Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

www.007guard.com ? slow internet :( [RESOLVED]

Started by g3nX , Nov 13 2008 03:13 PM

  • This topic is locked This topic is locked

#16
emeraldnzl
Posted 19 November 2008 - 09:58 PM

emeraldnzl

    GeekU Instructor

  • GeekU Moderator
  • 20,051 posts
Kaspersky works with Internet Explorer and Firefox 3. It uses Java Runtime Environment (JRE) Java 1.6.0_7

Please download JavaRa to your desktop and unzip it to its own folder
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.
  • Open JavaRa.exe again and select Search For Updates.
  • Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.
Now go to Kaspersky website and perform an online antivirus scan.

  • Read through the requirements and privacy statement and click on Accept button.
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan.
  • Once the scan is complete, it will display the results. Click on View Scan Report.
  • You will see a list of infected items there. Click on Save Report As....
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Copy and paste that information in your next post.

Next

  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, a log will open. Please post the contents of log.txt back here.
So when you come back please post
  • Kaspersky scan results
  • RSIT log
  • and tell me how your computer is performing now
  • 0

Advertisements

#17
g3nX
Posted 20 November 2008 - 01:21 PM

g3nX

    Member

  • Topic Starter
  • Member
  • PipPip
  • 17 posts
Logfile of random's system information tool 1.04 (written by random/random)
Run by ¤0wner at 2008-11-20 14:10:03
Microsoft Windows XP Professional Service Pack 3
System drive C: has 3 GB (1%) free of 236 GB
Total RAM: 1023 MB (54% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:10:12, on 11/20/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20733)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvraidservice.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\TDK Systems\Bluetooth Software\BTTray.exe
C:\Program Files\TDK Systems\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\mIRC\mirc.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\TVersity\Media Server\MediaServer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\¤0wner\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\¤0wner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft....k/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [NVRaidService] C:\WINDOWS\system32\nvraidservice.exe
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SRS Audio Sandbox] "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\TDK Systems\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.ms...ine/install.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative....15035/CTPID.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\TDK Systems\Bluetooth Software\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program Files\TVersity\Media Server\MediaServer.exe

--
End of file - 7035 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
FGCatchUrl - C:\Program Files\FlashGet\jccatch.dll [2007-08-06 94308]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll [2008-09-15 1562960]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-11-19 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-11-19 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-11-19 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}]
FlashGet GetFlash Class - C:\Program Files\FlashGet\getflash.dll [2007-05-18 163840]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NVRaidService"=C:\WINDOWS\system32\nvraidservice.exe [2004-06-10 83968]
"AudioDrvEmulator"=C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe [2005-11-04 49152]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-02-13 13500416]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-02-13 86016]
"BluetoothAuthenticationAgent"=C:\WINDOWS\system32\bthprops.cpl [2008-04-14 110592]
"egui"=C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2008-02-20 1443072]
"VolPanel"=C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe [2006-07-13 122880]
"CTHelper"=C:\WINDOWS\system32\CTHELPER.EXE [2008-02-20 19456]
"CTxfiHlp"=C:\WINDOWS\system32\CTXFIHLP.EXE [2008-02-20 19968]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-11-19 136600]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"SRS Audio Sandbox"=C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe [2008-06-09 3215360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-02-28 1828136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]
C:\Program Files\Spyware Doctor\pctsTray.exe [2008-09-16 1168264]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2008-03-30 267048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-02-18 2221352]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2008-02-28 570664]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2008-03-28 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sclauncher]
C:\Program Files\SimpleCenter\bin\win\sclauncher.exe [2007-10-11 94208]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SRS Audio Sandbox]
C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe [2008-06-09 3215360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
C:\WINDOWS\UpdReg.EXE [2000-05-11 90112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinVNC]
C:\Program Files\TightVNC\WinVNC.exe [2007-05-07 589824]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Nokia Nseries PC Suite.lnk]
C:\PROGRA~1\Nokia\NNPCS\RUNLAU~1.EXE [2008-01-14 679936]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3
"Apple Mobile Device"=2
"Nero BackItUp Scheduler 3"=2
"sdCoreService"=3
"sdAuxService"=3
"Bonjour Service"=2
"WinVNC4"=2
"ServiceLayer"=3
"winvnc"=2
"ThreatFire"=3

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
BTTray.lnk - C:\Program Files\TDK Systems\Bluetooth Software\BTTray.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-02-25 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoDriveAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Steam\steamapps\g3n3rationx\counter-strike source\hl2.exe"="C:\Program Files\Steam\steamapps\g3n3rationx\counter-strike source\hl2.exe:*:Enabled:hl2"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Cerberus\Cerberus.exe"="C:\Program Files\Cerberus\Cerberus.exe:*:Enabled:Cerberus FTP Server"
"C:\Program Files\ApexDC++\ApexDC.exe"="C:\Program Files\ApexDC++\ApexDC.exe:*:Enabled:ApexDC++ - Pinnacle of File Sharing"
"C:\Program Files\FrostWire\FrostWire.exe"="C:\Program Files\FrostWire\FrostWire.exe:*:Enabled:LimeWire"
"C:\Program Files\mIRC\mirc.exe"="C:\Program Files\mIRC\mirc.exe:*:Enabled:mIRC"
"C:\Program Files\AIM6\aim6.exe"="C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM"
"C:\Program Files\RealVNC\VNC4\winvnc4.exe"="C:\Program Files\RealVNC\VNC4\winvnc4.exe:*:Enabled:VNC Server"
"C:\Program Files\SoulseekNS\slsk.exe"="C:\Program Files\SoulseekNS\slsk.exe:*:Enabled:SoulSeek"
"C:\Program Files\TVersity\Media Server\MediaServer.exe"="C:\Program Files\TVersity\Media Server\MediaServer.exe:*:Enabled:TVersity Media Server"
"C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe"="C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater"
"C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe"="C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process "
"C:\Program Files\RealVNC\VNC4\vncviewer.exe"="C:\Program Files\RealVNC\VNC4\vncviewer.exe:*:Enabled:VNC Viewer Enterprise Edition for Win32"
"C:\Program Files\FlashGet\flashget.exe"="C:\Program Files\FlashGet\flashget.exe:*:Enabled:Flashget"
"C:\Program Files\TightVNC\WinVNC.exe"="C:\Program Files\TightVNC\WinVNC.exe:*:Enabled:TightVNC Win32 Server"
"C:\Program Files\TightVNC\vncviewer.exe"="C:\Program Files\TightVNC\vncviewer.exe:*:Enabled:vncviewer"
"C:\Program Files\RayV\RayV\RayV.exe"="C:\Program Files\RayV\RayV\RayV.exe:*:Enabled:RayV"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.js - open - "C:\Program Files\Adobe\Adobe Dreamweaver CS3\Dreamweaver.exe","%1"

======List of files/folders created in the last 1 months======

2008-11-19 23:56:30 ----A---- C:\WINDOWS\system32\javaws.exe
2008-11-19 23:56:30 ----A---- C:\WINDOWS\system32\javaw.exe
2008-11-19 23:56:30 ----A---- C:\WINDOWS\system32\java.exe
2008-11-19 23:56:30 ----A---- C:\WINDOWS\system32\deploytk.dll
2008-11-19 23:56:16 ----D---- C:\Program Files\Java
2008-11-19 15:39:15 ----D---- C:\_OTMoveIt
2008-11-19 11:48:55 ----D---- C:\Documents and Settings\¤0wner\Application Data\RayV
2008-11-19 11:48:43 ----D---- C:\Program Files\RayV
2008-11-19 00:11:44 ----D---- C:\rsit
2008-11-18 19:56:28 ----A---- C:\WINDOWS\system32\tmp.txt
2008-11-18 19:56:13 ----A---- C:\rapport.txt
2008-11-18 19:55:20 ----A---- C:\WINDOWS\system32\WS2Fix.exe
2008-11-18 19:55:20 ----A---- C:\WINDOWS\system32\VCCLSID.exe
2008-11-18 19:55:20 ----A---- C:\WINDOWS\system32\VACFix.exe
2008-11-18 19:55:20 ----A---- C:\WINDOWS\system32\swxcacls.exe
2008-11-18 19:55:20 ----A---- C:\WINDOWS\system32\swsc.exe
2008-11-18 19:55:20 ----A---- C:\WINDOWS\system32\swreg.exe
2008-11-18 19:55:20 ----A---- C:\WINDOWS\system32\SrchSTS.exe
2008-11-18 19:55:20 ----A---- C:\WINDOWS\system32\Process.exe
2008-11-18 19:55:20 ----A---- C:\WINDOWS\system32\o4Patch.exe
2008-11-18 19:55:20 ----A---- C:\WINDOWS\system32\IEDFix.exe
2008-11-18 19:55:20 ----A---- C:\WINDOWS\system32\IEDFix.C.exe
2008-11-18 19:55:20 ----A---- C:\WINDOWS\system32\dumphive.exe
2008-11-18 19:55:20 ----A---- C:\WINDOWS\system32\404Fix.exe
2008-11-17 02:52:39 ----D---- C:\Documents and Settings\All Users\Application Data\acccore
2008-11-17 02:51:53 ----D---- C:\Documents and Settings\All Users\Application Data\AOL Downloads
2008-11-16 23:32:33 ----SHD---- C:\RECYCLER
2008-11-16 21:55:14 ----D---- C:\WINDOWS\temp
2008-11-16 21:55:14 ----A---- C:\ComboFix.txt
2008-11-16 21:52:13 ----D---- C:\ComboFix
2008-11-14 01:20:09 ----A---- C:\Boot.bak
2008-11-14 01:20:04 ----RASHD---- C:\cmdcons
2008-11-14 01:19:04 ----A---- C:\WINDOWS\SWXCACLS.exe
2008-11-13 17:31:52 ----D---- C:\Program Files\Mozilla Firefox
2008-11-12 22:48:44 ----A---- C:\WINDOWS\system32\vfwwdm32.dll
2008-11-12 22:46:14 ----D---- C:\Program Files\TDK Systems
2008-11-11 05:50:09 ----D---- C:\WINDOWS\Minidump
2008-11-06 02:07:44 ----D---- C:\Config.Msi
2008-11-06 02:02:09 ----A---- C:\WINDOWS\ntbtlog.txt
2008-11-03 20:36:38 ----A---- C:\WINDOWS\CSTBox.INI
2008-10-26 12:36:29 ----D---- C:\Program Files\TightVNC
2008-10-23 19:23:25 ----D---- C:\Program Files\FlashGet

======List of files/folders modified in the last 1 months======

2008-11-20 14:02:44 ----D---- C:\Documents and Settings\¤0wner\Application Data\Skype
2008-11-20 00:50:28 ----D---- C:\WINDOWS\Prefetch
2008-11-19 23:56:34 ----SHD---- C:\WINDOWS\Installer
2008-11-19 23:56:30 ----D---- C:\WINDOWS\system32
2008-11-19 23:56:16 ----RD---- C:\Program Files
2008-11-19 21:49:52 ----D---- C:\Documents and Settings\¤0wner\Application Data\uTorrent
2008-11-19 21:47:06 ----D---- C:\Downloads
2008-11-19 21:46:42 ----A---- C:\WINDOWS\NeroDigital.ini
2008-11-19 20:37:13 ----D---- C:\Program Files\mIRC
2008-11-19 20:15:03 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-11-19 15:47:24 ----D---- C:\WINDOWS\system32\CatRoot2
2008-11-19 00:10:22 ----D---- C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-11-17 20:04:23 ----D---- C:\Documents and Settings\¤0wner\Application Data\OpenOffice.org2
2008-11-17 18:00:30 ----D---- C:\Documents and Settings\¤0wner\Application Data\Adobe
2008-11-17 02:52:46 ----D---- C:\Program Files\AIM6
2008-11-17 02:52:31 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-11-16 21:55:14 ----D---- C:\WINDOWS
2008-11-16 21:54:48 ----A---- C:\WINDOWS\system.ini
2008-11-16 21:53:16 ----D---- C:\WINDOWS\system32\drivers
2008-11-16 21:53:16 ----D---- C:\WINDOWS\AppPatch
2008-11-16 21:53:16 ----D---- C:\Program Files\Common Files
2008-11-16 21:52:17 ----D---- C:\QooBox
2008-11-16 21:05:01 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-11-14 19:17:49 ----D---- C:\Documents and Settings\¤0wner\Application Data\Canon
2008-11-14 01:20:09 ----RASH---- C:\boot.ini
2008-11-13 17:32:32 ----D---- C:\Documents and Settings\¤0wner\Application Data\Mozilla
2008-11-12 23:24:00 ----D---- C:\WINDOWS\security
2008-11-12 22:52:55 ----HD---- C:\WINDOWS\inf
2008-11-12 22:49:09 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-11-12 22:48:39 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-12 22:46:38 ----SD---- C:\WINDOWS\system32\Microsoft
2008-11-11 05:50:02 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-11-06 02:11:23 ----A---- C:\WINDOWS\win.ini
2008-11-06 02:08:29 ----D---- C:\WINDOWS\system32\config
2008-11-06 02:08:03 ----D---- C:\WINDOWS\system32\wbem
2008-11-06 02:08:03 ----D---- C:\WINDOWS\Registration
2008-11-06 02:07:43 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-06 02:05:21 ----A---- C:\WINDOWS\DUMP5052.tmp
2008-11-06 01:54:48 ----A---- C:\WINDOWS\DUMP5042.tmp
2008-11-06 01:33:08 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2008-11-05 22:45:18 ----D---- C:\Program Files\Spyware Doctor
2008-11-04 10:13:10 ----D---- C:\Program Files\Opera
2008-10-29 19:37:53 ----D---- C:\Program Files\Steam

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;AMD Athlon64 Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2003-11-06 35328]
R1 easdrv;easdrv; C:\WINDOWS\system32\DRIVERS\easdrv.sys [2008-02-20 29704]
R1 epfwtdir;epfwtdir; C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 33800]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
R1 pctfw2;pctfw2; \??\C:\WINDOWS\system32\drivers\pctfw2.sys []
R1 WS2IFSL;Windows Socket 2.0 Non-IFS Service Provider Support Environment; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-04 12032]
R2 BTSERIAL;Bluetooth Serial Driver; \??\C:\WINDOWS\system32\drivers\btserial.sys []
R2 BTSLBCSP;Bluetooth Port Client Driver; \??\C:\WINDOWS\system32\drivers\btslbcsp.sys []
R2 eamon;EAMON; C:\WINDOWS\system32\DRIVERS\eamon.sys [2008-02-20 39944]
R2 rspndr;Link-Layer Topology Discovery Responder; C:\WINDOWS\system32\DRIVERS\rspndr.sys [2006-11-08 62336]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 BtAudio;Bluetooth Audio; C:\WINDOWS\system32\DRIVERS\btaudio.sys [2003-11-17 21861]
R3 BTDriver;Bluetooth Virtual Communications Driver; C:\WINDOWS\system32\DRIVERS\btport.sys [2003-11-17 30235]
R3 BthEnum;Bluetooth Request Block Driver; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-13 17024]
R3 BTHMODEM;Bluetooth Modem Communications Driver; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2008-04-13 37888]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-13 101120]
R3 BTHUSB;Bluetooth Radio USB Driver; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-13 18944]
R3 BTWDNDIS;Bluetooth LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2003-11-17 146684]
R3 CT20XUT.DLL;CT20XUT.DLL; C:\WINDOWS\system32\CT20XUT.DLL [2008-02-25 170520]
R3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\system32\drivers\ctac32k.sys [2008-02-25 511000]
R3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2008-02-25 524312]
R3 CTEXFIFX.DLL;CTEXFIFX.DLL; C:\WINDOWS\system32\CTEXFIFX.DLL [2008-02-25 1323544]
R3 CTHWIUT.DLL;CTHWIUT.DLL; C:\WINDOWS\system32\CTHWIUT.DLL [2008-02-25 72728]
R3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\system32\drivers\ctprxy2k.sys [2008-02-25 14360]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\drivers\ctsfm2k.sys [2008-02-25 157208]
R3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\system32\drivers\emupia2k.sys [2008-02-25 92696]
R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
R3 ha20x2k;Creative 20X HAL Driver; C:\WINDOWS\system32\drivers\ha20x2k.sys [2008-02-25 1172504]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12160]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-02-13 6660960]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2004-05-17 33280]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2004-05-17 12928]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2008-02-25 127000]
R3 Razerlow;Razerlow USB Filter Driver; C:\WINDOWS\System32\Drivers\Razerlow.sys [2005-04-24 13225]
R3 RFCOMM;Bluetooth Device (RFCOMM Protocol TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-13 59136]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2004-08-04 5888]
R3 RTL8023xp;Realtek RTL8139/810x/8169/8110 all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2004-04-13 70144]
R3 SaiH8000;SaiH8000; C:\WINDOWS\system32\DRIVERS\SaiH8000.sys [2004-07-30 56576]
R3 SRS_SSCFilter;SRS Labs Audio Sandbox (WDM); C:\WINDOWS\system32\drivers\srs_sscfilter_i386.sys [2007-07-26 39808]
R3 StillCam;Still Serial Digital Camera Driver; C:\WINDOWS\system32\DRIVERS\serscan.sys [2001-08-17 6784]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 vncmirror;vncmirror; C:\WINDOWS\system32\DRIVERS\vncmirror.sys [2008-05-12 4608]
S3 ayxtesdo;ayxtesdo; C:\WINDOWS\system32\drivers\ayxtesdo.sys []
S3 BTHPORT;Bluetooth Port Driver; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-04-13 273024]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 COMMONFX.DLL;COMMONFX.DLL; C:\WINDOWS\system32\COMMONFX.DLL [2008-02-25 98328]
S3 CTAUDFX.DLL;CTAUDFX.DLL; C:\WINDOWS\system32\CTAUDFX.DLL [2008-02-25 551960]
S3 ctdvda2k;Creative DVD-Audio Device Driver; C:\WINDOWS\system32\drivers\ctdvda2k.sys [2008-02-25 346856]
S3 CTEAPSFX.DLL;CTEAPSFX.DLL; C:\WINDOWS\system32\CTEAPSFX.DLL [2008-02-25 174104]
S3 CTEDSPFX.DLL;CTEDSPFX.DLL; C:\WINDOWS\system32\CTEDSPFX.DLL [2008-02-25 286232]
S3 CTEDSPIO.DLL;CTEDSPIO.DLL; C:\WINDOWS\system32\CTEDSPIO.DLL [2008-02-25 134680]
S3 CTEDSPSY.DLL;CTEDSPSY.DLL; C:\WINDOWS\system32\CTEDSPSY.DLL [2008-02-25 329240]
S3 CTERFXFX.DLL;CTERFXFX.DLL; C:\WINDOWS\system32\CTERFXFX.DLL [2008-02-25 100888]
S3 CTSBLFX.DLL;CTSBLFX.DLL; C:\WINDOWS\system32\CTSBLFX.DLL [2008-02-25 566296]
S3 IKFileSec;File Security Driver; C:\WINDOWS\system32\drivers\ikfilesec.sys [2008-09-16 40840]
S3 IKSysFlt;System Filter Driver; C:\WINDOWS\system32\drivers\iksysflt.sys [2008-09-16 66952]
S3 IKSysSec;System Security Driver; C:\WINDOWS\system32\drivers\iksyssec.sys [2008-09-16 81288]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2007-11-29 16896]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2007-11-29 19328]
S3 nmwcdcm;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2007-02-22 12288]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 TfNetMon;TfNetMon; \??\C:\WINDOWS\system32\drivers\TfNetMon.sys []
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2007-11-29 8064]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-02-18 30464]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 usbser;Nokia USB Serial Port; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-13 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2007-11-29 8064]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]
S4 atapi;atapi; C:\WINDOWS\system32\drivers\atapi.sys [2008-04-13 96512]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 btwdins;Bluetooth Service; C:\Program Files\TDK Systems\Bluetooth Software\bin\btwdins.exe [2003-11-17 135168]
R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.exe [1999-12-12 44032]
R2 CTAudSvcService;Creative Audio Service; C:\Program Files\Creative\Shared Files\CTAudSvc.exe [2008-03-07 417792]
R2 ekrn;Eset Service; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-02-20 472320]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-11-19 152984]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-02-13 155716]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 TVersityMediaServer;TVersityMediaServer; C:\Program Files\TVersity\Media Server\MediaServer.exe [2008-09-21 811008]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 NOD32FiXTemDono;Eset Nod32 Boot; C:\WINDOWS\system32\regedt32.exe [2004-08-04 3584]
S2 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 EhttpSrv;Eset HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2008-02-20 19200]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-03-27 654848]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
S4 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592]
S4 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2007-07-24 229376]
S4 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-03-30 504104]
S4 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
S4 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920]
S4 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2008-09-16 1077640]
S4 ServiceLayer;ServiceLayer; C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe [2007-06-15 300544]
S4 ThreatFire;ThreatFire; C:\Program Files\Spyware Doctor\TFEngine\TFService.exe [2008-10-03 66880]
S4 winvnc;VNC Server; C:\Program Files\TightVNC\WinVNC.exe [2007-05-07 589824]
S4 WinVNC4;VNC Server Version 4; C:\Program Files\RealVNC\VNC4\WinVNC4.exe [2008-10-14 2164088]

-----------------EOF-----------------



--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, November 20, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, November 20, 2008 00:53:34
Records in database: 1395434
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan statistics:
Files scanned: 116207
Threat name: 3
Infected objects: 6
Suspicious objects: 0
Duration of the scan: 07:06:03


File name / Threat name / Threats count
C:\Documents and Settings\¤0wner\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
C:\Documents and Settings\¤0wner\Desktop\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
C:\Downloads\~Cell Apps~\N-Gage\Atari Masterpieces Vol. 2.rar Infected: Trojan.SymbOS.Blocker.a 1
C:\Downloads\~Cell Apps~\N-Gage\Call Of Duty.rar Infected: Trojan.SymbOS.Blocker.a 1
C:\Downloads\~Cell Apps~\N-Gage\The Elder Scrolls Travels Shadowkey.rar Infected: Trojan.SymbOS.Blocker.a 1
C:\Program Files\FlashGet\updates.exe Infected: Trojan.Win32.Agent.aloj 1

The selected area was scanned.

I deleted the whole \N-Gage\ folder. \FlashGet\updates.exe I doubt is a virus. Computer works fine, same as before, only that one time the internet was barely working but after half of day it was working fine again. I checked the netstat now and instead of www.007guard.com connections it's localhost with random ports. It's probably the same thing only the name changed? :)
Posted Image

Edited by g3nX, 20 November 2008 - 01:23 PM.

  • 0

#18
emeraldnzl
Posted 20 November 2008 - 04:20 PM

emeraldnzl

    GeekU Instructor

  • GeekU Moderator
  • 20,051 posts

I checked the netstat now and instead of www.007guard.com connections it's localhost with random ports. It's probably the same thing only the name changed?


What we have done is restored the default settings.

You have the P2P programs SoulSeekNS, UTorrent and FrostWire on your computer. P2P file sharing programs inevitably lead to infection. To avoid future infection you might want to consider uninstalling them.

Now

Disable resident protections (Antivirus...); remember to re-enable them after the scan

Download Lop S&D

Double-click Lop S&D.exe (If you are running on Vista you will need to right-click on the file and choose Run As Administrator.)
Choose the language, then choose Option 1 (Search)
Wait till the end of the scan
Post the log which is created: (%SystemDrive%\lopR.txt)
  • 0

#19
g3nX
Posted 20 November 2008 - 04:24 PM

g3nX

    Member

  • Topic Starter
  • Member
  • PipPip
  • 17 posts
--------------------\\ Lop S&D 4.2.4-9c XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
X86-based PC ( Uniprocessor Free : AMD Athlon™ 64 Processor 3500+ )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : ¤0wner ( Administrator )
BOOT : Normal boot
Antivirus : ESET NOD32 Antivirus 3.0 3.0 (Not Activated)
A:\ (USB)
C:\ (Local Disk) - NTFS - Total:230 Go (Free:3 Go)
D:\ (CD or DVD)
E:\ (CD or DVD)
F:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
Option : [1] ( Thu 11/20/2008|17:23 )

--------------------\\ Listing folders in APPLIC~1

[10/08/2008|14:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
[11/17/2008|02:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\acccore
[03/27/2008|21:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[03/04/2008|22:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
[11/17/2008|02:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL Downloads
[03/04/2008|22:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL OCP
[03/05/2008|23:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[03/05/2008|23:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[03/04/2008|21:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CanonBJ
[04/20/2008|18:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative
[03/04/2008|22:19] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ESET
[03/27/2008|21:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
[06/15/2008|15:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
[08/27/2008|10:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[03/05/2008|18:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[03/18/2008|21:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
[06/15/2008|15:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nokia
[03/03/2008|23:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
[06/15/2008|15:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
[10/04/2008|08:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Tools
[09/18/2008|17:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
[09/23/2008|11:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Soulseek
[11/06/2008|02:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[10/10/2008|13:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SRS Labs
[11/06/2008|01:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[11/19/2008|00:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
[03/03/2008|23:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage

[03/03/2008|22:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[03/04/2008|17:57] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[03/03/2008|22:30] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[03/04/2008|22:09] C:\DOCUME~1\0WNER~1\APPLIC~1\acccore
[11/20/2008|14:19] C:\DOCUME~1\0WNER~1\APPLIC~1\Adobe
[04/11/2008|18:55] C:\DOCUME~1\0WNER~1\APPLIC~1\Apple Computer
[11/14/2008|19:17] C:\DOCUME~1\0WNER~1\APPLIC~1\Canon
[04/20/2008|18:29] C:\DOCUME~1\0WNER~1\APPLIC~1\Creative
[03/10/2008|18:13] C:\DOCUME~1\0WNER~1\APPLIC~1\DAEMON Tools
[08/30/2008|15:09] C:\DOCUME~1\0WNER~1\APPLIC~1\dvdcss
[09/01/2008|17:14] C:\DOCUME~1\0WNER~1\APPLIC~1\GARMIN
[03/03/2008|22:34] C:\DOCUME~1\0WNER~1\APPLIC~1\Identities
[03/05/2008|18:45] C:\DOCUME~1\0WNER~1\APPLIC~1\I-O DATA DEVICE,INC
[03/03/2008|22:58] C:\DOCUME~1\0WNER~1\APPLIC~1\Macromedia
[08/27/2008|10:56] C:\DOCUME~1\0WNER~1\APPLIC~1\Malwarebytes
[08/22/2008|14:54] C:\DOCUME~1\0WNER~1\APPLIC~1\Microsoft
[03/05/2008|19:01] C:\DOCUME~1\0WNER~1\APPLIC~1\mIRC
[05/27/2008|15:50] C:\DOCUME~1\0WNER~1\APPLIC~1\Move Networks
[11/13/2008|17:32] C:\DOCUME~1\0WNER~1\APPLIC~1\Mozilla
[03/18/2008|21:04] C:\DOCUME~1\0WNER~1\APPLIC~1\Nero
[06/15/2008|15:41] C:\DOCUME~1\0WNER~1\APPLIC~1\Nokia
[06/16/2008|03:02] C:\DOCUME~1\0WNER~1\APPLIC~1\NSeries
[11/17/2008|20:04] C:\DOCUME~1\0WNER~1\APPLIC~1\OpenOffice.org2
[03/05/2008|18:44] C:\DOCUME~1\0WNER~1\APPLIC~1\Opera
[06/15/2008|15:36] C:\DOCUME~1\0WNER~1\APPLIC~1\PC Suite
[09/16/2008|19:13] C:\DOCUME~1\0WNER~1\APPLIC~1\PC Tools
[11/19/2008|11:54] C:\DOCUME~1\0WNER~1\APPLIC~1\RayV
[11/20/2008|16:47] C:\DOCUME~1\0WNER~1\APPLIC~1\Skype
[09/16/2008|23:55] C:\DOCUME~1\0WNER~1\APPLIC~1\skypePM
[03/05/2008|18:35] C:\DOCUME~1\0WNER~1\APPLIC~1\Sun
[04/20/2008|16:12] C:\DOCUME~1\0WNER~1\APPLIC~1\Systweak
[03/03/2008|23:00] C:\DOCUME~1\0WNER~1\APPLIC~1\Talkback
[10/08/2008|14:17] C:\DOCUME~1\0WNER~1\APPLIC~1\uniblue
[11/19/2008|21:49] C:\DOCUME~1\0WNER~1\APPLIC~1\uTorrent
[04/15/2008|19:28] C:\DOCUME~1\0WNER~1\APPLIC~1\vlc
[08/22/2008|12:48] C:\DOCUME~1\0WNER~1\APPLIC~1\Winamp
[03/04/2008|21:26] C:\DOCUME~1\0WNER~1\APPLIC~1\WinRAR


--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[11/15/2008 09:23][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[11/19/2008 20:15][--ah-----] C:\WINDOWS\tasks\SA.DAT
[08/04/2004 07:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing Folders in C:\Program Files

[09/09/2008|21:58] C:\Program Files\Adobe
[09/08/2008|13:28] C:\Program Files\Advanced System Optimizer
[11/17/2008|02:52] C:\Program Files\AIM6
[05/28/2008|12:26] C:\Program Files\AIMP2
[03/27/2008|21:57] C:\Program Files\Akelote ir Ko
[09/28/2008|01:42] C:\Program Files\ApexDC++
[04/24/2008|17:06] C:\Program Files\Apple Software Update
[05/01/2008|19:29] C:\Program Files\Audacity
[03/05/2008|23:19] C:\Program Files\Bonjour
[03/13/2008|21:37] C:\Program Files\Canon
[04/20/2008|17:54] C:\Program Files\CCleaner
[04/06/2008|17:18] C:\Program Files\Cerberus
[11/16/2008|21:53] C:\Program Files\Common Files
[03/03/2008|22:28] C:\Program Files\ComPlus Applications
[04/20/2008|18:10] C:\Program Files\Creative
[04/20/2008|18:09] C:\Program Files\Creative Installation Information
[03/13/2008|22:44] C:\Program Files\DAEMON Tools Lite
[06/15/2008|15:36] C:\Program Files\DIFX
[04/20/2008|17:56] C:\Program Files\Driver Cleaner Pro
[03/04/2008|22:19] C:\Program Files\ESET
[09/26/2008|21:11] C:\Program Files\ffdshow
[11/13/2008|17:24] C:\Program Files\FlashGet
[03/05/2008|18:33] C:\Program Files\Fotonija
[05/03/2008|18:44] C:\Program Files\FrostWire
[04/20/2008|18:28] C:\Program Files\InstallShield Installation Information
[10/08/2008|13:48] C:\Program Files\Internet Explorer
[03/05/2008|18:45] C:\Program Files\I-O DATA DEVICE,INC
[04/03/2008|18:59] C:\Program Files\iPod
[04/03/2008|18:59] C:\Program Files\iTunes
[11/19/2008|23:56] C:\Program Files\Java
[03/09/2008|11:54] C:\Program Files\K-Lite Codec Pack
[11/16/2008|21:05] C:\Program Files\Malwarebytes' Anti-Malware
[05/18/2008|13:39] C:\Program Files\Messenger
[03/03/2008|22:30] C:\Program Files\microsoft frontpage
[03/05/2008|18:39] C:\Program Files\Microsoft Office
[03/03/2008|23:24] C:\Program Files\Microsoft Silverlight
[11/19/2008|20:37] C:\Program Files\mIRC
[06/16/2008|19:08] C:\Program Files\Mobiola Web Camera for S60
[05/18/2008|13:39] C:\Program Files\Movie Maker
[11/20/2008|14:07] C:\Program Files\Mozilla Firefox
[06/15/2008|15:34] C:\Program Files\MSBuild
[03/05/2008|18:39] C:\Program Files\MSECache
[10/08/2008|13:51] C:\Program Files\MSI
[03/03/2008|22:27] C:\Program Files\MSN
[03/03/2008|22:27] C:\Program Files\MSN Gaming Zone
[06/15/2008|15:44] C:\Program Files\MSXML 6.0
[03/18/2008|21:02] C:\Program Files\Nero
[03/18/2008|21:05] C:\Program Files\NeroInstall.bak
[05/18/2008|13:37] C:\Program Files\NetMeeting
[06/15/2008|15:44] C:\Program Files\Nokia
[03/03/2008|22:28] C:\Program Files\Online Services
[04/16/2008|21:14] C:\Program Files\OpenOffice.org 2.3
[04/16/2008|21:14] C:\Program Files\OpenOffice.org 2.4
[11/04/2008|10:13] C:\Program Files\Opera
[08/29/2008|14:11] C:\Program Files\Orb Networks
[05/18/2008|13:37] C:\Program Files\Outlook Express
[04/03/2008|18:58] C:\Program Files\QuickTime
[11/19/2008|11:48] C:\Program Files\RayV
[09/18/2008|11:49] C:\Program Files\RealVNC
[06/15/2008|15:27] C:\Program Files\Reference Assemblies
[09/02/2008|10:20] C:\Program Files\RipCast 1.9
[08/26/2008|00:19] C:\Program Files\Sandboxie
[06/15/2008|15:39] C:\Program Files\SimpleCenter
[09/18/2008|17:49] C:\Program Files\Skype
[09/22/2008|15:19] C:\Program Files\SoulseekNS
[11/11/2008|05:50] C:\Program Files\Spybot - Search & Destroy
[11/05/2008|22:45] C:\Program Files\Spyware Doctor
[10/10/2008|13:10] C:\Program Files\SRS Labs
[10/29/2008|19:37] C:\Program Files\Steam
[11/12/2008|22:46] C:\Program Files\TDK Systems
[10/26/2008|12:36] C:\Program Files\TightVNC
[09/23/2008|17:37] C:\Program Files\Total Video Converter
[10/13/2008|21:21] C:\Program Files\Tracker Checker 2
[08/25/2008|18:06] C:\Program Files\Trend Micro
[03/05/2008|18:54] C:\Program Files\TVersity
[09/26/2008|21:11] C:\Program Files\TVersity Codec Pack
[10/08/2008|14:14] C:\Program Files\Uniblue
[03/03/2008|22:28] C:\Program Files\Uninstall Information
[03/04/2008|20:49] C:\Program Files\uTorrent
[03/05/2008|07:52] C:\Program Files\VideoLAN
[08/22/2008|12:49] C:\Program Files\Winamp
[03/03/2008|22:27] C:\Program Files\Windows Media Connect 2
[05/18/2008|13:37] C:\Program Files\Windows Media Player
[05/18/2008|13:37] C:\Program Files\Windows NT
[03/03/2008|22:29] C:\Program Files\WindowsUpdate
[03/04/2008|21:26] C:\Program Files\WinRAR
[03/03/2008|22:30] C:\Program Files\xerox

--------------------\\ Listing Folders in C:\Program Files\Common Files

[09/09/2008|21:58] C:\Program Files\Common Files\Adobe
[03/04/2008|22:08] C:\Program Files\Common Files\AOL
[03/05/2008|23:18] C:\Program Files\Common Files\Apple
[04/20/2008|18:09] C:\Program Files\Common Files\Creative
[06/15/2008|15:39] C:\Program Files\Common Files\i4j_jres
[03/13/2008|21:37] C:\Program Files\Common Files\InstallShield
[03/27/2008|21:44] C:\Program Files\Common Files\Macrovision Shared
[06/15/2008|15:55] C:\Program Files\Common Files\MainConcept
[06/15/2008|15:37] C:\Program Files\Common Files\Microsoft Shared
[03/03/2008|22:28] C:\Program Files\Common Files\MSSoap
[06/15/2008|15:38] C:\Program Files\Common Files\muvee Technologies
[03/18/2008|21:03] C:\Program Files\Common Files\Nero
[06/15/2008|15:43] C:\Program Files\Common Files\Nokia
[03/03/2008|17:22] C:\Program Files\Common Files\ODBC
[09/16/2008|19:17] C:\Program Files\Common Files\PC Tools
[06/15/2008|15:36] C:\Program Files\Common Files\PCSuite
[03/03/2008|22:28] C:\Program Files\Common Files\Services
[03/04/2008|22:05] C:\Program Files\Common Files\Skype
[03/03/2008|17:22] C:\Program Files\Common Files\SpeechEngines
[05/18/2008|13:36] C:\Program Files\Common Files\System

--------------------\\ Process

( 49 Processes )

... OK !

--------------------\\ Searching with S_Lop

No Lop folder found !

--------------------\\ Searching for Lop Files - Folders

No Lop folder found !

--------------------\\ Searching within the Registry

..... OK !

--------------------\\ Checking the Hosts file

Hosts file CLEAN


--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-20 17:23:45
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Searching for other infections


No other infections found !

[F:907][D:19]-> C:\DOCUME~1\0WNER~1\LOCALS~1\Temp
[F:13][D:0]-> C:\DOCUME~1\0WNER~1\Cookies
[F:4150][D:8]-> C:\DOCUME~1\0WNER~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Thu 11/20/2008|17:24 - Option : [1]

--------------------\\ Scan completed at 17:24:27
  • 0

#20
emeraldnzl
Posted 20 November 2008 - 05:36 PM

emeraldnzl

    GeekU Instructor

  • GeekU Moderator
  • 20,051 posts
Still one or two to remove.

Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :processes
explorer.exe
:services
ayxtesdo
:files
C:\WINDOWS\system32\drivers\ayxtesdo.sys
C:\Downloads\~Cell Apps~\N-Gage\Atari Masterpieces Vol. 2.rar
C:\Downloads\~Cell Apps~\N-Gage\Call Of Duty.rar
C:\Downloads\~Cell Apps~\N-Gage\The Elder Scrolls Travels Shadowkey.rar
C:\Program Files\FlashGet
:commands
[emptytemp]
[start explorer]
[Reboot]
  • Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Next

Please run Kaspersky on line scan again and post the results back here.

So when you return please post
  • OTMoveIt3 log
  • Kaspersky scan results
  • 0

#21
g3nX
Posted 21 November 2008 - 12:54 PM

g3nX

    Member

  • Topic Starter
  • Member
  • PipPip
  • 17 posts
========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
Unable to stop service ayxtesdo .
========== FILES ==========
File/Folder C:\WINDOWS\system32\drivers\ayxtesdo.sys not found.
File/Folder C:\Downloads\~Cell Apps~\N-Gage\Atari Masterpieces Vol. 2.rar not found.
File/Folder C:\Downloads\~Cell Apps~\N-Gage\Call Of Duty.rar not found.
File/Folder C:\Downloads\~Cell Apps~\N-Gage\The Elder Scrolls Travels Shadowkey.rar not found.
C:\Program Files\FlashGet\SOUNDS moved successfully.
C:\Program Files\FlashGet\Skin moved successfully.
C:\Program Files\FlashGet\Language moved successfully.
C:\Program Files\FlashGet\FGUpdate moved successfully.
C:\Program Files\FlashGet\FGMule\log\torfiles moved successfully.
C:\Program Files\FlashGet\FGMule\log moved successfully.
C:\Program Files\FlashGet\FGMule\config\update moved successfully.
C:\Program Files\FlashGet\FGMule\config\lang moved successfully.
C:\Program Files\FlashGet\FGMule\config moved successfully.
C:\Program Files\FlashGet\FGMule moved successfully.
C:\Program Files\FlashGet\Config moved successfully.
C:\Program Files\FlashGet moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\0WNER~1\LOCALS~1\Temp\etilqs_J7SCp9RQUeKkIJxypL4m scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\0WNER~1\LOCALS~1\Temp\etilqs_J7SCp9RQUeKkIJxypL4m-journal scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_bc4.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Opera cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11202008_184250

Files moved on Reboot...
File C:\DOCUME~1\0WNER~1\LOCALS~1\Temp\etilqs_J7SCp9RQUeKkIJxypL4m not found!
File C:\DOCUME~1\0WNER~1\LOCALS~1\Temp\etilqs_J7SCp9RQUeKkIJxypL4m-journal not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\Perflib_Perfdata_bc4.dat not found!





--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, November 21, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, November 20, 2008 20:06:26
Records in database: 1397677
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan statistics:
Files scanned: 116080
Threat name: 1
Infected objects: 2
Suspicious objects: 0
Duration of the scan: 07:12:18


File name / Threat name / Threats count
C:\Documents and Settings\¤0wner\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
C:\Documents and Settings\¤0wner\Desktop\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1

The selected area was scanned.
  • 0

#22
emeraldnzl
Posted 21 November 2008 - 01:08 PM

emeraldnzl

    GeekU Instructor

  • GeekU Moderator
  • 20,051 posts
Hello g3nX,

Looking good. That Kaspersky only found ones related to malware tools.

We need to remove that bad driver though.

You have had ComboFix on your machine.

If you still have it we will use it to attack that driver. If not let me know and we will download again.

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

KillAll::
Driver::
ayxtesdo
File::
C:\WINDOWS\system32\drivers\ayxtesdo.sys


Save this as CFScript.txt, in the same location as ComboFix.exe

Posted Image

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it will produce a log for you at C:\ComboFix.txt which I will require in your next reply.
  • 0

#23
g3nX
Posted 21 November 2008 - 02:52 PM

g3nX

    Member

  • Topic Starter
  • Member
  • PipPip
  • 17 posts
ComboFix 08-11-21.03 - ¤0wner 2008-11-21 15:21:08.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.492 [GMT -5:00]
Running from: c:\documents and settings\¤0wner\Desktop\Cleaners\ComboFix.exe
Command switches used :: c:\documents and settings\¤0wner\Desktop\CFScript.txt
* Created a new restore point
* Resident AV is active


FILE ::
c:\windows\system32\drivers\ayxtesdo.sys
.

((((((((((((((((((((((((( Files Created from 2008-10-21 to 2008-11-21 )))))))))))))))))))))))))))))))
.

2008-11-20 17:21 . 2008-11-20 17:24 <DIR> d-------- C:\Lop SD
2008-11-19 23:56 . 2008-11-19 23:56 <DIR> d-------- c:\program files\Java
2008-11-19 23:56 . 2008-11-19 23:56 410,976 --a------ c:\windows\system32\deploytk.dll
2008-11-19 23:56 . 2008-11-19 23:56 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-11-19 15:39 . 2008-11-19 15:39 <DIR> d-------- C:\_OTMoveIt
2008-11-19 11:48 . 2008-11-19 11:48 <DIR> d-------- c:\program files\RayV
2008-11-19 11:48 . 2008-11-19 11:54 <DIR> d-------- c:\documents and settings\¤0wner\Application Data\RayV
2008-11-19 00:11 . 2008-11-19 00:11 <DIR> d-------- C:\rsit
2008-11-18 19:56 . 2008-11-18 20:04 2,696 --a------ c:\windows\system32\tmp.reg
2008-11-18 19:55 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe
2008-11-18 19:55 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe
2008-11-18 19:55 . 2008-10-01 14:51 87,552 --a------ c:\windows\system32\VACFix.exe
2008-11-18 19:55 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\o4Patch.exe
2008-11-18 19:55 . 2008-05-18 20:40 82,944 --a------ c:\windows\system32\IEDFix.exe
2008-11-18 19:55 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\IEDFix.C.exe
2008-11-18 19:55 . 2008-08-18 11:19 82,432 --a------ c:\windows\system32\404Fix.exe
2008-11-18 19:55 . 2003-06-05 20:13 53,248 --a------ c:\windows\system32\Process.exe
2008-11-18 19:55 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe
2008-11-18 19:55 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe
2008-11-17 02:52 . 2008-11-17 02:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\acccore
2008-11-17 02:51 . 2008-11-17 02:51 <DIR> d-------- c:\documents and settings\All Users\Application Data\AOL Downloads
2008-11-12 22:49 . 2008-04-14 05:42 16,384 --a------ c:\windows\system32\ipsink.ax
2008-11-12 22:49 . 2008-04-14 05:42 16,384 --a--c--- c:\windows\system32\dllcache\ipsink.ax
2008-11-12 22:49 . 2008-04-14 00:16 15,232 --a------ c:\windows\system32\drivers\StreamIP.sys
2008-11-12 22:49 . 2008-04-14 00:16 15,232 --a--c--- c:\windows\system32\dllcache\streamip.sys
2008-11-12 22:49 . 2008-04-14 00:16 11,136 --a------ c:\windows\system32\drivers\SLIP.sys
2008-11-12 22:49 . 2008-04-14 00:16 11,136 --a--c--- c:\windows\system32\dllcache\slip.sys
2008-11-12 22:49 . 2008-04-14 00:16 10,880 --a------ c:\windows\system32\drivers\NdisIP.sys
2008-11-12 22:49 . 2008-04-14 00:16 10,880 --a--c--- c:\windows\system32\dllcache\ndisip.sys
2008-11-12 22:46 . 2008-11-12 22:46 <DIR> d-------- c:\program files\TDK Systems
2008-11-06 02:07 . 2008-11-21 15:15 <DIR> dr-h----- c:\documents and settings\¤0wner\Recent
2008-11-06 02:07 . 2008-11-21 15:15 <DIR> dr-h----- c:\documents and settings\¤0wner\Recent
2008-11-05 13:18 . 2008-11-21 15:23 9,699,328 --a------ c:\documents and settings\¤0wner\ntuser.dat
2008-11-05 13:18 . 2008-11-21 15:23 9,699,328 --a------ c:\documents and settings\¤0wner\ntuser.dat
2008-11-03 20:36 . 2008-11-03 20:36 36,363 --a------ c:\windows\CSTBox.INI
2008-10-26 12:36 . 2008-10-26 12:36 <DIR> d-------- c:\program files\TightVNC

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-21 20:23 266,240 ----a-w c:\documents and settings\NetworkService\NTUSER.DAT
2008-11-21 20:19 --------- d-----w c:\documents and settings\¤0wner\Application Data\Skype
2008-11-21 18:56 --------- d-----w c:\program files\mIRC
2008-11-20 02:49 --------- d-----w c:\documents and settings\¤0wner\Application Data\uTorrent
2008-11-19 05:10 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2008-11-18 01:04 --------- d-----w c:\documents and settings\¤0wner\Application Data\OpenOffice.org2
2008-11-17 07:52 --------- d-----w c:\program files\AIM6
2008-11-17 02:05 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2008-11-15 00:17 --------- d-----w c:\documents and settings\¤0wner\Application Data\Canon
2008-11-11 10:50 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-06 07:07 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-06 07:05 98,304 ----a-w c:\windows\DUMP5052.tmp
2008-11-06 06:54 98,304 ----a-w c:\windows\DUMP5042.tmp
2008-11-06 06:33 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-06 03:45 --------- d-----w c:\program files\Spyware Doctor
2008-11-04 15:13 --------- d-----w c:\program files\Opera
2008-10-30 00:37 --------- d-----w c:\program files\Steam
2008-10-22 21:10 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2008-10-22 21:10 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-10-14 02:21 --------- d-----w c:\program files\Tracker Checker 2
2008-10-10 18:10 --------- d-----w c:\program files\SRS Labs
2008-10-10 18:10 --------- d-----w c:\documents and settings\All Users\Application Data\SRS Labs
2008-10-08 19:17 --------- d-----w c:\documents and settings\¤0wner\Application Data\uniblue
2008-10-08 19:14 --------- dc-h--w c:\documents and settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
2008-10-08 19:14 --------- d-----w c:\program files\Uniblue
2008-10-08 18:51 --------- d-----w c:\program files\MSI
2008-10-07 15:51 361,344 ----a-w c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2008-10-07 15:51 361,344 ----a-w c:\windows\system32\drivers\TCPIP.SYS
2008-10-04 13:24 --------- d-----w c:\documents and settings\All Users\Application Data\PC Tools
2008-10-03 22:49 51,520 ----a-w c:\windows\system32\drivers\TfFsMon.sys
2008-10-03 22:49 38,208 ----a-w c:\windows\system32\drivers\TfSysMon.sys
2008-10-03 22:49 33,088 ----a-w c:\windows\system32\drivers\TfNetMon.sys
2008-10-03 22:49 12,608 ----a-w c:\windows\system32\drivers\TfKbMon.sys
2008-09-28 06:42 --------- d-----w c:\program files\ApexDC++
2008-09-27 02:11 --------- d-----w c:\program files\TVersity Codec Pack
2008-09-27 02:11 --------- d-----w c:\program files\ffdshow
2008-09-23 22:37 --------- d-----w c:\program files\Total Video Converter
2008-09-23 16:46 --------- d-----w c:\documents and settings\All Users\Application Data\Soulseek
2008-09-22 20:19 --------- d-----w c:\program files\SoulseekNS
2008-09-02 15:18 356,352 ----a-w c:\windows\eSellerateEngine.dll
2008-06-15 20:55 56 --sha-w c:\documents and settings\All Users\Application Data\dc64vg9.sys
2008-03-05 03:06 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat
.

((((((((((((((((((((((((((((( snapshot@2008-11-14_ 1.22.20.03 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-01-24 01:41:42 841,304 ----a-w c:\windows\Downloaded Program Files\ampAx3.0.84.2.dll
+ 2008-11-17 07:52:31 38,428 ----a-w c:\windows\Downloaded Program Files\unagiuninst.exe
- 2008-10-08 20:01:49 1,446,936 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2008-11-21 20:24:43 1,446,936 ----a-w c:\windows\system32\FNTCACHE.DAT
+ 2008-11-20 04:56:18 144,792 ----a-w c:\windows\system32\java.exe
+ 2008-11-20 04:56:19 144,792 ----a-w c:\windows\system32\javaw.exe
+ 2008-11-20 04:56:19 148,888 ----a-w c:\windows\system32\javaws.exe
+ 2008-03-25 02:32:44 218,496 ----a-r c:\windows\system32\Macromed\Flash\FlashUtil9f.exe
+ 2008-11-19 16:48:47 74,137 ----a-w c:\windows\system32\Macromed\Flash\uninstall_activeX.exe
+ 2006-01-09 14:36:06 40,960 ----a-w c:\windows\system32\swsc.exe
+ 2008-11-21 20:24:57 16,384 ----atw c:\windows\temp\Perflib_Perfdata_f4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SRS Audio Sandbox"="c:\program files\SRS Labs\Audio Sandbox\SRSSSC.exe" [2008-06-09 3215360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2004-06-10 83968]
"AudioDrvEmulator"="c:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-02-13 13500416]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-02-13 86016]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 1443072]
"VolPanel"="c:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-13 122880]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-19 136600]
"nwiz"="nwiz.exe" [2008-02-13 c:\windows\system32\nwiz.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 c:\windows\system32\bthprops.cpl]
"CTHelper"="CTHELPER.EXE" [2008-02-20 c:\windows\system32\CtHelper.exe]
"CTxfiHlp"="CTXFIHLP.EXE" [2008-02-20 c:\windows\system32\Ctxfihlp.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\TDK Systems\Bluetooth Software\BTTray.exe [2003-11-17 503869]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Nokia Nseries PC Suite.lnk]
backup=c:\windows\pss\Nokia Nseries PC Suite.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2008-02-28 16:07 1828136 c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISTray]
--a------ 2008-09-16 19:16 1168264 c:\program files\Spyware Doctor\pctsTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-03-30 09:36 267048 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
--a------ 2008-02-18 15:29 2221352 c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2008-02-28 08:59 570664 c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-03-28 22:37 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sclauncher]
--a------ 2007-10-11 18:12 94208 c:\program files\SimpleCenter\bin\win\sclauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SRS Audio Sandbox]
--a------ 2008-06-09 14:43 3215360 c:\program files\SRS Labs\Audio Sandbox\SRSSSC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--------- 2000-05-11 00:00 90112 c:\windows\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinVNC]
--a------ 2007-05-07 18:28 589824 c:\program files\TightVNC\WinVNC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
--a------ 2006-10-18 20:05 204288 c:\program files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPod Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"Nero BackItUp Scheduler 3"=2 (0x2)
"sdCoreService"=3 (0x3)
"sdAuxService"=3 (0x3)
"Bonjour Service"=2 (0x2)
"WinVNC4"=2 (0x2)
"ServiceLayer"=3 (0x3)
"winvnc"=2 (0x2)
"ThreatFire"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Steam\\steamapps\\g3n3rationx\\counter-strike source\\hl2.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Cerberus\\Cerberus.exe"=
"c:\\Program Files\\ApexDC++\\ApexDC.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\Program Files\\mIRC\\mirc.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\winvnc4.exe"=
"c:\\Program Files\\SoulseekNS\\slsk.exe"=
"c:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\RealVNC\\VNC4\\vncviewer.exe"=
"c:\\Program Files\\TightVNC\\WinVNC.exe"=
"c:\\Program Files\\TightVNC\\vncviewer.exe"=
"c:\\Program Files\\RayV\\RayV\\RayV.exe"=
"c:\\Documents and Settings\\¤0wner\\Desktop\\hfs.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2008-10-03 51520]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2008-10-03 38208]
R1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2008-02-20 33800]
R1 pctfw2;pctfw2;\??\c:\windows\system32\drivers\pctfw2.sys [2008-09-16 160792]
R2 CTAudSvcService;Creative Audio Service;c:\program files\Creative\Shared Files\CTAudSvc.exe [2008-04-20 417792]
R3 ha20x2k;Creative 20X HAL Driver;c:\windows\system32\drivers\ha20x2k.sys [2008-02-25 1172504]
R3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\Drivers\Razerlow.sys [2005-04-24 13225]
R3 SaiH8000;SaiH8000;c:\windows\system32\DRIVERS\SaiH8000.sys [2004-07-30 56576]
S2 NOD32FiXTemDono;Eset Nod32 Boot;c:\windows\system32\regedt32.exe /s c:\windows\nod32fixtemdono.reg [2004-08-04 3584]
S3 TfNetMon;TfNetMon;\??\c:\windows\system32\drivers\TfNetMon.sys [2008-10-03 33088]
S4 ThreatFire;ThreatFire;c:\program files\Spyware Doctor\TFEngine\TFService.exe service []
.
Contents of the 'Scheduled Tasks' folder

2008-11-15 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-21 15:24:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\TDK Systems\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\CTSVCCDA.EXE
c:\windows\system32\rundll32.exe
c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\CTxfispi.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Completion time: 2008-11-21 15:27:00 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-21 20:26:57
ComboFix2.txt 2008-11-17 02:55:14
ComboFix3.txt 2008-11-14 06:30:40
ComboFix4.txt 2008-11-14 06:22:48
ComboFix5.txt 2008-11-21 20:20:40

Pre-Run: 4,166,234,112 bytes free
Post-Run: 4,221,308,928 bytes free

246
  • 0

#24
emeraldnzl
Posted 21 November 2008 - 03:00 PM

emeraldnzl

    GeekU Instructor

  • GeekU Moderator
  • 20,051 posts
Hello again g3nX,

Your machine looks clean to me now.

We have a couple of last steps to perform and then you're all set. :)

Follow these steps to uninstall Combofix and some tools used in the removal of malware
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    Posted Image
After that please go here to download OTCleanIt.

Run this program to remove the remaining tools we have been using.

You will be asked to reboot the machine to finish the Cleanup process choose Yes.

MBAM can be uninstalled via control panel add/remove but it may be a useful tool to keep

-------------------------------------------------------------------------------------------------------------------

A reminder now: Remember to turn back on any anti-malware programs you may have turned off during the cleaning process.

-------------------------------------------------------------------------------------------------------------------

Now that you are clean here are some things I think are worth having a look at:

-------------------------------------------------------------------------------------------------------------------

Check your Adobe Acrobat Reader; it may be out of date. Older versions are vunerable to attack.

Please go to the link below to update.

http://www.adobe.com.../readstep2.html

---------------------------------------------------------------------------------------------------------------------

Be sure and give the Temp folders a cleaning out now and then. This helps with security and your computer will run more efficiently. I clean mine once a week. For ease of use, you might consider the following free program:--------------------------------------------------------------------------------------------------------------------

A great way to check that your Microsoft and Java have the latest updates is to go to Software Inspector at Secunia.

I do this weekly. Not only do they tell you which programs need updating but they give you the link to follow.

To bolster your security go to Secunia.com to ensure essential programs are up to date.

---------------------------------------------------------------------------------------------------------------------

Make Internet Explorer more secure
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".a
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Consider using an alternate browser. Mozilla's Firefox browser is excellant; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up blocker (Note: this as an added benefit!) that I have seen. Firefox is my default browser but I retain Internet Explorer as well so that I can access the very few sites that require it.

Firefox may be downloaded from Here

-----------------------------------------------------------------------------------------------------------------------

Startuplite is a tool to help you stop some programs not needed when you start your computer from loading. They will begin automatically only when needed.

------------------------------------------------------------------------------------------------------------------------

To help protect your computer in the future here are some free programs you can look at:

  • SUPERAntiSpyware Free for Home Users to detect and remove spyware.
  • IESpy-Ad to block access to malicious websites so you cannot be redirected to them from an infected site or email.

    If your Microsoft Update is not working automatically. Keep your operating system up to date by visiting
  • Microsoft Windows Update
monthly. And to keep your system clean run these free malware scanners
weekly, and be aware of what emails you open and websites you visit.

To learn more about how to protect yourself while on the internet read this article by Tony Klein: So how did I get infected in the first place?

Have a safe and happy computing day!
  • 0

#25
g3nX
Posted 24 November 2008 - 01:04 AM

g3nX

    Member

  • Topic Starter
  • Member
  • PipPip
  • 17 posts
Emeraldnzl, THANK YOU ! ! I really appreciate that you took your time to help me! Your instructions were very clear and easy to follow. My computer is now clean and runs very smooth. Keep up the good work on this forum and good luck! Thanks again! :)

---g3nX.
  • 0

Advertisements

#26
emeraldnzl
Posted 24 November 2008 - 12:53 PM

emeraldnzl

    GeekU Instructor

  • GeekU Moderator
  • 20,051 posts
You are very welcome. :)
  • 0

#27
emeraldnzl
Posted 24 November 2008 - 12:53 PM

emeraldnzl

    GeekU Instructor

  • GeekU Moderator
  • 20,051 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP