksrv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\system32\DWRCS.EXE
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\IFXSPMGT.exe
C:\WINDOWS\system32\IFXTCS.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Intel\AMT\Lms.exe
C:\Program Files\Trend Micro\OfficeScan Client\NTRtScan.exe
C:\WINDOWS\system32\IfxPsdSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Intel\AMT\Uns.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Trend Micro\OfficeScan Client\TmListen.exe
C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe
C:\WINDOWS\Temp\FY7A8E.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Hewlett-Packard\IAM\Bin\asghost.exe
C:\Program Files\Intel\AMT\atchk.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\kix\UTLite33.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Trend Micro\OfficeScan Client\PccNTMon.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\ActivIdentity\ActivClient\acevents.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Embedded Security Software\PSDrt.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\PrintKey2000\Printkey2000.exe
C:\Program Files\Trillian\trillian.exe
C:\Documents and Settings\shaevans\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.fcinternal.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://nfuse.czncorp...auth/login.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [atchk] "C:\Program Files\Intel\AMT\atchk.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [PTHOSTTR] c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule
O4 - HKLM\..\Run: [IFXSPMGT] c:\WINDOWS\system32\ifxspmgt.exe /NotifyLogon
O4 - HKLM\..\Run: [accrdsub] "c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Client Access Service] "C:\Program Files\IBM\Client Access\cwbsvstr.exe"
O4 - HKLM\..\Run: [Client Access Help Update] "C:\Program Files\IBM\Client Access\cwbinhlp.exe"
O4 - HKLM\..\Run: [Client Access Check Version] "C:\Program Files\IBM\Client Access\cwbckver.exe" LOGIN
O4 - HKLM\..\Run: [Client Access Express Welcome] "C:\Program Files\IBM\Client Access\cwbwlwiz.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\Pccntmon.exe" -HideWindow
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: AutoCAD LT Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe
O4 - Global Startup: Bluetooth.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
O4 - Global Startup: Clean Access Agent.lnk = C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Printkey2000.lnk = C:\Program Files\PrintKey2000\Printkey2000.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res:///3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=58813
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} (Shockwave ActiveX Control) - http://fpdownload.ma...director/sw.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgree...eensActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1198010915734
O16 - DPF: {82B56B47-90DC-4F58-9A7D-D27BA46D3C0F} (MyPhotoAlbum Easy Upload Tool Combo Control) - http://schleppy1975....geUploader4.cab
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} (Office Update Installation Engine) - http://office.micros...ntent/opuc4.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O16 - DPF: {DC11F230-5717-4C25-BAD7-37B879C19655} (MyPhotoAlbum Easy Upload Tool Combo Control) - http://schleppy1975....geUploader4.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD LT 2002\AcPreview.ocx
O17 - HKLM\Software\..\Telephony: DomainName = corp.pvt
O17 - HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: Domain = corp.pvt
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: Domain = corp.pvt
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O20 - AppInit_DLLs: APSHook.dll
O20 - Winlogon Notify: ackpbsc - C:\WINDOWS\system32\ackpbsc.dll
O20 - Winlogon Notify: acunlock - C:\Program Files\ActivIdentity\ActivClient\acunlock.dll
O20 - Winlogon Notify: DeviceNP - C:\WINDOWS\system32\DeviceNP.dll
O20 - Winlogon Notify: OneCard - C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll
O23 - Service: ActivClient Middleware Service (accoca) - ActivIdentity - C:\Program Files\ActivIdentity\ActivClient\accoca.exe
O23 - Service: Intel® Active Management Technology System Status Service (atchksrv) - Intel Corporation - C:\Program Files\Intel\AMT\atchksrv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: CCA Agent Stub (CCAAgentStub) - Unknown owner - C:\WINDOWS\system32\CCAAgentStub.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: iSeries Access for Windows Remote Command (Cwbrxd) - IBM Corporation - C:\WINDOWS\cwbrxd.exe
O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\system32\DWRCS.EXE
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: HP ProtectTools Device Locking / Auditing (FLCDLOCK) - Hewlett-Packard Ltd - C:\WINDOWS\system32\flcdlock.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\IFXSPMGT.exe
O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\IFXTCS.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Intel® Active Management Technology Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\AMT\Lms.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\NTRtScan.exe
O23 - Service: Personal Secure Drive service (PersonalSecureDriveService) - Infineon Technologies AG - C:\WINDOWS\system32\IfxPsdSv.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmListen.exe
O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe
O23 - Service: Intel® Active Management Technology User Notification Service (UNS) - Intel Corporation - C:\Program Files\Intel\AMT\Uns.exe


--
End of file - 13953 bytes

-- File Associations -----------------------------------------------------------

.reg - regfile - shell\open\command - regedit.exe "%1" %*
.scr - AutoCADLTScriptFile - shell\open\command - "C:\WINDOWS\system32\notepad.exe" "%1"


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

S3 NCHSSVAD (SoundTap Recorder) - c:\windows\system32\drivers\nchssvad.sys <Not Verified; NCH Swift Sound; NCH Swift Sound Virtual Audio Device>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 DWMRCS (DameWare Mini Remote Control) - c:\windows\system32\dwrcs.exe -service <Not Verified; DameWare Development LLC; DameWare Development DWRCS>
R2 RegSrvc (Intel® PROSet/Wireless Registry Service) - c:\program files\intel\wireless\bin\regsrvc.exe <Not Verified; Intel Corporation; Intel® PROSet/Wireless Registry Service>

S2 CCAAgentStub (CCA Agent Stub) - "c:\windows\system32\ccaagentstub.exe" (file missing)
S3 Cwbrxd (iSeries Access for Windows Remote Command) - c:\windows\cwbrxd.exe <Not Verified; IBM Corporation; IBM® iSeries ™ Access for Windows>
S3 FLCDLOCK (HP ProtectTools Device Locking / Auditing) - c:\windows\system32\flcdlock.exe <Not Verified; Hewlett-Packard Ltd; Device Access Manager>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Cisco Systems VPN Adapter
Device ID: ROOT\NET\0000
Manufacturer: Cisco Systems
Name: Cisco Systems VPN Adapter
PNP Device ID: ROOT\NET\0000
Service: CVirtA


-- Process Modules -------------------------------------------------------------

C:\WINDOWS\system32\winlogon.exe (pid 1404)
2007-02-26 05:49:00 70144 -ra------ C:\WINDOWS\system32\APSHook.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-05-03 19:51:16 112640 --a------ C:\WINDOWS\system32\ackpbsc.dll <Not Verified; ActivIdentity; ActivClient Services>
2007-05-03 19:51:16 118784 --a------ C:\WINDOWS\system32\aclog.dll <Not Verified; ActivIdentity; Library - Logging>
2007-05-03 19:52:08 655360 --a------ C:\WINDOWS\system32\aclibeay.dll <Not Verified; ActivIdentity; The OpenSSL Toolkit>
2007-05-03 19:51:42 100864 --a------ C:\WINDOWS\system32\acevtsub.dll <Not Verified; ActivIdentity; ActivClient Services>
2007-05-03 19:51:28 325120 --a------ C:\WINDOWS\system32\asphat32.dll <Not Verified; ActivIdentity; Smart Card Middleware>
2007-05-03 19:51:16 29696 --a------ C:\WINDOWS\system32\acerrmes.dll <Not Verified; ActivIdentity; Smart Card Middleware>
2007-05-03 19:51:30 87040 --a------ C:\WINDOWS\system32\aspcom.dll <Not Verified; ActivIdentity; Smart Card Middleware>
2007-12-19 12:23:31 64512 --a------ C:\Program Files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll <Not Verified; ActivIdentity; Smart Card Middleware>
2007-12-19 12:23:31 53760 --a------ C:\Program Files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll <Not Verified; ActivIdentity; Smart Card Middleware>
2007-03-14 07:03:00 74752 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-06-15 03:47:00 586240 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ItMsg.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-05-03 19:51:12 281088 --a------ C:\Program Files\ActivIdentity\ActivClient\acunlock.dll <Not Verified; ActivIdentity; ActivClient>
2007-05-03 19:49:30 224768 --a------ C:\WINDOWS\system32\aipingui.dll <Not Verified; ActivIdentity; ActivClient>
2007-12-19 12:23:36 254464 --a------ C:\Program Files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll <Not Verified; ActivIdentity; ActivClient>
2007-05-03 19:51:50 206848 --a------ C:\Program Files\ActivIdentity\ActivClient\Resources\acCobAPIrc.dll <Not Verified; ActivIdentity; Smart Card Middleware>
2007-12-19 12:23:37 56832 --a------ C:\Program Files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll <Not Verified; ActivIdentity; ActivClient>
2007-04-30 09:19:04 49152 --a------ C:\WINDOWS\system32\DeviceNP.dll <Not Verified; Hewlett-Packard Limited; HP ProtectTools Device Management>
2007-10-08 15:11:52 208896 --a------ C:\WINDOWS\system32\NetProvCredMan.dll <Not Verified; Intel Corporation; NetProvCredMan Dynamic Link Library>

C:\WINDOWS\system32\svchost.exe (pid 1680)
2007-02-26 05:49:00 70144 -ra------ C:\WINDOWS\system32\APSHook.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-03-14 07:03:00 74752 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-06-15 03:47:00 586240 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ItMsg.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2006-06-22 07:14:00 131584 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ASChnl.dll <Not Verified; Cognizance Corporation; Cognizance Identity Manager>
2007-06-08 11:33:42 485888 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ItDAC.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-03-02 05:20:00 157184 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ItReports.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-05-28 04:19:00 94208 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\BioAuthSrv.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-03-22 10:23:00 142848 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ItVCServer.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-03-07 04:40:00 290816 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ItVCard.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-03-29 05:31:00 263680 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\ItAuth.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-01-09 04:18:00 168960 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\HPBrand.dll <Not Verified; Hewlett-Packard Company; Cognizance Identity Manager>
2007-07-20 20:00:20 512512 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\AuthWiz.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-07-20 19:38:54 224256 -ra------ C:\Program Files\Hewlett-Packard\IAM\Bin\TpmAuth.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>

C:\WINDOWS\system32\svchost.exe (pid 1708)
2007-02-26 05:49:00 70144 -ra------ C:\WINDOWS\system32\APSHook.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>

C:\WINDOWS\system32\svchost.exe (pid 2004)
2007-02-26 05:49:00 70144 -ra------ C:\WINDOWS\system32\APSHook.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>

C:\WINDOWS\system32\svchost.exe (pid 192)
2007-02-26 05:49:00 70144 -ra------ C:\WINDOWS\system32\APSHook.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>

C:\WINDOWS\system32\svchost.exe (pid 1868)
2007-02-26 05:49:00 70144 -ra------ C:\WINDOWS\system32\APSHook.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>

C:\WINDOWS\explorer.exe (pid 3520)
2007-02-26 05:49:00 70144 -ra------ C:\WINDOWS\system32\APSHook.dll <Not Verified; Bioscrypt Inc.; Bioscrypt VeriSoft Single Sign On>
2007-10-08 15:11:52 208896 --a------ C:\WINDOWS\system32\NetProvCredMan.dll <Not Verified; Intel Corporation; NetProvCredMan Dynamic Link Library>
2007-02-06 15:40:54 65536 --a------ C:\WINDOWS\system32\BTNCopy.dll <Not Verified; Broadcom Corporation.; Bluetooth Software>
2002-05-07 06:20:00 36864 --a------ C:\Program Files\IBM\Client Access\Shared\cwbunddh.dll <Not Verified; IBM Corporation; IBM® iSeries ™ Access for Windows>
2007-02-06 16:19:44 77824 --a------ C:\WINDOWS\system32\BtMmHook.dll <Not Verified; Broadcom Corporation.; Bluetooth Software>
2007-02-06 16:16:06 53248 --a------ C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll


-- Scheduled Tasks -------------------------------------------------------------

2008-06-13 07:32:31 414 --a------ C:\WINDOWS\Tasks\Norton Security Scan.job


-- Files created between 2008-06-11 and 2008-07-11 -----------------------------

2008-07-11 13:16:01 0 d-------- C:\Documents and Settings\shaevans\Application Data\Malwarebytes
2008-07-11 13:15:59 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-11 13:15:58 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-07-11 08:11:06 0 d-------- V:\Deckard
2008-07-08 08:23:38 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\InstallShield
2008-07-08 08:23:38 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Infineon
2008-07-08 08:23:38 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Identities
2008-07-08 08:23:38 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\hpqLog
2008-07-08 08:23:38 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\CiscoCAA
2008-07-08 08:23:38 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\AdobeUM
2008-07-08 08:23:38 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Adobe
2008-07-08 08:23:37 0 dr-h----- C:\Documents and Settings\SMSCliSvcAcct&\Recent
2008-07-08 08:23:37 0 d--h----- C:\Documents and Settings\SMSCliSvcAcct&\PrintHood
2008-07-08 08:23:37 0 d--h----- C:\Documents and Settings\SMSCliSvcAcct&\NetHood
2008-07-08 08:23:37 0 dr------- C:\Documents and Settings\SMSCliSvcAcct&\My Documents
2008-07-08 08:23:37 0 d--h----- C:\Documents and Settings\SMSCliSvcAcct&\Local Settings
2008-07-08 08:23:37 0 dr------- C:\Documents and Settings\SMSCliSvcAcct&\Favorites
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Desktop
2008-07-08 08:23:37 0 d---s---- C:\Documents and Settings\SMSCliSvcAcct&\Cookies
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Bluetooth Software
2008-07-08 08:23:37 0 dr-h----- C:\Documents and Settings\SMSCliSvcAcct&\Application Data
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Sun
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\OfficeUpdate12
2008-07-08 08:23:37 0 d---s---- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Microsoft
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Microsoft Web Folders
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Macromedia
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\InterVideo
2008-07-08 08:23:37 0 d-------- C:\Documents and Settings\SMSCliSvcAcct&\Application Data\Intel
2008-07-08 08:23:36 0 d---s---- C:\Documents and Settings\SMSCliSvcAcct&\UserData
2008-07-08 08:23:36 0 d--h----- C:\Documents and Settings\SMSCliSvcAcct&\Templates
2008-07-08 08:23:36 0 dr------- C:\Documents and Settings\SMSCliSvcAcct&\Start Menu
2008-07-08 08:23:36 0 dr-h----- C:\Documents and Settings\SMSCliSvcAcct&\SendTo
2008-07-08 08:23:36 1572864 --ah----- C:\Documents and Settings\SMSCliSvcAcct&\NTUSER.DAT
2008-07-07 16:01:26 0 d-------- C:\WINDOWS\system32\NtmsData
2008-07-07 14:41:33 0 d-------- C:\Documents and Settings\shaevans\.housecall6.6
2008-07-07 07:27:18 0 dr-h----- C:\Documents and Settings\shaevans\Recent
2008-06-19 10:15:36 94208 --a------ C:\WINDOWS\system32\pskill.exe <Not Verified; Sysinternals - www.sysinternals.com; Systems Internals pkill>
2008-06-19 10:15:36 94720 --a------ C:\WINDOWS\system32\MsiZap.exe <Not Verified; Microsoft Corporation; Windows Installer - Unicode>
2008-06-13 07:32:27 0 d-------- C:\Program Files\Norton Security Scan
2008-06-13 07:31:29 0 d-------- C:\WINDOWS\system32\Adobe
2008-06-12 15:47:42 0 d-------- C:\Documents and Settings\shaevans\Application Data\Snapfish


-- Find3M Report ---------------------------------------------------------------

2008-07-11 11:51:28 0 d-------- C:\Program Files\Trillian
2008-07-09 13:54:33 0 d-------- C:\Documents and Settings\shaevans\Application Data\U3
2008-07-02 07:55:51 0 d-------- C:\Program Files\Java
2008-06-20 13:12:49 0 d-------- C:\Program Files\ADTRAN DSL Assistant
2008-06-13 10:47:56 0 d-------- C:\Documents and Settings\shaevans\Application Data\Amazon
2008-06-09 17:03:27 45964 -----n--- V:\warwickpricing
2008-06-09 16:04:32 0 d-------- C:\Program Files\Common Files
2008-06-01 19:49:35 0 d-------- C:\Program Files\NCH Swift Sound
2008-06-01 19:48:45 0 d-------- C:\Program Files\NCH Software
2008-06-01 19:48:14 0 d-------- C:\Documents and Settings\shaevans\Application Data\NCH Swift Sound
2008-05-13 15:02:06 0 d-------- C:\Documents and Settings\shaevans\Application Data\Autodesk
2008-05-13 14:41:10 0 d-------- C:\Program Files\Common Files\L&H
2008-05-13 14:40:39 0 d-------- C:\Program Files\Microsoft.NET
2008-05-13 14:35:05 0 d-------- C:\Program Files\Common Files\Autodesk Shared
2008-05-13 14:35:04 0 d-------- C:\Program Files\AutoCAD LT 2002
2008-05-13 14:25:57 0 d-------- C:\Program Files\AutoCAD LT 2006
2008-05-13 14:25:41 0 d-------- C:\Program Files\AnswerWorks 4.0
2008-05-13 14:20:26 0 d-------- C:\Program Files\Autodesk
2008-05-12 09:17:54 0 d--h----- C:\Program Files\Zero G Registry
2008-05-12 09:16:54 0 d-------- C:\Program Files\Actelis Networks
2008-05-09 14:18:38 23408 --a------ C:\Documents and Settings\shaevans\Application Data\Comma Separated Values (Windows).ADR
2008-05-06 16:16:48 9405 --a------ C:\Documents and Settings\shaevans\Application Data\Comma Separated Values (Windows).EML


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPStart"="C:\Program Files\Synaptics\SynTP\SynTPStart.exe" [09/15/2007 03:29 AM]
"atchk"="C:\Program Files\Intel\AMT\atchk.exe" [05/01/2007 05:52 PM]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [03/01/2007 02:18 PM]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [10/08/2007 03:18 PM]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [10/08/2007 03:13 PM]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [07/13/2006 09:12 AM]
"PTHOSTTR"="c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.exe" [01/09/2007 04:52 PM]
"CognizanceTS"="c:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [12/22/2003 07:12 PM]
"IFXSPMGT"="c:\WINDOWS\system32\ifxspmgt.exe" [02/15/2007 02:00 PM]
"@"="" []
"accrdsub"="c:\Program Files\ActivIdentity\ActivClient\accrdsub.exe" [05/03/2007 07:51 PM]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [01/05/2007 06:36 PM]
"Cpqset"="C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe" [01/02/2007 04:46 PM]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [05/18/2007 10:50 PM]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [05/18/2007 10:50 PM]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [05/18/2007 10:50 PM]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [11/06/2007 05:34 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"Client Access Service"="C:\Program Files\IBM\Client Access\cwbsvstr.exe" [05/07/2002 06:20 AM]
"Client Access Help Update"="C:\Program Files\IBM\Client Access\cwbinhlp.exe" [05/07/2002 06:20 AM]
"Client Access Check Version"="C:\Program Files\IBM\Client Access\cwbckver.exe" [05/07/2002 06:20 AM]
"Client Access Express Welcome"="C:\Program Files\IBM\Client Access\cwbwlwiz.exe" [05/07/2002 06:20 AM]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [12/17/2002 01:28 PM]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\OfficeScan Client\Pccntmon.exe" [12/11/2007 07:31 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [03/30/2006 05:45 PM]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [04/30/2008 08:16 AM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 01:56 AM]

C:\Documents and Settings\shaevans\Start Menu\Programs\Startup\
Trillian.lnk - C:\Program Files\Trillian\trillian.exe [5/19/2008]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
AutoCAD LT Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [3/5/2005 9:18:22 AM]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2/6/2007 4:14:00 PM]
Clean Access Agent.lnk - C:\Program Files\Cisco Systems\Clean Access Agent\CCAAgent.exe [9/7/2007 12:13:06 AM]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [4/30/2008 8:16:50 AM]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1/21/2000 4:15:54 AM]
Printkey2000.lnk - C:\Program Files\PrintKey2000\Printkey2000.exe [4/22/2008 10:52:10 AM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"Wallpaper"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc]
c:\WINDOWS\system32\ackpbsc.dll 05/03/2007 07:51 PM 112640 c:\WINDOWS\system32\ackpbsc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock]
c:\Program Files\ActivIdentity\ActivClient\acunlock.dll 05/03/2007 07:51 PM 281088 c:\Program Files\ActivIdentity\ActivClient\acunlock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
DeviceNP.dll 04/30/2007 09:19 AM 49152 C:\WINDOWS\system32\DeviceNP.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]
c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll 03/14/2007 07:03 AM 74752 c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=APSHook.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"= scecli ASWLNPkg

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 Pml Driver HPZ12 Net Driver HPZ12
Cognizance ASBroker ASChannel


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{57bd5546-adaa-11dc-bbbe-b02c9a8bec2e}]
AutoRun\command- E:\setup.exe




-- End of Deckard's System Scanner: finished at 2008-07-11 13:34:39 ------------

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel® Core™2 Duo CPU T7700 @ 2.40GHz
CPU 1: Intel® Core™2 Duo CPU T7700 @ 2.40GHz
Percentage of Memory in Use: 33%
Physical Memory (total/avail): 2039.23 MiB / 1359.4 MiB
Pagefile Memory (total/avail): 3931.61 MiB / 3398.37 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1904.7 MiB

C: is Fixed (NTFS) - 74.53 GiB total, 52.29 GiB free.
D: is CDROM (No Media)
K: is Network (NTFS)
M: is Network (NTFS)
N: is Network (NTFS)
S: is Network (NTFS)
T: is Network (NTFS)
U: is Network (NTFS)
V: is Network (NTFS)

\\.\PHYSICALDRIVE0 - Hitachi HTS722080K9SA00 - 74.53 GiB - 1 partition
\PARTITION0 (bootable) - Installable File System - 74.53 GiB - C:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

FirstRunDisabled is set.

AV: Trend Micro OfficeScan Antivirus v8.0 (TrendAntiVirus)
AV: Trend Micro OfficeScan Antivirus v8.0 (TrendAntiVirus)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft Office\\Office\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office\\OUTLOOK.EXE:*:Enabled:OUTLOOK.EXE"
"C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Enabled:conf.exe"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\SMSADMIN\\bin\\i386\\statview.exe"="C:\\SMSADMIN\\bin\\i386\\statview.exe:*:Enabled:SMS 2.0 Utility - Status Message Viewer"
"C:\\SMSADMIN\\bin\\i386\\SETUP.EXE"="C:\\SMSADMIN\\bin\\i386\\SETUP.EXE:*:Enabled:SMS Setup"
"C:\\WINDOWS\\system32\\wbem\\unsecapp.exe"="C:\\WINDOWS\\system32\\wbem\\unsecapp.exe:*:Enabled:unsecapp.exe"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"C:\\WINDOWS\\system32\\mmc.exe"="C:\\WINDOWS\\system32\\mmc.exe:*:Enabled:Microsoft Management Console"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\WINDOWS\\system32\\VoissAssistant.exe"="C:\\WINDOWS\\system32\\VoissAssistant.exe:*:Enabled:VoissAssistant"
"C:\\Program Files\\Microsoft Office\\OFFICE11\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\OFFICE11\\OUTLOOK.EXE:*:Enabled:OUTLOOK.EXE"
"C:\\Program Files\\NET6\\net6vpn.exe"="C:\\Program Files\\NET6\\net6vpn.exe:*:Enabled:Citrix Secure Access Agent"
"C:\\Program Files\\Java\\j2re1.4.2_03\\bin\\javaw.exe"="C:\\Program Files\\Java\\j2re1.4.2_03\\bin\\javaw.exe:*:Enabled:javaw"
"C:\\Program Files\\Viryanet\\MicroServer\\VCM.exe"="C:\\Program Files\\Viryanet\\MicroServer\\VCM.exe:*:Enabled:VCM"
"C:\\WINDOWS\\explorer.exe"="C:\\WINDOWS\\explorer.exe:*:Disabled:Windows Explorer"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\SmartFTP\\SmartFTP.exe"="C:\\Program Files\\SmartFTP\\SmartFTP.exe:*:Enabled:SmartFTP"
"C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Enabled:conf.exe"
"C:\\Program Files\\Microsoft Office\\Office\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office\\OUTLOOK.EXE:*:Enabled:OUTLOOK.EXE"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Documents and Settings\\mwj974\\Local Settings\\Temporary Internet Files\\Content.IE5\\0L6VGXAV\\CitrixSAClient[1].exe"="C:\\Documents and Settings\\mwj974\\Local Settings\\Temporary Internet Files\\Content.IE5\\0L6VGXAV\\CitrixSAClient[1].exe:*:Enabled:Citrix Secure Access Agent"
"C:\\Program Files\\NET6\\net6vpn.exe"="C:\\Program Files\\NET6\\net6vpn.exe:*:Enabled:Citrix Secure Access Agent"
"C:\\WINDOWS\\system32\\wbem\\unsecapp.exe"="C:\\WINDOWS\\system32\\wbem\\unsecapp.exe:*:Enabled:WMI"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\shaevans\Application Data
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=NYMTJSLXP041364
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=V:
HOMEPATH=\
HOMESHARE=\\nymt00s2kfp01\ShaEvans$
LOGONSERVER=\\PADL00S03DC01
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;c:\Program Files\Hewlett-Packard\IAM\bin;c:\Program Files\ActivIdentity\ActivClient\;C:\PROGRA~1\IBM\CLIENT~1;C:\PROGRA~1\IBM\CLIENT~1\Shared;C:\PROGRA~1\IBM\CLIENT~1\Emulator;C:\Program Files\Common Files\Adaptec Shared\System;C:\Program Files\Common Files\Autodesk Shared\
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 11, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f0b
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\shaevans\LOCALS~1\Temp
TMP=C:\DOCUME~1\shaevans\LOCALS~1\Temp
USERDNSDOMAIN=CORP.PVT
USERDOMAIN=CORP
USERNAME=shaevans
USERPROFILE=C:\Documents and Settings\shaevans
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

frontier (admin)
SMSCliSvcAcct& (admin)
Administrator (admin)
shaevans (admin)
gsc943 (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> C:\Program Files\InstallShield Installation Information\{69333A04-5134-40A5-A055-9166A7AA1EC8}\setup.exe -runfromtemp -l0x0009 -removeonly
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\AFPViewr\DeIsL1.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL10.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL11.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL12.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL13.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL14.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL2.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL3.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL4.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL5.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL6.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL7.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL8.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\DeIsL9.isu"
--> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\IBM\Client Access\Emulator\DeIsL1.isu"
  • 0

#10
Shawn_Evans
Posted 11 July 2008 - 11:58 AM

Shawn_Evans

    New Member

  • Topic Starter
  • Member
  • Pip
  • 8 posts
Is my system clean? Running much better and pop ups and dialog boxes are gone...! I cannot thank "Kahdah" and other members of this site for the work they do and the service they provide. Amazing that some companies charge upwards of $100 for software that does not work and open source comes through yet again.. Bravo and kudos...
  • 0

#11
kahdah
Posted 11 July 2008 - 06:14 PM

kahdah

    GeekU Teacher

  • Retired Staff
  • 15,822 posts
Please go to Start > Run> then copy\paste this in "%userprofile%\desktop\dss.exe" /daft then hit ok.
Place a check next to everything and click on Fix.
Then click the scan button again and you will see an all associations ok.
===============================================
Cleanup::
  • Make sure you have an Internet Connection.
  • Double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")
  • Click on the CleanUp! button
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OtMoveit2 to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.
===============
Upgrading Java:
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 7.
  • Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
  • Click the "Download" button to the right.
  • Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
  • Click on Continue.
  • Click on the link to download Windows Offline Installation (jre-6u6-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on the download to install the newest version.

=============================
Delete\uninstall anything else that we have used.

System Restore
Then I will need you to reset your System Restore points.
The link below shows how to create a clean restore point.
How to Turn On and Turn Off System Restore in Windows XP
http://support.micro...kb/310405/en-us
=====================================
After that your log is clean. :)

The following is a list of tools and utilities that I like to suggest to people.
You do not have to have all or any of them they are only suggestions.
This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.

Spybot Search & Destroy-Uber powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.

Spyware Blaster - Great prevention tool to keep nasties from installing on your system.

Spywareguard-Works as a Spyware "Shield" to protect your computer from getting malware in the first place.

IE-SPYAD- puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.

Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.

Tony Klein article To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP