Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Suspected Rootkit + Other Issues [Closed]

Started by clutsta , Aug 23 2016 03:36 AM

This topic is locked

#1
clutsta

Posted 23 August 2016 - 03:36 AM

Member

Member
28 posts

Hi there, first of all let me express my appreciation to the Admin, Mods and Contributors on this forum. You are all champions and awesome human beings!

I have been experiencing serious issues on several devices across my home network, including a desktop running XP SP3, Samsung Laptop running XP SP3, a Macbook Pro and also my Galaxy S3 mobile phone. Approximately a year ago I had issues which were raised in another thread on this forum. I had honestly believe that my devices and network has been compromised from prior to then, and up until now with a hidden system on each machine running XP. Avast and Malwarebytes would scan but would not show any sort of anything, ever. Even when I knew the system was infected. Settings are constantly reverting back to ones that I don't choose. MWB had important settings greyed out. Firefox had occasional page script issues, random flashing and strange stuff happening when downloading.

Approximately 2 weeks ago I had a virus which compromised both my machines running XP. It was strange because the virus actually installed programs that were present before I started having issues, such as Skype, Dropbox, Bitlord etc. I then re-installed XP SP3 on both machines (different software licences) and am still unable to get any sort of any network connection to the internet. It is a strange co-incidence, but at the same time both devices were infected, my phone line has also experienced a fault, and is no longer working. According to my phone line provider, the fault is due to be fixed within the next 24 hours.

I will start off with a log from the Samsung laptop. This is the device I really need the temporary wireless connection to work on

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-08-2016 01

Ran by Administrator (administrator) on KEVGIL (23-08-2016 18:49:06)

Running from E:\

Loaded Profiles: Administrator (Available Profiles: Kevin Gilhooly & Administrator)

Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) Language: English (United States)

Internet Explorer Version 8 (Default browser: IE)

Boot Mode: Safe Mode (minimal)

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(McAfee, Inc.) C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

(McAfee, Inc.) C:\PROGRA~1\McAfee.com\Agent\mcagent.exe

(McAfee, Inc.) C:\PROGRA~1\McAfee\MSC\mcuimgr.exe

(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre1.5.0\bin\jusched.exe [36972 2008-11-12] (Sun Microsystems, Inc.)

HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [16851456 2008-08-26] (Realtek Semiconductor Corp.)

HKLM\...\Run: [Alcmtr] => C:\WINDOWS\ALCMTR.EXE [57344 2008-06-20] (Realtek Semiconductor Corp.)

HKLM\...\Run: [] => [X]

HKLM\...\Run: [EDS] => C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe [659456 2007-12-21] (Samsung Electronics,.LTD)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1044480 2008-08-28] (Synaptics, Inc.)

HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [39792 2008-01-12] (Adobe Systems Incorporated)

HKLM\...\Run: [DMHotKey] => C:\Program Files\Samsung\Easy Display Manager\DMLoader.exe [466944 2006-12-28] (SAMSUNG Electronics)

HKLM\...\Run: [BatteryManager] => C:\Program Files\Samsung\Samsung Battery Manager\BatteryManager.exe [2768896 2008-10-20] ()

HKLM\...\Run: [MagicKeyboard] => C:\Program Files\SAMSUNG\MagicKBD\PreMKBD.exe [151552 2006-05-15] ()

HKLM\...\Run: [mcagent_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [582992 2007-08-04] (McAfee, Inc.)

HKLM\...\Run: [Dodo_Australia Flame ModemListener] => C:\Program Files\Dodo Mobile\BackgroundService\ModemListener.exe [169768 2015-01-04] ()

HKU\S-1-5-21-2277594783-1135049707-4067570145-500\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\IMAGIN~1.SCR [1744896 2007-02-27] (TopThinks, INC.)

Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk [2009-02-22]

ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Internet Explorer:

==================

HKU\S-1-5-21-2277594783-1135049707-4067570145-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

HKU\S-1-5-21-2277594783-1135049707-4067570145-500\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

BHO: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23] (Adobe Systems Incorporated)

BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> c:\Program Files\McAfee\VirusScan\scriptsn.dll [2007-07-24] (McAfee, Inc.)

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 6to4; C:\WINDOWS\System32\6to4svc.dll [100864 2010-02-12] (Microsoft Corporation)

S2 Dodo_Australia Flame Modem Device Helper; C:\Program Files\Dodo Mobile\BackgroundService\ServiceManager.exe [76584 2014-12-11] () [File not signed]

R2 mcmscsvc; C:\Program Files\McAfee\MSC\mcmscsvc.exe [749904 2007-08-04] (McAfee, Inc.)

S2 McNASvc; c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe [2376992 2007-07-23] (McAfee, Inc.)

S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [378184 2007-07-25] (McAfee, Inc.)

S2 McProxy; c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe [359248 2007-07-16] (McAfee, Inc.)

S2 McShield; C:\Program Files\McAfee\VirusScan\Mcshield.exe [144704 2007-07-24] (McAfee, Inc.)

S4 McSysmon; C:\Program Files\McAfee\VirusScan\mcsysmon.exe [695624 2007-07-25] (McAfee, Inc.)

S2 MpfService; C:\Program Files\McAfee\MPF\MPFSrv.exe [856864 2007-07-19] (McAfee, Inc.)

S2 Samsung Update Plus; C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe [77480 2008-05-13] () [File not signed]

S2 SNM WLAN Service; C:\Program Files\samsung\Samsung Network Manager\SNMWLANService.exe [36864 2006-10-30] () [File not signed]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 AlcatelOTDCWwan; C:\WINDOWS\System32\DRIVERS\AlcatelOTDCWwan.sys [134144 2013-06-18] (TCT International Mobile Ltd.)

S3 AR5416; C:\WINDOWS\System32\DRIVERS\athw.sys [1334432 2008-10-08] (Atheros Communications, Inc.)

S3 btaudio; C:\WINDOWS\System32\drivers\btaudio.sys [539072 2007-03-23] (Broadcom Corporation.)

S3 BTDriver; C:\WINDOWS\System32\DRIVERS\btport.sys [37424 2007-03-23] (Broadcom Corporation.)

S3 BTKRNL; C:\WINDOWS\System32\DRIVERS\btkrnl.sys [876384 2007-03-31] (Broadcom Corporation.)

S3 BTWDNDIS; C:\WINDOWS\System32\DRIVERS\btwdndis.sys [149123 2007-03-23] (Broadcom Corporation.)

S3 BTWUSB; C:\WINDOWS\System32\Drivers\btwusb.sys [67960 2007-03-23] (Broadcom Corporation.)

S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)

S3 DNSeFilter; C:\WINDOWS\System32\drivers\SamsungEDS.sys [30208 2008-01-15] (Samsung Electronics,.LTD) [File not signed]

S2 DOSMEMIO; C:\WINDOWS\system32\MEMIO.SYS [4300 2005-10-27] () [File not signed]

S3 jrdusbser; C:\WINDOWS\System32\DRIVERS\jrdusbser.sys [107904 2013-06-18] (TCT International Mobile Ltd.)

S3 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [79304 2007-07-24] (McAfee, Inc.)

S3 mfebopk; C:\WINDOWS\System32\drivers\mfebopk.sys [35240 2007-07-21] (McAfee, Inc.)

S1 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [201288 2007-07-21] (McAfee, Inc.)

S3 mferkdk; C:\WINDOWS\System32\drivers\mferkdk.sys [33800 2007-07-24] (McAfee, Inc.)

S3 mfesmfk; C:\WINDOWS\System32\drivers\mfesmfk.sys [40488 2007-07-21] (McAfee, Inc.)

S1 MPFP; C:\WINDOWS\System32\Drivers\Mpfp.sys [113952 2007-07-13] (McAfee, Inc.)

S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)

S3 SUEPD; C:\WINDOWS\System32\DRIVERS\SUE_PD.sys [19840 2006-10-30] (Samsung) [File not signed]

S1 Tcpip6; C:\WINDOWS\System32\DRIVERS\tcpip6.sys [226880 2010-02-11] (Microsoft Corporation)

S3 VMC326; C:\WINDOWS\System32\Drivers\VMC326.sys [238464 2008-09-23] (Vimicro Corporation)

S3 yukonwxp; C:\WINDOWS\System32\DRIVERS\yk51x86.sys [289024 2008-06-27] (Marvell)

S4 IntelIde; no ImagePath

U1 WS2IFSL; no ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-23 16:00 - 2016-08-23 16:00 - 00000000 ____D C:\Documents and Settings\Administrator\Application Data\Adobe

2016-08-23 15:49 - 2016-08-23 15:38 - 01746432 _____ (Farbar) C:\Documents and Settings\Administrator\Desktop\FRST.exe

2016-08-23 15:47 - 2016-08-23 15:47 - 00000000 __SHD C:\Documents and Settings\Administrator\IETldCache

2016-08-23 15:46 - 2016-08-23 18:49 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Temp

2016-08-23 15:46 - 2016-08-23 15:47 - 00000000 ____D C:\Documents and Settings\Administrator

2016-08-23 15:46 - 2008-12-22 20:33 - 00000178 ___SH C:\Documents and Settings\Administrator\ntuser.ini

2016-08-23 15:46 - 2008-12-22 19:28 - 00000000 ____D C:\Documents and Settings\Administrator\My Documents\Play Camera Media

2016-08-23 15:46 - 2008-11-12 00:41 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Application Data\Adobe

2016-08-23 15:46 - 2008-11-12 00:36 - 00000767 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Internet Explorer.lnk

2016-08-23 15:46 - 2008-11-12 00:36 - 00000738 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Outlook Express.lnk

2016-08-23 15:46 - 2008-11-12 00:36 - 00000000 ___RD C:\Documents and Settings\Administrator\My Documents\My Pictures

2016-08-23 15:46 - 2008-11-12 00:36 - 00000000 ___RD C:\Documents and Settings\Administrator\My Documents\My Music

2016-08-23 15:46 - 2008-11-12 00:36 - 00000000 ___RD C:\Documents and Settings\Administrator\My Documents

2016-08-23 15:46 - 2008-11-12 00:35 - 00000000 ____D C:\Documents and Settings\Administrator\Local Settings\Application Data\{3248F0A6-6813-11D6-A77B-00B0D0150000}

2016-08-23 15:46 - 2008-11-12 00:32 - 00001599 _____ C:\Documents and Settings\Administrator\Start Menu\Programs\Remote Assistance.lnk

2016-08-23 15:45 - 2016-08-23 15:45 - 00113980 _____ C:\WINDOWS\ntbtlog.txt

2016-08-23 15:43 - 2016-08-23 15:38 - 01746432 _____ (Farbar) C:\Documents and Settings\Kevin Gilhooly\Desktop\FRST.exe

2016-08-23 15:40 - 2016-08-23 15:41 - 00000000 ____D C:\FRST

2016-08-19 15:42 - 2008-04-14 00:17 - 00025856 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbprint.sys

2016-08-19 15:42 - 2008-04-14 00:17 - 00025856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbprint.sys

2016-08-15 10:42 - 2016-08-15 10:42 - 144884648 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2016-08-15 10:42 - 2016-08-15 10:42 - 00000000 ____D C:\WINDOWS\system32\MRT

2016-08-15 07:59 - 2016-08-15 07:59 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB974571$

2016-08-15 07:59 - 2016-08-15 07:59 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862152$

2016-08-15 07:59 - 2016-08-15 07:59 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2592799$

2016-08-15 07:58 - 2016-08-15 07:58 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB977816$

2016-08-15 07:58 - 2016-08-15 07:58 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB975560$

2016-08-15 07:58 - 2016-08-15 07:58 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB973507$

2016-08-15 07:58 - 2016-08-15 07:58 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$

2016-08-15 07:58 - 2016-08-15 07:58 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2770660$

2016-08-15 07:58 - 2016-08-15 07:58 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2535512$

2016-08-15 07:57 - 2016-08-15 07:57 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB952287$

2016-08-15 07:57 - 2016-08-15 07:57 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB950762$

2016-08-15 07:57 - 2016-08-15 07:57 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876331$

2016-08-15 07:57 - 2016-08-15 07:57 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$

2016-08-15 07:57 - 2016-08-15 07:57 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2807986$

2016-08-15 07:57 - 2016-08-15 07:57 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2570947$

2016-08-15 07:56 - 2016-08-15 07:56 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB978695_WM9$

2016-08-15 07:56 - 2016-08-15 07:56 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB973904$

2016-08-15 07:56 - 2016-08-15 07:56 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2868038$

2016-08-15 07:56 - 2016-08-15 07:56 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2820917$

2016-08-15 07:56 - 2016-08-15 07:56 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2603381$

2016-08-15 07:55 - 2016-08-15 07:55 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB973540_WM9$

2016-08-15 07:55 - 2016-08-15 07:55 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2893294$

2016-08-15 07:55 - 2016-08-15 07:55 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2757638$

2016-08-15 07:55 - 2016-08-15 07:55 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2653956$

2016-08-15 07:55 - 2016-08-15 07:55 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2508429$

2016-08-15 07:55 - 2016-08-15 07:55 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2419632$

2016-08-15 07:54 - 2016-08-15 07:54 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB974392$

2016-08-15 07:54 - 2016-08-15 07:54 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB971029$

2016-08-15 07:54 - 2016-08-15 07:54 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2879017$

2016-08-15 07:54 - 2016-08-15 07:54 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2749655$

2016-08-15 07:54 - 2016-08-15 07:54 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2506212$

2016-08-15 07:53 - 2016-08-15 07:53 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB977914$

2016-08-15 07:53 - 2016-08-15 07:53 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB952069_WM9$

2016-08-15 07:53 - 2016-08-15 07:53 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2892075$

2016-08-15 07:53 - 2016-08-15 07:53 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2803821-v2_WM9$

2016-08-15 07:53 - 2016-08-15 07:53 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2698365$

2016-08-15 07:53 - 2016-08-15 07:53 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2619339$

2016-08-15 07:52 - 2016-08-15 07:52 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB979482$

2016-08-15 07:52 - 2016-08-15 07:52 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB979309$

2016-08-15 07:52 - 2016-08-15 07:52 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB978542$

2016-08-15 07:52 - 2016-08-15 07:52 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2727528$

2016-08-15 07:52 - 2016-08-15 07:52 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2705219-v2$

2016-08-15 07:51 - 2016-08-15 07:51 - 00000000 __SHD C:\Documents and Settings\LocalService\IETldCache

2016-08-15 07:51 - 2016-08-15 07:51 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB981997$

2016-08-15 07:51 - 2016-08-15 07:51 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB973815$

2016-08-15 07:51 - 2016-08-15 07:51 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB960803$

2016-08-15 07:51 - 2016-08-15 07:51 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2934207$

2016-08-15 07:51 - 2016-08-15 07:51 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862330$

2016-08-15 07:51 - 2016-08-15 07:51 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2723135-v2$

2016-08-15 07:50 - 2016-08-15 07:50 - 00000000 __SHD C:\Documents and Settings\Kevin Gilhooly\IETldCache

2016-08-15 07:50 - 2016-08-15 07:50 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2813345$

2016-08-15 07:50 - 2016-08-15 07:50 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2676562$

2016-08-15 07:50 - 2016-08-15 07:50 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2509553$

2016-08-15 07:50 - 2016-08-15 07:50 - 00000000 ___RD C:\Documents and Settings\Kevin Gilhooly\My Documents\My Pictures

2016-08-15 07:49 - 2016-08-15 07:49 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB982665$

2016-08-15 07:49 - 2016-08-15 07:49 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2620712$

2016-08-15 07:49 - 2016-08-15 07:49 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2478960$

2016-08-15 07:49 - 2016-08-15 07:49 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2393802$

2016-08-15 07:48 - 2016-08-15 07:48 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB975467$

2016-08-15 07:48 - 2016-08-15 07:48 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB968389$

2016-08-15 07:48 - 2016-08-15 07:48 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2914368$

2016-08-15 07:48 - 2016-08-15 07:48 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2661637$

2016-08-15 07:48 - 2016-08-15 07:48 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2584146$

2016-08-15 07:48 - 2016-08-15 07:48 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2566454$

2016-08-15 07:48 - 2016-08-15 07:48 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2423089$

2016-08-15 07:17 - 2016-08-23 15:38 - 00000240 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job

2016-08-15 07:17 - 2016-08-15 10:41 - 00000234 _____ C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job

2016-08-15 07:16 - 2016-08-19 16:04 - 00000408 ____H C:\WINDOWS\Tasks\{F897AA24-BDC3-11D1-B85B-00C04FB93981}_KEVGIL_Kevin Gilhooly.job

2016-08-15 07:13 - 2016-08-15 07:13 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB952954$

2016-08-15 07:13 - 2016-08-15 07:13 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB951376-v2$

2016-08-15 07:13 - 2016-08-15 07:13 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2922229$

2016-08-15 07:13 - 2016-08-15 07:13 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2868626$

2016-08-15 07:12 - 2016-08-15 07:49 - 00065536 _____ C:\WINDOWS\system32\config\Internet.evt

2016-08-15 07:12 - 2016-08-15 07:12 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB959426$

2016-08-15 07:11 - 2016-08-23 15:39 - 00000431 _____ C:\WINDOWS\system32\Drivers\etc\hosts.ics

2016-08-15 07:10 - 2016-08-15 07:12 - 00000000 __HDC C:\WINDOWS\ie8

2016-08-15 07:09 - 2016-08-15 07:09 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB960859$

2016-08-15 07:09 - 2016-08-15 07:09 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB946648$

2016-08-15 07:09 - 2016-08-15 07:09 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2712808$

2016-08-15 07:09 - 2016-08-15 07:09 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2479943$

2016-08-15 07:09 - 2016-08-15 07:09 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2387149$

2016-08-15 07:08 - 2016-08-15 07:08 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2916036$

2016-08-15 07:08 - 2016-08-15 07:08 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834886$

2016-08-15 07:08 - 2016-08-15 07:08 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2659262$

2016-08-15 07:08 - 2016-08-15 07:08 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2564958$

2016-08-15 07:08 - 2016-08-15 07:08 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2544893-v2$

2016-08-15 07:08 - 2016-08-15 07:08 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2478971$

2016-08-15 07:07 - 2016-08-15 07:07 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2900986$

2016-08-15 07:07 - 2016-08-15 07:07 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2691442$

2016-08-15 07:07 - 2016-08-15 07:07 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2631813$

2016-08-15 07:07 - 2016-08-15 07:07 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2585542$

2016-08-15 07:07 - 2016-08-15 07:07 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2536276-v2$

2016-08-15 07:07 - 2016-08-15 07:07 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2296011$

2016-08-15 07:06 - 2016-08-15 07:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB975558_WM8$

2016-08-15 07:06 - 2016-08-15 07:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB974318$

2016-08-15 07:06 - 2016-08-15 07:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB955759$

2016-08-15 07:06 - 2016-08-15 07:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2847311$

2016-08-15 07:06 - 2016-08-15 07:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2378111_WM9$

2016-08-15 07:06 - 2016-08-15 07:06 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2115168$

2016-08-15 07:05 - 2016-08-15 07:05 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB969059$

2016-08-15 07:05 - 2016-08-15 07:05 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB951978$

2016-08-15 07:05 - 2016-08-15 07:05 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2802968$

2016-08-15 07:05 - 2016-08-15 07:05 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2655992$

2016-08-15 07:05 - 2016-08-15 07:05 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2443105$

2016-08-15 07:04 - 2016-08-15 07:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB975713$

2016-08-15 07:04 - 2016-08-15 07:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB950974$

2016-08-15 07:04 - 2016-08-15 07:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2898715$

2016-08-15 07:04 - 2016-08-15 07:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2598479$

2016-08-15 07:04 - 2016-08-15 07:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2481109$

2016-08-15 07:04 - 2016-08-15 07:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2229593$

2016-08-15 07:03 - 2016-08-15 07:03 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB982132$

2016-08-15 07:03 - 2016-08-15 07:03 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB978338$

2016-08-15 07:03 - 2016-08-15 07:03 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB971657$

2016-08-15 07:03 - 2016-08-15 07:03 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2929961$

2016-08-15 07:03 - 2016-08-15 07:03 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862335$

2016-08-15 07:03 - 2016-08-15 07:03 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2686509$

2016-08-15 07:02 - 2016-08-15 07:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB972270$

2016-08-15 07:02 - 2016-08-15 07:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB954155_WM9$

2016-08-15 07:02 - 2016-08-15 07:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2909212$

2016-08-15 07:02 - 2016-08-15 07:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2780091$

2016-08-15 07:02 - 2016-08-15 07:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2510581$

2016-08-15 07:02 - 2016-08-15 07:02 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2507938$

2016-08-15 07:01 - 2016-08-15 07:01 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB974112$

2016-08-15 07:01 - 2016-08-15 07:01 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB956572$

2016-08-15 07:01 - 2016-08-15 07:01 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2904266$

2016-08-15 07:01 - 2016-08-15 07:01 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2876217$

2016-08-15 07:01 - 2016-08-15 07:01 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2347290$

2016-08-15 07:00 - 2016-08-15 07:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB979687$

2016-08-15 07:00 - 2016-08-15 07:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB975025$

2016-08-15 07:00 - 2016-08-15 07:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB973869$

2016-08-15 07:00 - 2016-08-15 07:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB956844$

2016-08-15 07:00 - 2016-08-15 07:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2930275$

2016-08-15 07:00 - 2016-08-15 07:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2864063$

2016-08-15 07:00 - 2016-08-15 07:00 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2483185$

2016-08-15 06:59 - 2016-08-15 06:59 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB952004$

2016-08-15 06:59 - 2016-08-15 06:59 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2719985$

2016-08-14 21:50 - 2008-06-13 12:05 - 00272128 ____N (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bthport.sys

2016-08-14 21:50 - 2008-06-13 12:05 - 00272128 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\bthport.sys

2016-08-14 21:47 - 2011-07-15 14:29 - 00456320 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\mrxsmb.sys

2016-08-14 21:40 - 2013-07-03 03:12 - 00025088 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\hidparse.sys

2016-08-14 21:40 - 2013-07-03 02:59 - 00014976 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbscan.sys

2016-08-14 21:36 - 2013-07-17 01:58 - 00123008 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbvideo.sys

2016-08-14 21:36 - 2013-07-17 01:58 - 00060160 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbaudio.sys

2016-08-14 21:36 - 2013-02-12 01:32 - 00012928 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usb8023x.sys

2016-08-14 21:32 - 2014-02-26 02:59 - 00013312 ____N (Microsoft Corporation) C:\WINDOWS\system32\xp_eos.exe

2016-08-14 21:32 - 2014-02-26 02:59 - 00013312 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\xp_eos.exe

2016-08-14 21:29 - 2013-08-09 01:55 - 00032384 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbccgp.sys

2016-08-14 21:29 - 2013-08-09 01:55 - 00005376 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\usbd.sys

2016-08-14 21:27 - 2013-07-04 04:03 - 02149888 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ntkrnlmp.exe

2016-08-14 21:27 - 2013-07-04 03:59 - 02193536 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ntoskrnl.exe

2016-08-14 21:27 - 2013-07-04 03:08 - 02070144 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ntkrnlpa.exe

2016-08-14 21:27 - 2013-07-04 03:08 - 02028544 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\ntkrpamp.exe

2016-08-14 21:25 - 2012-01-11 20:06 - 00003072 ____N C:\WINDOWS\system32\iacenc.dll

2016-08-14 21:25 - 2012-01-11 20:06 - 00003072 ____C C:\WINDOWS\system32\dllcache\iacenc.dll

2016-08-14 21:20 - 2016-08-15 07:13 - 00000000 ___HD C:\WINDOWS\$hf_mig$

2016-08-14 21:20 - 2016-08-14 21:20 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB898461$

2016-08-14 21:20 - 2016-08-14 21:20 - 00000000 ____D C:\WINDOWS\system32\PreInstall

2016-08-14 21:20 - 2009-01-07 18:21 - 00026144 _____ (Microsoft Corporation) C:\WINDOWS\system32\spupdsvc.exe

2016-08-14 21:20 - 2009-01-07 18:20 - 00016928 ____N (Microsoft Corporation) C:\WINDOWS\system32\spmsg.dll

2016-08-13 20:35 - 2016-08-13 20:35 - 00012328 _____ C:\Documents and Settings\Kevin Gilhooly\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2016-08-13 20:34 - 2016-08-13 20:34 - 00001607 _____ C:\Documents and Settings\All Users\Desktop\Dodo Mobile.lnk

2016-08-13 20:34 - 2016-08-13 20:34 - 00000000 ____D C:\Program Files\Dodo Mobile

2016-08-13 20:34 - 2016-08-13 20:34 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Dodo Mobile

2016-08-13 20:34 - 2013-06-18 11:31 - 00134144 _____ (TCT International Mobile Ltd.) C:\WINDOWS\system32\Drivers\AlcatelOTDCWwan.sys

2016-08-13 20:34 - 2013-06-18 11:31 - 00107904 _____ (TCT International Mobile Ltd.) C:\WINDOWS\system32\Drivers\jrdusbser.sys

2016-08-13 20:34 - 2008-04-14 00:10 - 00057600 ____C (Microsoft Corporation) C:\WINDOWS\system32\dllcache\redbook.sys

2016-08-13 20:34 - 2008-04-14 00:10 - 00057600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\redbook.sys

2016-08-13 18:05 - 2016-08-13 18:05 - 00000000 ____D C:\Documents and Settings\Kevin Gilhooly\Application Data\Adobe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-23 15:46 - 2008-11-11 16:23 - 00000000 ____D C:\Documents and Settings

2016-08-23 15:44 - 2009-02-22 05:21 - 00000178 ___SH C:\Documents and Settings\Kevin Gilhooly\ntuser.ini

2016-08-23 15:44 - 2008-11-12 00:47 - 00001709 _____ C:\WINDOWS\system32\Config.MPF

2016-08-23 15:44 - 2008-11-12 00:35 - 00009512 _____ C:\WINDOWS\SchedLgU.Txt

2016-08-23 15:44 - 2008-11-12 00:35 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2016-08-23 15:43 - 2009-02-22 05:21 - 00000000 ____D C:\Documents and Settings\Kevin Gilhooly\Local Settings\Temp

2016-08-23 15:38 - 2008-11-11 23:11 - 00001158 _____ C:\WINDOWS\system32\wpa.dbl

2016-08-19 15:42 - 2008-11-11 16:18 - 00000000 RSHDC C:\WINDOWS\system32\dllcache

2016-08-15 10:57 - 2008-11-12 00:43 - 00002431 _____ C:\Documents and Settings\All Users\Desktop\Samsung Network Manager.lnk

2016-08-15 10:57 - 2008-11-11 16:18 - 00000000 ___HD C:\WINDOWS\inf

2016-08-15 07:52 - 2008-11-12 00:30 - 00000000 ____D C:\Program Files\Outlook Express

2016-08-15 07:52 - 2008-11-12 00:30 - 00000000 ____D C:\Program Files\Movie Maker

2016-08-15 07:51 - 2009-02-22 05:21 - 00000803 _____ C:\Documents and Settings\Kevin Gilhooly\Start Menu\Programs\Internet Explorer.lnk

2016-08-15 07:51 - 2008-11-12 00:35 - 00000000 __SHD C:\Documents and Settings\LocalService

2016-08-15 07:50 - 2009-02-22 05:21 - 00000000 ___RD C:\Documents and Settings\Kevin Gilhooly\My Documents\My Music

2016-08-15 07:50 - 2009-02-22 05:21 - 00000000 ___RD C:\Documents and Settings\Kevin Gilhooly\My Documents

2016-08-15 07:50 - 2009-02-22 05:21 - 00000000 ____D C:\Documents and Settings\Kevin Gilhooly

2016-08-15 07:50 - 2008-11-11 16:23 - 00090296 _____ C:\WINDOWS\system32\FNTCACHE.DAT

2016-08-15 07:50 - 2008-11-11 16:18 - 00000000 ____D C:\WINDOWS\Help

2016-08-15 07:18 - 2008-11-11 16:24 - 00355944 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2016-08-15 07:17 - 2008-11-11 16:18 - 00000000 ____D C:\WINDOWS\security

2016-08-15 07:13 - 2008-11-11 16:24 - 00001374 _____ C:\WINDOWS\imsins.BAK

2016-08-15 07:12 - 2008-11-11 16:18 - 00000000 ____D C:\WINDOWS\Media

2016-08-15 07:09 - 2008-11-12 00:28 - 00000000 ____D C:\Program Files\Messenger

2016-08-13 22:08 - 2008-11-12 00:43 - 00000000 ____D C:\WINDOWS\WinClon

2016-08-13 20:58 - 2008-11-12 00:29 - 00000000 ___RD C:\Documents and Settings\All Users\Start Menu\Programs\Games

2016-08-13 20:58 - 2008-11-12 00:28 - 00000000 ____D C:\Program Files\Windows NT

2016-08-13 17:44 - 2008-11-12 00:44 - 00000000 ____D C:\Program Files\McAfee

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed

C:\WINDOWS\system32\winlogon.exe => File is digitally signed

C:\WINDOWS\system32\svchost.exe => File is digitally signed

C:\WINDOWS\system32\services.exe => File is digitally signed

C:\WINDOWS\system32\User32.dll => File is digitally signed

C:\WINDOWS\system32\userinit.exe => File is digitally signed

C:\WINDOWS\system32\rpcss.dll => File is digitally signed

C:\WINDOWS\system32\dnsapi.dll => File is digitally signed

C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End of FRST.txt ============================

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 21-08-2016 01

Ran by Administrator (23-08-2016 18:51:07)

Running from E:\

Microsoft Windows XP Home Edition Service Pack 3 (X86) (2009-02-22 04:21:11)

Boot Mode: Safe Mode (minimal)

==========================================================

==================== Accounts: =============================

Administrator (S-1-5-21-2277594783-1135049707-4067570145-500 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Administrator

Guest (S-1-5-21-2277594783-1135049707-4067570145-501 - Limited - Enabled)

HelpAssistant (S-1-5-21-2277594783-1135049707-4067570145-1004 - Limited - Disabled)

Kevin Gilhooly (S-1-5-21-2277594783-1135049707-4067570145-1005 - Administrator - Enabled) => %SystemDrive%\Documents and Settings\Kevin Gilhooly

SUPPORT_388945a0 (S-1-5-21-2277594783-1135049707-4067570145-1002 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: McAfee VirusScan (Disabled - Out of date) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Personal Firewall (Disabled) {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 9.0.124.0 - Adobe Systems Incorporated)

Adobe Reader 8.1.2 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A81200000003}) (Version: 8.1.2 - Adobe Systems Incorporated)

Atheros WLAN Client (HKLM\...\{F4F41D14-E0DD-4FB4-AA09-A14225C769BD}) (Version: 18.00.0000 - WLAN)

Dodo Mobile (HKLM\...\Dodo_Australia Flame Dodo Mobile_is1) (Version: - Dodo_Australia)

Easy Display Manager (HKLM\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 2.0.0.0 - Samsung)

imagine digital freedom - Samsung (HKLM\...\{8E106A57-A17E-431D-B48F-175E42EB9F74}) (Version: 1.0.2.2 - Samsung Electronics Co. Ltd.,)

Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - )

J2SE Runtime Environment 5.0 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0150000}) (Version: 1.5.0 - Sun Microsystems, Inc.)

Magic Keyboard (HKLM\...\{BD723E53-A42C-4702-AA04-1D74A0311590}) (Version: 7.0.2.0 - )

Marvell Miniport Driver (HKLM\...\Marvell Miniport Driver) (Version: 10.62.1.3 - Marvell)

McAfee SecurityCenter (HKLM\...\MSC) (Version: - McAfee, Inc.)

MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)

MSXML 4.0 SP2 Parser and SDK (HKLM\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)

Namuga 1.3M Webcam (HKLM\...\{71A51B59-E7D3-11DB-A386-005056C00008}) (Version: 1.00.0000 - Vimicro Corporation)

Play Camera (HKLM\...\InstallShield_{7B46F9CF-CF60-492E-816E-95EB1A9D1BB4}) (Version: 2.0.0.13 - Samsung Electronics)

Play Camera (Version: 2.0.0.13 - Samsung Electronics) Hidden

Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 5.10.0.5693 - Realtek Semiconductor Corp.)

Samsung Battery Manager (HKLM\...\{6F730513-8688-4C3C-90A3-6B9792CE2EF3}) (Version: 1.00 - )

Samsung EDS (HKLM\...\{ABB14904-A11B-4F42-996C-80FD608A0F17}) (Version: 1.00.0000 - Samsung Electronics)

Samsung Magic Doctor (HKLM\...\{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}) (Version: 4.00 - )

Samsung Network Manager 2.0 (HKLM\...\InstallShield_{DEA48EFD-22C1-4CD6-B887-EB2E6B2E4735}) (Version: 2.0.5.0 - Samsung)

Samsung Network Manager 2.0 (Version: 2.0.5.0 - Samsung) Hidden

Samsung Recovery Solution III (HKLM\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 3.0.0.6 - Samsung)

Samsung Update Plus (HKLM\...\InstallShield_{685707A4-911C-468D-BFC4-64A50E5E3A0C}) (Version: 1.2.0.13 - Samsung Electronics Co., LTD)

Samsung Update Plus (Version: 1.2.0.13 - Samsung Electronics Co., LTD) Hidden

Samsung Wallpaper (HKLM\...\{5CBB720F-08E6-4043-B83F-76C277AF6DE7}) (Version: 2.0.0.0 - Samsung Electronics)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 11.1.3.2 - Synaptics)

User Guide (HKLM\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.0 - )

WebFldrs XP (Version: 9.50.7523 - Microsoft Corporation) Hidden

WIDCOMM Bluetooth Software (HKLM\...\{84814E6B-2581-46EC-926A-823BD1C670F6}) (Version: 5.1.0.3300 - )

Windows Internet Explorer 8 (HKLM\...\ie8) (Version: 20090308.140743 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\WINDOWS\Tasks\McDefragTask.job => c:\PROGRA~1\mcafee\mqc\QcConsol.exe C:\WINDOWS\system32\defrag.exe

Task: C:\WINDOWS\Tasks\McQcTask.job => c:\PROGRA~1\mcafee\mqc\QcConsol.exe

Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Logon.job => C:\WINDOWS\system32\xp_eos.exe

Task: C:\WINDOWS\Tasks\Microsoft Windows XP End of Service Notification Monthly.job => C:\WINDOWS\system32\xp_eos.exe

Task: C:\WINDOWS\Tasks\{F897AA24-BDC3-11D1-B85B-00C04FB93981}_KEVGIL_Kevin Gilhooly.job => C:\WINDOWS\system32\mobsync.exe

==================== Shortcuts =============================

(The entries could be listed to be restored or removed.)

==================== Loaded Modules (Whitelisted) ==============

==================== Alternate Data Streams (Whitelisted) =========

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" value will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm => ""="Service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nm.sys => ""="Driver"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="1"

==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)

==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2008-11-11 23:11 - 2008-04-14 13:00 - 00000734 ____A C:\WINDOWS\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2277594783-1135049707-4067570145-500\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\Web\Wallpaper\SamsungWallpaper.bmp

DNS Servers: Media is not connected to internet.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

StandardProfile\AuthorizedApplications: [C:\Program Files\Internet Explorer\IEXPLORE.EXE] => Enabled:Internet Explorer

StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\dpvsetup.exe] => Enabled:Microsoft DirectPlay Voice Test

StandardProfile\AuthorizedApplications: [C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe] => Enabled:McAfee Network Agent

StandardProfile\AuthorizedApplications: [C:\WINDOWS\system32\sessmgr.exe] => Disabled:@xpsp2res.dll,-22019

DomainProfile\GloballyOpenPorts: [139:TCP] => Enabled:@xpsp2res.dll,-22004

DomainProfile\GloballyOpenPorts: [445:TCP] => Enabled:@xpsp2res.dll,-22005

DomainProfile\GloballyOpenPorts: [137:UDP] => Enabled:@xpsp2res.dll,-22001

DomainProfile\GloballyOpenPorts: [138:UDP] => Enabled:@xpsp2res.dll,-22002

StandardProfile\GloballyOpenPorts: [1900:UDP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22007

StandardProfile\GloballyOpenPorts: [2869:TCP] => :LocalSubNet:Disabled:@xpsp2res.dll,-22008

StandardProfile\GloballyOpenPorts: [139:TCP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22004

StandardProfile\GloballyOpenPorts: [445:TCP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22005

StandardProfile\GloballyOpenPorts: [137:UDP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22001

StandardProfile\GloballyOpenPorts: [138:UDP] => :LocalSubNet:Enabled:@xpsp2res.dll,-22002

==================== Restore Points =========================

13-08-2016 18:24:49 System Checkpoint

14-08-2016 21:20:48 Software Distribution Service 3.0

15-08-2016 07:47:52 Software Distribution Service 3.0

15-08-2016 10:42:18 Software Distribution Service 3.0

19-08-2016 16:06:46 System Checkpoint

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (08/23/2016 03:42:34 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application frst.exe, version 21.8.2016.1, faulting module frst.exe, version 21.8.2016.1, fault address 0x0002108d.

Processing media-specific event for [frst.exe!ws!]

System errors:

=============

Error: (08/23/2016 06:47:16 PM) (Source: DCOM) (EventID: 10005) (User: KEVGIL)

Description: DCOM got error "%%1084 = This service cannot be started in Safe Mode" attempting to start the service StiSvc with arguments ""

in order to run the server:

{A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error: (08/23/2016 03:48:48 PM) (Source: DCOM) (EventID: 10005) (User: KEVGIL)

Description: DCOM got error "%%1084 = This service cannot be started in Safe Mode" attempting to start the service StiSvc with arguments ""

in order to run the server:

{A1F4E726-8CF1-11D1-BF92-0060081ED811}

Error: (08/23/2016 03:47:58 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)

Description: DCOM got error "%%1084 = This service cannot be started in Safe Mode" attempting to start the service McNASvc with arguments ""

in order to run the server:

{24F616A1-B755-4053-8018-C3425DC8B68A}

Error: (08/23/2016 03:47:57 PM) (Source: DCOM) (EventID: 10005) (User: NT AUTHORITY)

Description: DCOM got error "%%1084 = This service cannot be started in Safe Mode" attempting to start the service McNASvc with arguments ""

in order to run the server:

{24F616A1-B755-4053-8018-C3425DC8B68A}

Error: (08/23/2016 03:47:21 PM) (Source: DCOM) (EventID: 10005) (User: KEVGIL)

Description: DCOM got error "%%1084 = This service cannot be started in Safe Mode" attempting to start the service netman with arguments ""

in order to run the server:

{BA126AE5-2166-11D1-B1D0-00805FC1270E}

Error: (08/23/2016 03:47:08 PM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: The following boot-start or system-start driver(s) failed to load:

AFD

Fips

intelppm

IPSec

mfehidk

MPFP

MRxSmb

NetBIOS

NetBT

RasAcd

Rdbss

Tcpip

Tcpip6

Error: (08/23/2016 03:47:08 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error:

%%31 = A device attached to the system is not functioning.

Error: (08/23/2016 03:47:08 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The IPv6 Helper Service service depends on the Microsoft IPv6 Protocol Driver service which failed to start because of the following error:

%%31 = A device attached to the system is not functioning.

Error: (08/23/2016 03:47:08 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error:

%%31 = A device attached to the system is not functioning.

Error: (08/23/2016 03:47:08 PM) (Source: Service Control Manager) (EventID: 7001) (User: )

Description: The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error:

%%31 = A device attached to the system is not functioning.

==================== Memory info ===========================

Processor: Intel® Atom™ CPU N270 @ 1.60GHz

Percentage of memory in use: 18%

Total physical RAM: 1014.36 MB

Available physical RAM: 822.74 MB

Total Virtual: 2445.19 MB

Available Virtual: 2352.47 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:71.04 GB) (Free:65.38 GB) NTFS ==>[drive with boot components (Windows XP)]

Drive d: () (Fixed) (Total:72 GB) (Free:35.51 GB) NTFS

Drive e: (TRANSCEND) (Removable) (Total:7.53 GB) (Free:7.53 GB) FAT32

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (Size: 149.1 GB) (Disk ID: AA0213BA)

Partition 1: (Not Active) - (Size=6 GB) - (Type=12)

Partition 2: (Active) - (Size=71 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=72 GB) - (Type=07 NTFS)

========================================================

Disk: 1 (MBR Code: Windows XP) (Size: 7.5 GB) (Disk ID: C3072E18)

Partition 1: (Active) - (Size=7.5 GB) - (Type=0B)

==================== End of Addition.txt ============================

#2
Jr0x

Posted 28 August 2016 - 09:51 AM

Malware removal team

Malware Removal
1,830 posts

Hi clusta,

Welcome to :welcome:

. My name is Jr0x and I'll be helping you with your problem.

Please Note: I am still in training and my fixes have to be approved by my instructor so there may be a slight delay in my replies. Look upon it as a good thing though in that you have two people looking at your problem.

Before we get started, there are a few things I need you to take note of.

Please read through the instructions before attempting to follow those procedures. I would recommend printing them out as some of the instructions would requires you to be in safe mode / offline.
If there is anything you are unclear of, please ask before you start the fix.
Do not run any scripts / tools on your own, unsupervised usage may cause more harm than good.
Please stay with me on this thread, do not start another thread in here (Geeks To Go) or any other forum until I've declared you clean and good to go.
There may be delayed response to you as we may live in different timezone.
Inform me of anything that happens unexpectedly during the fix at any point of time.
As much as we like to make this a easy process for you. Malware removal is a complex multi-step process, and things may happen such as data loss or render your machine unbootable. I would recommend that you backup your personal data before we proceed.
Posts that are not replied to in four (4) days will result in the topic being closed. We have not forgotten you; this is just an effort to keep the boards organized and flowing. To continue on your closed topic, please PM me or any Moderator to have the topic reactivated. If, at any time during our working together, I have not responded to you in 2 days (48 hours), then please PM me.
Please do not attach any log files to your replies unless I specifically ask you. Instead please copy and paste so as to include the log in your reply. You can do this in separate posts if it's easier for you.
As we go along please tell me how the computer is running now. Please be as descriptive as possible e.g. I'm still getting web redirects, I am unable to access the internet etc.

Let's get started.

am still unable to get any sort of any network connection to the internet. It is a strange co-incidence, but at the same time both devices were infected, my phone line has also experienced a fault, and is no longer working. According to my phone line provider, the fault is due to be fixed within the next 24 hours.

As I can see from your log, did you boot into Safe Mode knowingly or you are not able to boot into normal mode?

If you are in Safe Mode without network, then you will not be able to connect to internet be it through LAN or wireless.

As for your phone line, are you referring to your Internet Service Provider (ISP). If you are not sure what ISP is, it's the company that you subscribed to for your internet connection.

Since your log is a couple of day old, I would require you to post a more updated log and in normal mode if that is possible. Do note that you are required to run FRST from your Desktop.

Scan with Farbar's Recovery Scan Tool (FRST)

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
Press Scan button.
It will produce a log called FRST.txt in the same directory the tool is run from.
Please copy and paste log back here.
The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

Let me know if you are facing any issue following the instruction.

#3
clutsta

Posted 29 August 2016 - 05:14 PM

Member

Topic Starter
Member
28 posts

Hi there, yep ISP is my Internet Service Provider. I can boot in normal mode, but there's still absolutely zero access to any network connection.

FRST will not "run as". It comes up with an "Autolt Error - Unable to open the script file".

Here's a normal mode/Scan log below:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 21-08-2016 01

Ran by Kevin Gilhooly (administrator) on KEVGIL (29-08-2016 11:33:53)

Running from C:\Documents and Settings\Kevin Gilhooly\Desktop

Loaded Profiles: Kevin Gilhooly (Available Profiles: Kevin Gilhooly)

Platform: Microsoft Windows XP Home Edition Service Pack 3 (X86) Language: English (United States)

Internet Explorer Version 8 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

(Sun Microsystems, Inc.) C:\Program Files\Java\jre1.5.0\bin\jusched.exe

(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE

(Samsung Electronics,.LTD) C:\Program Files\Samsung\Samsung EDS\EDSAgent.exe

(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe

(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe

(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe

() C:\Program Files\Samsung\Samsung Battery Manager\BatteryManager.exe

(McAfee, Inc.) C:\Program Files\McAfee.com\Agent\mcagent.exe

() C:\Program Files\Dodo Mobile\BackgroundService\ModemListener.exe

(SAMSUNG Electronics) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

(SAMSUNG Electronics Co., Ltd.) C:\Program Files\Samsung\MagicKBD\MagicKBD.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\MagicKBD\PerformanceManager.exe

() C:\Program Files\Dodo Mobile\BackgroundService\ServiceManager.exe

(McAfee, Inc.) C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

(McAfee, Inc.) C:\PROGRA~1\COMMON~1\McAfee\MNA\McNASvc.exe

(McAfee, Inc.) C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe

(McAfee, Inc.) C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe

(McAfee, Inc.) C:\Program Files\McAfee\MPF\MpfSrv.exe

() C:\Program Files\Samsung\Samsung Network Manager\SNMWLANService.exe

(Intel Corporation) C:\WINDOWS\system32\igfxext.exe

(McAfee, Inc.) C:\PROGRA~1\McAfee\MSC\mcuimgr.exe

(McAfee, Inc.) C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe