Jump to content

JoeInOburg

Members
 View Profile  See their activity

  • Posts

    8

  • Joined

  • Last visited

 Content Type 

Posts posted by JoeInOburg

    Windows XP Recovery (?)

    in Resolved Malware Removal Logs

    Posted

    Thanks for your help, please see the logs below:

    MBAM LOG

    Malwarebytes' Anti-Malware 1.50.1.1100

    www.malwarebytes.org

    Database version: 5363

    Windows 5.1.2600 Service Pack 3 (Safe Mode)

    Internet Explorer 8.0.6001.18702

    5/26/2011 11:33:30 PM

    mbam-log-2011-05-26 (23-33-30).txt

    Scan type: Full scan (C:\|)

    Objects scanned: 277667

    Time elapsed: 39 minute(s), 35 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 0

    Registry Values Infected: 0

    Registry Data Items Infected: 1

    Folders Infected: 0

    Files Infected: 2

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    (No malicious items detected)

    Registry Keys Infected:

    (No malicious items detected)

    Registry Values Infected:

    (No malicious items detected)

    Registry Data Items Infected:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:

    (No malicious items detected)

    Files Infected:

    c:\downloads\scrabblesetup-dm[1].exe (Adware.TryMedia) -> Quarantined and deleted successfully.

    c:\documents and settings\joe and courtney.joeandcourtney\Desktop\uSeRiNiT.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.

    COMBO FIX LOG

    ComboFix 11-05-31.01 - Joe and Courtney 06/01/2011 5:34.3.1 - x86

    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.257 [GMT -4:00]

    Running from: c:\documents and settings\Joe and Courtney.JOEANDCOURTNEY\My Documents\Downloads\ComboFix.exe

    AV: Trend Micro PC-cillin Internet Security *Enabled/Outdated* {7D2296BC-32CC-4519-917E-52E652474AF5}

    FW: Trend Micro PC-cillin Internet Security (Firewall) *Enabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}

    * Created a new restore point

    .

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    ---- Previous Run -------

    .

    c:\documents and settings\All Users\Application Data\qMQfDeINnQ.exe

    c:\windows\system32\drivers\disdsubg.sys

    .

    Infected copy of c:\windows\system32\drivers\volsnap.sys was found and disinfected

    Restored copy from - Kitty had a snack :P

    .

    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    -------\Service_kfsk

    .

    .

    ((((((((((((((((((((((((( Files Created from 2011-05-01 to 2011-06-01 )))))))))))))))))))))))))))))))

    .

    .

    2011-06-01 02:30 . 2011-05-29 13:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

    2011-05-27 23:50 . 2011-05-27 23:50 529448 ----a-w- c:\windows\system32\PerfStringBackup.TMP

    2011-05-27 10:31 . 2011-05-27 10:49 -------- d-----w- C:\ComFix1

    2011-05-27 02:26 . 2011-05-27 02:26 -------- d-----w- c:\program files\CCleaner

    2011-05-27 01:08 . 2011-05-27 01:08 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2011-05-29 13:11 . 2009-11-01 02:19 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

    2011-03-27 01:39 . 2011-03-27 01:39 21425 ----a-w- c:\windows\system32\drivers\AegisP.sys

    2011-03-07 05:33 . 2004-08-10 19:02 692736 ---ha-w- c:\windows\system32\inetcomm.dll

    2011-03-04 06:37 . 2004-08-10 18:51 420864 ---ha-w- c:\windows\system32\vbscript.dll

    2011-03-03 13:21 . 2004-08-10 18:51 1857920 ---ha-w- c:\windows\system32\win32k.sys

    2008-02-28 00:49 . 2008-02-28 00:49 27976 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll

    2008-02-28 00:49 . 2008-02-28 00:49 125848 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll

    2008-02-28 00:49 . 2008-02-28 00:50 46408 ----a-w- c:\program files\mozilla firefox\plugins\atmccli.dll

    2008-02-28 00:50 . 2008-02-28 00:50 98712 ----a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-23 68856]

    "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]

    "qMQfDeINnQ"="c:\documents and settings\All Users\Application Data\qMQfDeINnQ.exe" [bU]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]

    "BuildBU"="c:\dell\bldbubg.exe" [2005-12-15 61440]

    "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]

    "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]

    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-19 421888]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

    "Malwarebytes' Anti-Malware"="c:\program files\1Malwarebytes' Anti-Malware\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]

    .

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

    "RunNarrator"="Narrator.exe" [2008-04-14 53760]

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk

    backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk

    backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^dlbcserv.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\dlbcserv.lnk

    backup=c:\windows\pss\dlbcserv.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

    backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk

    backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk

    backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk

    backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk

    backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WDDMStatus.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk

    backup=c:\windows\pss\WDDMStatus.lnkCommon Startup

    .

    [HKLM\~\startupfolder\C:^Documents and Settings^Joe and Courtney.JOEANDCOURTNEY^Start Menu^Programs^Startup^Logitech . Product Registration.lnk]

    path=c:\documents and settings\Joe and Courtney.JOEANDCOURTNEY\Start Menu\Programs\Startup\Logitech . Product Registration.lnk

    backup=c:\windows\pss\Logitech . Product Registration.lnkStartup

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

    c:\windows\system32\dumprep 0 -k [X]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]

    2004-09-13 22:33 155648 ----a-w- c:\program files\Apoint\Apoint.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]

    2009-10-07 11:14 323392 ----a-w- c:\program files\DNA\btdna.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]

    2005-09-01 23:24 684032 ----a-w- c:\program files\Dell\QuickSet\quickset.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]

    2007-03-15 15:09 460784 ----a-w- c:\program files\DellSupport\DSAgnt.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DIGServices]

    2005-10-31 16:18 101888 ----a-w- c:\program files\ESPNRunTime\DIGServices.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DIGStream]

    2005-10-31 16:05 278528 ----a-w- c:\program files\DIGStream\digstream.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]

    2004-12-06 07:05 127035 ----a-w- c:\windows\system32\dla\tfswctrl.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dscactivate]

    2007-11-15 14:24 16384 ----a-w- c:\program files\Dell Support Center\gs_agent\custom\dsca.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]

    2005-02-23 22:19 53248 ------w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]

    2006-05-10 00:24 50760 ----a-w- c:\program files\Common Files\AOL\1136593465\ee\aolsoftware.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

    2006-02-19 07:41 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]

    2007-02-21 15:17 970752 ----a-w- c:\program files\Intel\Wireless\Bin\iFrmewrk.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend]

    2006-02-17 16:59 124520 ----a-w- c:\program files\Common Files\AOL\IPHSend\IPHSend.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

    2005-06-10 16:44 249856 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

    2005-06-10 16:44 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

    2010-07-21 19:53 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Vid]

    2010-10-29 20:06 5915480 ----a-w- c:\program files\Logitech\Vid HD\Vid.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]

    2009-10-14 18:36 2793304 ----a-w- c:\program files\Logitech\Logitech WebCam Software\LWS.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]

    2005-09-09 01:20 8192 ----a-w- c:\progra~1\MUSICM~1\MUSICM~3\mimboot.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

    2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OE_OEM]

    2006-04-11 23:39 176201 ----a-w- c:\program files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pccguide.exe]

    2005-08-30 22:30 823362 ----a-w- c:\program files\Trend Micro\Internet Security 12\pccguide.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]

    2004-04-12 02:15 290816 ------w- c:\program files\Dell\Media Experience\PCMService.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

    2010-03-19 02:16 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sealmon]

    2007-04-03 21:52 296080 ----a-w- c:\program files\SealedMedia\sealmon.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

    2010-05-14 15:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

    2006-03-05 22:38 180269 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VerizonServicepoint.exe]

    2008-09-17 01:14 2065648 ----a-w- c:\program files\Verizon\VSP\VerizonServicepoint.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Verizon_McciTrayApp]

    2010-03-17 20:55 1565696 ----a-w- c:\program files\Verizon\McciTrayApp.exe

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

    "iPod Service"=3 (0x3)

    "WMPNetworkSvc"=3 (0x3)

    "idsvc"=3 (0x3)

    "WDDMService"=2 (0x2)

    "WDSC"=2 (0x2)

    "WDFME"=2 (0x2)

    "Viewpoint Manager Service"=2 (0x2)

    "LVPrcSrv"=2 (0x2)

    "ose"=3 (0x3)

    "McciCMService"=2 (0x2)

    "MDM"=2 (0x2)

    "JavaQuickStarterService"=2 (0x2)

    "IDriverT"=3 (0x3)

    "gusvc"=3 (0x3)

    "DSBrokerService"=3 (0x3)

    "Bonjour Service"=2 (0x2)

    "Apple Mobile Device"=2 (0x2)

    "Tmntsrv"=2 (0x2)

    "PcCtlCom"=2 (0x2)

    "tmproxy"=2 (0x2)

    "TmPfw"=2 (0x2)

    "winmgmt"=2 (0x2)

    "stisvc"=2 (0x2)

    "SharedAccess"=2 (0x2)

    "WudfSvc"=3 (0x3)

    "WebClient"=2 (0x2)

    "Themes"=2 (0x2)

    "TermService"=3 (0x3)

    "TapiSrv"=3 (0x3)

    "Schedule"=2 (0x2)

    "SCardSvr"=3 (0x3)

    "wscsvc"=2 (0x2)

    "SamSs"=2 (0x2)

    "seclogon"=2 (0x2)

    "RDSessMgr"=3 (0x3)

    "RasMan"=3 (0x3)

    "RasAuto"=3 (0x3)

    "ProtectedStorage"=2 (0x2)

    "WmdmPmSN"=3 (0x3)

    "SwPrv"=3 (0x3)

    "CiSvc"=3 (0x3)

    "PolicyAgent"=2 (0x2)

    "EapHost"=3 (0x3)

    "ERSvc"=2 (0x2)

    "TrkWks"=2 (0x2)

    "CryptSvc"=3 (0x3)

    "Browser"=2 (0x2)

    "ClipSrv"=3 (0x3)

    "wuauserv"=2 (0x2)

    "ALG"=3 (0x3)

    "clr_optimization_v2.0.50727_32"=3 (0x3)

    "Pml Driver HPZ12"=2 (0x2)

    "AOL ACS"=2 (0x2)

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]

    "DisableMonitoring"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]

    "DisableMonitoring"=dword:00000001

    .

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "%windir%\\system32\\sessmgr.exe"=

    "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=

    "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

    "c:\\Program Files\\America Online 9.0\\waol.exe"=

    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

    "c:\\Program Files\\Common Files\\AOL\\1136593465\\ee\\aolsoftware.exe"=

    "c:\\Program Files\\Common Files\\AOL\\1136593465\\ee\\aim6.exe"=

    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

    "c:\\Program Files\\DNA\\btdna.exe"=

    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

    "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

    "c:\\Program Files\\iPod\\bin\\iPodService.exe"=

    "c:\\Program Files\\Dell Photo Printer 720\\dlbcserv.exe"=

    "c:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"=

    "c:\\Program Files\\DellSupport\\DSAgnt.exe"=

    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

    "c:\\Program Files\\iTunes\\iTunes.exe"=

    "c:\\Program Files\\AIM\\aim.exe"=

    "c:\\Program Files\\Skype\\Phone\\Skype.exe"=

    "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

    "c:\\Program Files\\Logitech\\Vid HD\\Vid.exe"=

    .

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

    "12001:UDP"= 12001:UDP:SMART WebServer Handshake Multicast Port

    .

    R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [11/8/2009 10:01 PM 28552]

    R2 Tmfilter;Tmfilter;c:\windows\system32\drivers\tmxpflt.sys [8/30/2005 6:30 PM 205328]

    R2 Tmpreflt;Tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [8/30/2005 6:30 PM 36368]

    S1 iacsoumf;iacsoumf;\??\c:\windows\system32\drivers\iacsoumf.sys --> c:\windows\system32\drivers\iacsoumf.sys [?]

    S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2/15/2011 4:08 PM 11520]

    S4 Tmntsrv;Trend Micro Real-time Service;c:\progra~1\TRENDM~1\INTERN~1\Tmntsrv.exe [8/30/2005 6:30 PM 290889]

    S4 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe [8/30/2005 6:30 PM 585792]

    S4 tmproxy;Trend Micro Proxy Service;c:\progra~1\TRENDM~1\INTERN~1\tmproxy.exe [8/30/2005 6:30 PM 262215]

    S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [6/24/2008 4:47 PM 24652]

    S4 WDDMService;WDDMService;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [9/8/2010 11:41 AM 237056]

    S4 WDFME;WD File Management Engine;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDFME\WDFME.exe [9/8/2010 11:45 AM 1034752]

    S4 WDSC;WD File Management Shadow Engine;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSC.exe [9/8/2010 11:44 AM 484352]

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2011-03-23 c:\windows\Tasks\AppleSoftwareUpdate.job

    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

    .

    .

    ------- Supplementary Scan -------

    .

    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

    uStart Page = hxxp://www.google.com/

    uInternet Settings,ProxyOverride = *.local

    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

    Trusted Zone: kaspersky.com\www

    TCP: DhcpNameServer = 192.168.1.1 68.237.161.12

    FF - ProfilePath - c:\documents and settings\Joe and Courtney.JOEANDCOURTNEY\Application Data\Mozilla\Firefox\Profiles\4fa3wskl.default\

    FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/aol/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us&tb_uuid=100000000000000002&tb_oid=05-08-2010&tb_mrud=05-08-2010

    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com

    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&tb_uuid=100000000000000002&tb_oid=05-08-2010&tb_mrud=05-08-2010&query=

    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

    FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

    FF - Ext: AIM Toolbar: {c2f863cd-0429-48c7-bb54-db756a951760} - %profile%\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}

    FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false

    .

    .

    **************************************************************************

    .

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2011-06-01 05:45

    Windows 5.1.2600 Service Pack 3 NTFS

    .

    scanning hidden processes ...

    .

    scanning hidden autostart entries ...

    .

    scanning hidden files ...

    .

    scan completed successfully

    hidden files: 0

    .

    **************************************************************************

    .

    --------------------- DLLs Loaded Under Running Processes ---------------------

    .

    - - - - - - - > 'winlogon.exe'(828)

    c:\windows\system32\Ati2evxx.dll

    .

    Completion time: 2011-06-01 05:49:10

    ComboFix-quarantined-files.txt 2011-06-01 09:48

    .

    Pre-Run: 7,824,547,840 bytes free

    Post-Run: 7,864,619,008 bytes free

    .

    - - End Of File - - 2EA036CD10127EB43065A2DA8BED80A6

    DDS LOG

    .

    DDS (Ver_11-05-19.01) - NTFSx86

    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22

    Run by Joe and Courtney at 5:58:25 on 2011-06-01

    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.193 [GMT -4:00]

    .

    AV: Trend Micro PC-cillin Internet Security *Enabled/Outdated* {7D2296BC-32CC-4519-917E-52E652474AF5}

    FW: Trend Micro PC-cillin Internet Security (Firewall) *Enabled*

    .

    ============== Running Processes ===============

    .

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe -k DcomLaunch

    svchost.exe

    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

    C:\WINDOWS\system32\svchost.exe -k netsvcs

    svchost.exe

    svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

    C:\WINDOWS\system32\HPZipm12.exe

    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

    C:\WINDOWS\explorer.exe

    C:\Documents and Settings\Joe and Courtney.JOEANDCOURTNEY\Desktop\dds.scr

    C:\WINDOWS\system32\WSCRIPT.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

    uStart Page = hxxp://www.google.com/

    uInternet Settings,ProxyOverride = *.local

    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

    uURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll

    mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll

    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

    BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll

    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

    BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll

    BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files\aim toolbar\aimtb.dll

    BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll

    BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

    TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll

    uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

    uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup

    uRun: [qMQfDeINnQ] c:\documents and settings\all users\application data\qMQfDeINnQ.exe

    mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"

    mRun: [buildBU] c:\dell\bldbubg.exe

    mRun: [intelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"

    mRun: [intelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

    mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\1malwarebytes' anti-malware\malwarebytes' anti-malware\mbamgui.exe /install /silent

    dRunOnce: [RunNarrator] Narrator.exe

    IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe

    IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html

    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

    Trusted Zone: kaspersky.com\www

    DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemyfios.verizon.net/sdcCommon/download/FIOS/Verizon%20FiOS%20Installer.cab

    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

    DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} - hxxps://lowes.2020.net/planner/Core/Player/2020PlayerAX_Win32.cab

    DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} - hxxp://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB

    DPF: {2DEF4530-8CE6-41C9-84B6-A54536C90213} - hxxps://awreports.agencyworks.com/viewer9/activeXViewer/activexviewer.cab

    DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll

    DPF: {6F750202-1362-4815-A476-88533DE61D0C} - hxxp://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab

    DPF: {6F750203-1362-4815-A476-88533DE61D0C} - hxxp://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab

    DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} - hxxps://www.pieofny.com/Remote/msrdp.cab

    DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} - hxxps://ltc.ehansel.com/eHansel/ActiveX/arview2.cab

    DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} - hxxp://picture.vzw.com/activex/VerizonWirelessUploadControl.cab

    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

    DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

    DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://freetrial.webex.com/client/T26L/webex/ieatgpc.cab

    DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5787/mcfscan.cab

    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

    Notify: AtiExtEvent - Ati2evxx.dll

    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - c:\documents and settings\joe and courtney.joeandcourtney\application data\mozilla\firefox\profiles\4fa3wskl.default\

    FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/aol/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us&tb_uuid=100000000000000002&tb_oid=05-08-2010&tb_mrud=05-08-2010

    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com

    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&tb_uuid=100000000000000002&tb_oid=05-08-2010&tb_mrud=05-08-2010&query=

    FF - component: c:\documents and settings\joe and courtney.joeandcourtney\application data\mozilla\firefox\profiles\4fa3wskl.default\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}\components\MailUtil.dll

    FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll

    FF - plugin: c:\program files\canon\zoombrowser ex\program\NPCIG.dll

    FF - plugin: c:\program files\common files\motive\npMotive.dll

    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

    FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll

    FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll

    FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll

    FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll

    FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

    FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

    FF - Ext: AIM Toolbar: {c2f863cd-0429-48c7-bb54-db756a951760} - %profile%\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}

    .

    ---- FIREFOX POLICIES ----

    FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false

    .

    ============= SERVICES / DRIVERS ===============

    .

    R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-11-8 28552]

    R2 Tmfilter;Tmfilter;c:\windows\system32\drivers\tmxpflt.sys [2005-8-30 205328]

    R2 Tmpreflt;Tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2005-8-30 36368]

    S1 iacsoumf;iacsoumf;\??\c:\windows\system32\drivers\iacsoumf.sys --> c:\windows\system32\drivers\iacsoumf.sys [?]

    S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2011-2-15 11520]

    S4 Tmntsrv;Trend Micro Real-time Service;c:\progra~1\trendm~1\intern~1\Tmntsrv.exe [2005-8-30 290889]

    S4 TmPfw;Trend Micro Personal Firewall;c:\progra~1\trendm~1\intern~1\TmPfw.exe [2005-8-30 585792]

    S4 tmproxy;Trend Micro Proxy Service;c:\progra~1\trendm~1\intern~1\tmproxy.exe [2005-8-30 262215]

    S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-6-24 24652]

    S4 WDDMService;WDDMService;c:\program files\western digital\wd smartware\wd drive manager\WDDMService.exe [2010-9-8 237056]

    S4 WDFME;WD File Management Engine;c:\program files\western digital\wd smartware\front parlor\wdfme\WDFME.exe [2010-9-8 1034752]

    S4 WDSC;WD File Management Shadow Engine;c:\program files\western digital\wd smartware\front parlor\WDSC.exe [2010-9-8 484352]

    .

    =============== Created Last 30 ================

    .

    2011-06-01 02:30:32 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

    2011-05-27 23:50:02 529448 ----a-w- c:\windows\system32\PerfStringBackup.TMP

    2011-05-27 10:31:23 98816 ----a-w- c:\windows\sed.exe

    2011-05-27 10:31:23 518144 ----a-w- c:\windows\SWREG.exe

    2011-05-27 10:31:23 256512 ----a-w- c:\windows\PEV.exe

    2011-05-27 10:31:23 208896 ----a-w- c:\windows\MBR.exe

    2011-05-27 10:31:18 -------- d-----w- C:\ComFix1

    2011-05-27 02:26:18 -------- d-----w- c:\program files\CCleaner

    .

    ==================== Find3M ====================

    .

    2011-05-29 13:11:30 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

    2011-03-27 01:39:38 21425 ----a-w- c:\windows\system32\drivers\AegisP.sys

    2011-03-07 05:33:50 692736 ---ha-w- c:\windows\system32\inetcomm.dll

    2011-03-04 06:37:06 420864 ---ha-w- c:\windows\system32\vbscript.dll

    2011-03-03 13:21:11 1857920 ---ha-w- c:\windows\system32\win32k.sys

    .

    ============= FINISH: 5:59:07.40 ===============

    Thanks for your help!

    Windows XP Recovery (?)

    in Resolved Malware Removal Logs

    Posted

    Nasty Windows XP Recovery infection, tried instructions on cleaning and fixing posted on the forums. Problems seem to be persisting

    Below are the mabm and dds logs and attached is the ark.txt and attach.txt files as per the instructions.

    I've had success with the users here before, so any assistance is GREATLY appreciated.

    MBAM Log:

    Malwarebytes' Anti-Malware 1.50.1.1100

    www.malwarebytes.org

    Database version: 6726

    Windows 5.1.2600 Service Pack 3

    Internet Explorer 8.0.6001.18702

    5/30/2011 3:59:06 PM

    mbam-log-2011-05-30 (15-59-06).txt

    Scan type: Quick scan

    Objects scanned: 198952

    Time elapsed: 6 minute(s), 7 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 0

    Registry Values Infected: 0

    Registry Data Items Infected: 0

    Folders Infected: 0

    Files Infected: 0

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    (No malicious items detected)

    Registry Keys Infected:

    (No malicious items detected)

    Registry Values Infected:

    (No malicious items detected)

    Registry Data Items Infected:

    (No malicious items detected)

    Folders Infected:

    (No malicious items detected)

    Files Infected:

    (No malicious items detected)

    DDS Log:

    .

    DDS (Ver_11-05-19.01) - NTFSx86

    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22

    Run by Joe and Courtney at 16:38:02 on 2011-05-30

    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.182 [GMT -4:00]

    .

    AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

    AV: Trend Micro PC-cillin Internet Security *Enabled/Outdated* {7D2296BC-32CC-4519-917E-52E652474AF5}

    FW: Trend Micro PC-cillin Internet Security (Firewall) *Enabled*

    .

    ============== Running Processes ===============

    .

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe -k DcomLaunch

    svchost.exe

    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

    C:\Program Files\Internet Explorer\IEXPLORE.EXE

    C:\WINDOWS\system32\svchost.exe -k netsvcs

    svchost.exe

    svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

    C:\WINDOWS\system32\HPZipm12.exe

    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    C:\Program Files\DellSupport\DSAgnt.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Internet Explorer\IEXPLORE.EXE

    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe

    C:\Program Files\internet explorer\iexplore.exe

    C:\Program Files\internet explorer\iexplore.exe

    C:\Program Files\Avira\AntiVir Desktop\avguard.exe

    C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

    C:\Program Files\Avira\AntiVir Desktop\sched.exe

    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

    C:\Program Files\Avira\AntiVir Desktop\avnotify.exe

    C:\Documents and Settings\Joe and Courtney.JOEANDCOURTNEY\Desktop\dds.scr

    C:\WINDOWS\system32\WSCRIPT.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

    uStart Page = hxxp://www.google.com/

    uInternet Settings,ProxyOverride = *.local

    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

    uURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll

    mURLSearchHooks: AIM Toolbar Search Class: {03402f96-3dc7-4285-bc50-9e81fefafe43} - c:\program files\aim toolbar\aimtb.dll

    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

    BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll

    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

    BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5612.1312\swg.dll

    BHO: AIM Toolbar Loader: {b0cda128-b425-4eef-a174-61a11ac5dbf8} - c:\program files\aim toolbar\aimtb.dll

    BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll

    BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll

    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

    TB: AIM Toolbar: {61539ecd-cc67-4437-a03c-9aaccbd14326} - c:\program files\aim toolbar\aimtb.dll

    uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

    uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup

    uRun: [qMQfDeINnQ] c:\documents and settings\all users\application data\qMQfDeINnQ.exe

    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

    mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"

    mRun: [buildBU] c:\dell\bldbubg.exe

    mRun: [intelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"

    mRun: [intelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

    mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

    dRunOnce: [RunNarrator] Narrator.exe

    IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - c:\program files\partygaming\partypoker\RunApp.exe

    IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html

    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

    IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

    Trusted Zone: kaspersky.com\www

    DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxps://activatemyfios.verizon.net/sdcCommon/download/FIOS/Verizon%20FiOS%20Installer.cab

    DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

    DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} - hxxps://lowes.2020.net/planner/Core/Player/2020PlayerAX_Win32.cab

    DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} - hxxp://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB

    DPF: {2DEF4530-8CE6-41C9-84B6-A54536C90213} - hxxps://awreports.agencyworks.com/viewer9/activeXViewer/activexviewer.cab

    DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll

    DPF: {6F750202-1362-4815-A476-88533DE61D0C} - hxxp://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab

    DPF: {6F750203-1362-4815-A476-88533DE61D0C} - hxxp://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab

    DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} - hxxps://www.pieofny.com/Remote/msrdp.cab

    DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} - hxxps://ltc.ehansel.com/eHansel/ActiveX/arview2.cab

    DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} - hxxp://picture.vzw.com/activex/VerizonWirelessUploadControl.cab

    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

    DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

    DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

    DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

    DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://freetrial.webex.com/client/T26L/webex/ieatgpc.cab

    DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} - hxxp://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5787/mcfscan.cab

    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

    Notify: AtiExtEvent - Ati2evxx.dll

    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - c:\documents and settings\joe and courtney.joeandcourtney\application data\mozilla\firefox\profiles\4fa3wskl.default\

    FF - prefs.js: browser.search.defaulturl - hxxp://aim.search.aol.com/aol/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us&tb_uuid=100000000000000002&tb_oid=05-08-2010&tb_mrud=05-08-2010

    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com

    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/redirector/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&tb_uuid=100000000000000002&tb_oid=05-08-2010&tb_mrud=05-08-2010&query=

    FF - component: c:\documents and settings\joe and courtney.joeandcourtney\application data\mozilla\firefox\profiles\4fa3wskl.default\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}\components\MailUtil.dll

    FF - component: c:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll

    FF - plugin: c:\program files\canon\zoombrowser ex\program\NPCIG.dll

    FF - plugin: c:\program files\common files\motive\npMotive.dll

    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

    FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll

    FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll

    FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll

    FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll

    FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

    FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

    FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

    FF - Ext: AIM Toolbar: {c2f863cd-0429-48c7-bb54-db756a951760} - %profile%\extensions\{c2f863cd-0429-48c7-bb54-db756a951760}

    .

    ---- FIREFOX POLICIES ----

    FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false

    .

    ============= SERVICES / DRIVERS ===============

    .

    R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-11-8 28552]

    R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2011-5-30 11608]

    R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2011-5-30 136360]

    R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2011-5-30 269480]

    R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2011-5-30 61960]

    R2 Tmfilter;Tmfilter;c:\windows\system32\drivers\tmxpflt.sys [2005-8-30 205328]

    R2 Tmpreflt;Tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2005-8-30 36368]

    S1 iacsoumf;iacsoumf;\??\c:\windows\system32\drivers\iacsoumf.sys --> c:\windows\system32\drivers\iacsoumf.sys [?]

    S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2011-2-15 11520]

    S4 Tmntsrv;Trend Micro Real-time Service;c:\progra~1\trendm~1\intern~1\Tmntsrv.exe [2005-8-30 290889]

    S4 TmPfw;Trend Micro Personal Firewall;c:\progra~1\trendm~1\intern~1\TmPfw.exe [2005-8-30 585792]

    S4 tmproxy;Trend Micro Proxy Service;c:\progra~1\trendm~1\intern~1\tmproxy.exe [2005-8-30 262215]

    S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-6-24 24652]

    S4 WDDMService;WDDMService;c:\program files\western digital\wd smartware\wd drive manager\WDDMService.exe [2010-9-8 237056]

    S4 WDFME;WD File Management Engine;c:\program files\western digital\wd smartware\front parlor\wdfme\WDFME.exe [2010-9-8 1034752]

    S4 WDSC;WD File Management Shadow Engine;c:\program files\western digital\wd smartware\front parlor\WDSC.exe [2010-9-8 484352]

    .

    =============== Created Last 30 ================

    .

    2011-05-30 20:04:13 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys

    2011-05-30 20:04:06 -------- d-----w- c:\program files\Avira

    2011-05-30 20:04:06 -------- d-----w- c:\documents and settings\all users\application data\Avira

    2011-05-27 23:50:02 529448 ----a-w- c:\windows\system32\PerfStringBackup.TMP

    2011-05-27 10:31:23 98816 ----a-w- c:\windows\sed.exe

    2011-05-27 10:31:23 89088 ----a-w- c:\windows\MBR.exe

    2011-05-27 10:31:23 256512 ----a-w- c:\windows\PEV.exe

    2011-05-27 10:31:23 161792 ----a-w- c:\windows\SWREG.exe

    2011-05-27 10:31:18 -------- d-----w- C:\ComFix1

    2011-05-27 02:26:18 -------- d-----w- c:\program files\CCleaner

    .

    ==================== Find3M ====================

    .

    2011-03-27 01:39:38 21425 ----a-w- c:\windows\system32\drivers\AegisP.sys

    2011-03-07 05:33:50 692736 ---ha-w- c:\windows\system32\inetcomm.dll

    2011-03-04 06:37:06 420864 ---ha-w- c:\windows\system32\vbscript.dll

    2011-03-03 13:21:11 1857920 ---ha-w- c:\windows\system32\win32k.sys

    .

    ============= FINISH: 16:39:38.50 ===============

    attach.zip

    Vundo

    in Resolved Malware Removal Logs

    Posted

    Active Scan Log:

    ;*******************************************************************************

    ********************************************************************************

    *

    *******************

    ANALYSIS: 2009-11-09 06:06:49

    PROTECTIONS: 1

    MALWARE: 14

    SUSPECTS: 1

    ;*******************************************************************************

    ********************************************************************************

    *

    *******************

    PROTECTIONS

    Description Version Active Updated

    ;===============================================================================

    ================================================================================

    =

    ===================

    Trend Micro PC-cillin Internet Security 12.7.1019 Yes No

    ;===============================================================================

    ================================================================================

    =

    ===================

    MALWARE

    Id Description Type Active Severity Disinfectable Disinfected Location

    ;===============================================================================

    ================================================================================

    =

    ===================

    00047993 adware/powerscan Adware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\power scan

    00055522 Eicar.Mod Virus No 0 No No c:\program files\trend micro\internet security 12\tmhelp.chm[/pcc12/test_virus.htm]

    00966839 Spyware/Virtumonde Spyware No 1 Yes No c:\program files\viewpoint\viewpoint experience technology\newcomponents\swfview.dll

    02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1046\a0112946.sys

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1046\a0112796.dll

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\qoobox\quarantine\c\windows\system32\leyuwuyu.dll.vir

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\qoobox\quarantine\c\windows\system32\nohisoye.dll.vir

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1046\a0112821.dll

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\qoobox\quarantine\c\windows\system32\wideyuyu.dll.vir

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\qoobox\quarantine\c\windows\system32\yivozizi.dll.vir

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1042\a0112380.exe

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1042\a0112313.dll

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1041\a0111641.dll

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1039\a0111523.dll

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\qoobox\quarantine\c\windows\system32\tilepilo.dll.vir

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1046\a0112931.dll

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\t45gl4d4\load-full[1].exe

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1046\a0112930.dll

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1046\a0112928.dll

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1046\a0112926.dll

    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1046\a0112927.dll

    03312714 Adware/NaviPromo Adware No 1 Yes No c:\program files\common files\aol\1136593465\ee\services\browserapp\ver1_2_5_15\skill.exe

    03509206 Adware/SystemGuard2009 Adware No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1025\a0110165.sys

    05581839 Generic Trojan Virus/Trojan No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1042\a0112315.dll

    05582497 Generic Trojan Virus/Trojan No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1042\a0112316.dll

    05582647 Generic Trojan Virus/Trojan No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1042\a0112314.dll

    05584625 Trj/Zlob.KH Virus/Trojan No 1 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1037\a0111226.dll

    05585229 Spyware/Virtumonde Spyware No 1 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1037\a0111208.dll

    05585229 Spyware/Virtumonde Spyware No 1 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1037\a0111210.dll

    05585229 Spyware/Virtumonde Spyware No 1 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1037\a0111209.dll

    05592800 Adware/Trymedia Adware No 0 Yes No c:\downloads\scrabblesetup-dm[1].exe

    05592929 Generic Trojan Virus/Trojan No 0 Yes No c:\system volume information\_restore{202550a8-7a33-4bca-9586-051d24ddbf8f}\rp1046\a0112797.dll

    ;===============================================================================

    ================================================================================

    =

    ===================

    SUSPECTS

    Sent Location

    ;===============================================================================

    ================================================================================

    =

    ===================

    No c:\program files\partygaming\partypoker\uninstall.exe

    ;===============================================================================

    ================================================================================

    =

    ===================

    VULNERABILITIES

    Id Severity Description

    ;===============================================================================

    ================================================================================

    =

    ===================

    ;===============================================================================

    ================================================================================

    =

    ===================

    Hijack This Log:

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 6:09:17 AM, on 11/9/2009

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v8.00 (8.00.6001.18702)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

    C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\LEXBCES.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\system32\LEXPPS.EXE

    C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe

    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

    C:\Program Files\Bonjour\mDNSResponder.exe

    C:\Program Files\Java\jre6\bin\jqs.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

    C:\WINDOWS\system32\svchost.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

    C:\Program Files\Viewpoint\Common\ViewpointService.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

    C:\WINDOWS\system32\wscntfy.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe

    C:\Program Files\Apoint\Apoint.exe

    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    C:\Program Files\Dell\Media Experience\PCMService.exe

    C:\Program Files\Apoint\Apntex.exe

    C:\Program Files\Dell\QuickSet\quickset.exe

    C:\WINDOWS\system32\dla\tfswctrl.exe

    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

    C:\Program Files\SealedMedia\sealmon.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\Verizon\McciTrayApp.exe

    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

    C:\Program Files\Verizon\VSP\VerizonServicepoint.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Program Files\Java\jre6\bin\jusched.exe

    C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe

    C:\Program Files\Messenger\msmsgs.exe

    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    C:\Program Files\DellSupport\DSAgnt.exe

    C:\Program Files\DNA\btdna.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Digital Line Detect\DLG.exe

    C:\Program Files\Dell Photo Printer 720\dlbcserv.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

    O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

    O4 - HKLM\..\Run: [intelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless

    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe

    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

    O4 - HKLM\..\Run: [iSUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

    O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

    O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"

    O4 - HKLM\..\Run: [buildBU] c:\dell\bldbubg.exe

    O4 - HKLM\..\Run: [sealmon] C:\Program Files\SealedMedia\sealmon.exe

    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

    O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe

    O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN

    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\explorer.exe" /runcleanupscript

    O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

    O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup

    O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe"

    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O4 - Global Startup: Digital Line Detect.lnk = ?

    O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O15 - Trusted Zone: http://www.kaspersky.com

    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo...20Installer.cab

    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

    O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/contr...vex/TmHcmsX.CAB

    O16 - DPF: {2DEF4530-8CE6-41C9-84B6-A54536C90213} (Crystal Report Viewer Control 9) - https://awreports.agencyworks.com/viewer9/a...tivexviewer.cab

    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

    O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab

    O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab

    O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://www.pieofny.com/Remote/msrdp.cab

    O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://picture.vzw.com/activex/VerizonWire...loadControl.cab

    O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://freetrial.webex.com/client/T26L/webex/ieatgpc.cab

    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...787/mcfscan.cab

    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

    O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

    O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

    O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

    O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    O23 - Service: WLANKEEPER - Intel

    Vundo

    in Resolved Malware Removal Logs

    Posted

    Updated java and ran the atf cleaner.

    When attempting to run the kaspersky scan, I am getting the following message during the download process:

    Launch of the java application is interrupted. Please establish an uninterrupted Internet connection for work with this program.

    However, the internet connect seems to be working fine.

    Please advise

    Vundo

    in Resolved Malware Removal Logs

    Posted

    Hi BHowett-

    Unistalled and removed Norton and Bit Torrent

    Computer seems to be running considerably better. Logs are below:

    Malwarebytes' Anti-Malware 1.41

    Database version: 3109

    Windows 5.1.2600 Service Pack 3

    11/5/2009 9:03:50 PM

    mbam-log-2009-11-05 (21-03-50).txt

    Scan type: Quick Scan

    Objects scanned: 120487

    Time elapsed: 8 minute(s), 25 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 0

    Registry Values Infected: 0

    Registry Data Items Infected: 0

    Folders Infected: 0

    Files Infected: 0

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    (No malicious items detected)

    Registry Keys Infected:

    (No malicious items detected)

    Registry Values Infected:

    (No malicious items detected)

    Registry Data Items Infected:

    (No malicious items detected)

    Folders Infected:

    (No malicious items detected)

    Files Infected:

    (No malicious items detected)

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 9:05:56 PM, on 11/5/2009

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v8.00 (8.00.6001.18702)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

    C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\LEXBCES.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\system32\LEXPPS.EXE

    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

    C:\Program Files\Bonjour\mDNSResponder.exe

    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

    C:\WINDOWS\system32\HPZipm12.exe

    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

    C:\WINDOWS\system32\svchost.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

    C:\Program Files\Viewpoint\Common\ViewpointService.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

    C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe

    C:\WINDOWS\system32\wscntfy.exe

    C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

    C:\Program Files\Apoint\Apoint.exe

    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    C:\Program Files\Dell\Media Experience\PCMService.exe

    C:\Program Files\Dell\QuickSet\quickset.exe

    C:\Program Files\Apoint\Apntex.exe

    C:\WINDOWS\system32\dla\tfswctrl.exe

    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\Program Files\SealedMedia\sealmon.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

    C:\Program Files\Verizon\McciTrayApp.exe

    C:\Program Files\Verizon\VSP\VerizonServicepoint.exe

    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe

    C:\Program Files\Messenger\msmsgs.exe

    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    C:\Program Files\DellSupport\DSAgnt.exe

    C:\Program Files\DNA\btdna.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Digital Line Detect\DLG.exe

    C:\Program Files\Dell Photo Printer 720\dlbcserv.exe

    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe

    C:\WINDOWS\system32\NOTEPAD.EXE

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

    O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

    O4 - HKLM\..\Run: [intelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless

    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe

    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

    O4 - HKLM\..\Run: [iSUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

    O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

    O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"

    O4 - HKLM\..\Run: [buildBU] c:\dell\bldbubg.exe

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    O4 - HKLM\..\Run: [sealmon] C:\Program Files\SealedMedia\sealmon.exe

    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

    O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

    O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe

    O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN

    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\explorer.exe" /runcleanupscript

    O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup

    O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe"

    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O4 - Global Startup: Digital Line Detect.lnk = ?

    O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll

    O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk (file missing)

    O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk (file missing)

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo...20Installer.cab

    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

    O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/contr...vex/TmHcmsX.CAB

    O16 - DPF: {2DEF4530-8CE6-41C9-84B6-A54536C90213} (Crystal Report Viewer Control 9) - https://awreports.agencyworks.com/viewer9/a...tivexviewer.cab

    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

    O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab

    O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab

    O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://www.pieofny.com/Remote/msrdp.cab

    O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://picture.vzw.com/activex/VerizonWire...loadControl.cab

    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://freetrial.webex.com/client/T26L/webex/ieatgpc.cab

    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...787/mcfscan.cab

    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

    O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

    O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

    O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

    O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    O23 - Service: WLANKEEPER - Intel

    Vundo

    in Resolved Malware Removal Logs

    Posted

    Hi BHowett-

    Thanks for your help and sorry about the delay in getting back to you.

    Seems as if the machine is running fine.

    Below is the combofix log:

    ComboFix 09-11-04.02 - Joe and Courtney 11/04/2009 22:45.1.1 - NTFSx86

    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.140 [GMT -5:00]

    Running from: c:\documents and settings\Joe and Courtney.JOEANDCOURTNEY\Desktop\ComboFix.exe

    AV: Trend Micro PC-cillin Internet Security *On-access scanning disabled* (Outdated) {7D2296BC-32CC-4519-917E-52E652474AF5}

    FW: Trend Micro PC-cillin Internet Security (Firewall) *disabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

    .

    c:\documents and settings\Joe and Courtney.JOEANDCOURTNEY\Application Data\Desktopicon

    c:\documents and settings\Joe and Courtney.JOEANDCOURTNEY\Application Data\Desktopicon\eBayShortcuts.exe

    c:\recycler\NPROTECT\00000000.DAT

    c:\recycler\NPROTECT\00000001.DAT

    c:\recycler\NPROTECT\00000002

    c:\recycler\NPROTECT\00000003

    c:\recycler\NPROTECT\00000004

    c:\recycler\NPROTECT\00000005

    c:\recycler\NPROTECT\00000006

    c:\recycler\NPROTECT\00000007

    c:\recycler\NPROTECT\00000009

    c:\recycler\NPROTECT\00000011

    c:\recycler\NPROTECT\00000012

    c:\recycler\NPROTECT\00000013

    c:\recycler\NPROTECT\00000014

    c:\recycler\NPROTECT\00000017.DAT

    c:\recycler\NPROTECT\00000018

    c:\recycler\NPROTECT\00000019

    c:\recycler\NPROTECT\00000020

    c:\recycler\NPROTECT\00000021

    c:\recycler\NPROTECT\00000022

    c:\recycler\NPROTECT\00000023

    c:\recycler\NPROTECT\00000025

    c:\recycler\NPROTECT\00000026.DAT

    c:\recycler\NPROTECT\00000027

    c:\recycler\NPROTECT\00000028

    c:\recycler\NPROTECT\00000029

    c:\recycler\NPROTECT\00000030

    c:\recycler\NPROTECT\00000031

    c:\recycler\NPROTECT\00000032

    c:\recycler\NPROTECT\00000033

    c:\recycler\NPROTECT\00000034

    c:\recycler\NPROTECT\00000035

    c:\recycler\NPROTECT\00000036

    c:\recycler\NPROTECT\00000037

    c:\recycler\NPROTECT\00000038

    c:\recycler\NPROTECT\00000039

    c:\recycler\NPROTECT\00000040

    c:\recycler\NPROTECT\00000041

    c:\recycler\NPROTECT\00000042

    c:\recycler\NPROTECT\00000043

    c:\recycler\NPROTECT\00000044

    c:\recycler\NPROTECT\00000045.dat

    c:\recycler\NPROTECT\00000046

    c:\recycler\NPROTECT\00000047

    c:\recycler\NPROTECT\00000050

    c:\recycler\NPROTECT\00000051

    c:\recycler\NPROTECT\00000052

    c:\recycler\NPROTECT\00000054

    c:\recycler\NPROTECT\00000055

    c:\recycler\NPROTECT\00000056

    c:\recycler\NPROTECT\00000057

    c:\recycler\NPROTECT\00000060

    c:\recycler\NPROTECT\00000061

    c:\recycler\NPROTECT\00000062

    c:\recycler\NPROTECT\00000063

    c:\recycler\NPROTECT\00000065

    c:\recycler\NPROTECT\00000066

    c:\recycler\NPROTECT\00000067

    c:\recycler\NPROTECT\00000068

    c:\recycler\NPROTECT\00000069

    c:\recycler\NPROTECT\00000070

    c:\recycler\NPROTECT\00000071

    c:\recycler\NPROTECT\00000072

    c:\recycler\NPROTECT\00000073

    c:\recycler\NPROTECT\00000074

    c:\recycler\NPROTECT\00000075

    c:\recycler\NPROTECT\00000077

    c:\recycler\NPROTECT\00000078

    c:\recycler\NPROTECT\00000079

    c:\recycler\NPROTECT\00000082

    c:\recycler\NPROTECT\00000083

    c:\recycler\NPROTECT\00000084

    c:\recycler\NPROTECT\00000085

    c:\recycler\NPROTECT\00000086

    c:\recycler\NPROTECT\00000087

    c:\recycler\NPROTECT\00000088

    c:\recycler\NPROTECT\00000089

    c:\recycler\NPROTECT\00000090

    c:\recycler\NPROTECT\00000092

    c:\recycler\NPROTECT\00000093

    c:\recycler\NPROTECT\00000094

    c:\recycler\NPROTECT\00000096

    c:\recycler\NPROTECT\00000097

    c:\recycler\NPROTECT\00000098

    c:\recycler\NPROTECT\00000100

    c:\recycler\NPROTECT\00000101

    c:\recycler\NPROTECT\00000102

    c:\recycler\NPROTECT\00000103

    c:\recycler\NPROTECT\00000104

    c:\recycler\NPROTECT\00000105

    c:\recycler\NPROTECT\00000107

    c:\recycler\NPROTECT\00000108

    c:\recycler\NPROTECT\00000109

    c:\recycler\NPROTECT\00000110

    c:\recycler\NPROTECT\00000111

    c:\recycler\NPROTECT\00000113

    c:\recycler\NPROTECT\00000114

    c:\recycler\NPROTECT\00000115

    c:\recycler\NPROTECT\00000116

    c:\recycler\NPROTECT\00000117

    c:\recycler\NPROTECT\00000118

    c:\recycler\NPROTECT\00000119

    c:\recycler\NPROTECT\00000120

    c:\recycler\NPROTECT\00000121

    c:\recycler\NPROTECT\00000122

    c:\recycler\NPROTECT\00000126

    c:\recycler\NPROTECT\00000127.dat

    c:\recycler\NPROTECT\00000128.dat

    c:\recycler\NPROTECT\00000129

    c:\recycler\NPROTECT\00000130

    c:\recycler\NPROTECT\00000131

    c:\recycler\NPROTECT\00000132

    c:\recycler\NPROTECT\00000133

    c:\recycler\NPROTECT\00000134

    c:\recycler\NPROTECT\00000135

    c:\recycler\NPROTECT\00000136

    c:\recycler\NPROTECT\00000138

    c:\recycler\NPROTECT\00000140.dat

    c:\recycler\NPROTECT\00000142

    c:\recycler\NPROTECT\00000143.bat

    c:\recycler\NPROTECT\00000144

    c:\recycler\NPROTECT\00000145

    c:\recycler\NPROTECT\00000146

    c:\recycler\NPROTECT\00000147

    c:\recycler\NPROTECT\00000148

    c:\recycler\NPROTECT\00000150

    c:\recycler\NPROTECT\00000151

    c:\recycler\NPROTECT\00000153

    c:\recycler\NPROTECT\00000154

    c:\recycler\NPROTECT\00000155

    c:\recycler\NPROTECT\00000158

    c:\recycler\NPROTECT\00000159

    c:\recycler\NPROTECT\00000160

    c:\recycler\NPROTECT\00000161

    c:\recycler\NPROTECT\00000162

    c:\recycler\NPROTECT\00000163

    c:\recycler\NPROTECT\00000164

    c:\recycler\NPROTECT\00000166

    c:\recycler\NPROTECT\00000167

    c:\recycler\NPROTECT\00000168

    c:\recycler\NPROTECT\00000169

    c:\recycler\NPROTECT\00000170

    c:\recycler\NPROTECT\00000171

    c:\recycler\NPROTECT\00000172

    c:\recycler\NPROTECT\00000173

    c:\recycler\NPROTECT\00000174

    c:\recycler\NPROTECT\00000175

    c:\recycler\NPROTECT\00000176

    c:\recycler\NPROTECT\00000177

    c:\recycler\NPROTECT\00000178

    c:\recycler\NPROTECT\00000179

    c:\recycler\NPROTECT\00000180

    c:\recycler\NPROTECT\00000181

    c:\recycler\NPROTECT\00000182

    c:\recycler\NPROTECT\00000184

    c:\recycler\NPROTECT\00000185

    c:\recycler\NPROTECT\00000186

    c:\recycler\NPROTECT\00000189

    c:\recycler\NPROTECT\00000192.SYS

    c:\recycler\NPROTECT\00000193

    c:\recycler\NPROTECT\00000194

    c:\recycler\NPROTECT\00000195

    c:\recycler\NPROTECT\00000196

    c:\recycler\NPROTECT\00000197

    c:\recycler\NPROTECT\00000198

    c:\recycler\NPROTECT\00000199

    c:\recycler\NPROTECT\00000200

    c:\recycler\NPROTECT\00000201

    c:\recycler\NPROTECT\00000202.dat

    c:\recycler\NPROTECT\00000203

    c:\recycler\NPROTECT\00000204.bad

    c:\recycler\NPROTECT\00000205.BAD

    c:\recycler\NPROTECT\00000206

    c:\recycler\NPROTECT\00000207

    c:\recycler\NPROTECT\00000208

    c:\recycler\NPROTECT\00000209

    c:\recycler\NPROTECT\00000210

    c:\recycler\NPROTECT\00000211

    c:\recycler\NPROTECT\00000217

    c:\recycler\NPROTECT\00000218.md5

    c:\windows\system32\bszip.dll

    c:\windows\system32\degenalu.dll

    c:\windows\system32\dufazone.dll

    c:\windows\system32\fiyigadu.dll

    c:\windows\system32\korivigi.dll

    c:\windows\system32\leyuwuyu.dll

    c:\windows\system32\nohisoye.dll

    c:\windows\system32\tilepilo.dll

    c:\windows\system32\wezehesa.dll

    c:\windows\system32\wideyuyu.dll

    c:\windows\system32\yivozizi.dll

    c:\windows\system32\zozobuve.dll

    c:\windows\Tasks\tmhorhtq.job

    C:\xcrashdump.dat

    c:\recycler\NPROTECT . . . . failed to delete

    c:\recycler\NPROTECT\NPROTECT.LOG . . . . failed to delete

    .

    ((((((((((((((((((((((((( Files Created from 2009-10-05 to 2009-11-05 )))))))))))))))))))))))))))))))

    .

    2009-11-01 02:51 . 2009-11-01 03:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

    2009-11-01 02:26 . 2009-11-01 02:26 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

    2009-11-01 02:25 . 2009-11-01 04:07 -------- d-----w- c:\program files\SUPERAntiSpyware

    2009-11-01 02:25 . 2009-11-01 04:08 -------- d-----w- c:\documents and settings\Joe and Courtney.JOEANDCOURTNEY\Application Data\SUPERAntiSpyware.com

    2009-11-01 02:22 . 2009-11-01 02:22 -------- d-----w- c:\program files\1Malwarebytes' Anti-Malware

    2009-11-01 02:19 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

    2009-11-01 02:19 . 2009-11-01 02:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware1

    2009-11-01 02:19 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

    2009-11-01 01:00 . 2009-11-01 01:00 -------- d-----w- C:\VundoFix Backups

    2009-10-31 15:21 . 2009-10-31 15:21 -------- d-----w- c:\windows\McAfee.com

    2009-10-17 17:01 . 2009-10-17 17:01 -------- d-----w- c:\program files\MSECache

    2009-10-14 22:22 . 2009-10-14 22:22 -------- d-sh--w- c:\documents and settings\Joe and Courtney.JOEANDCOURTNEY\IECompatCache

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2009-11-05 04:11 . 2008-05-02 00:22 -------- d-----w- c:\program files\DNA

    2009-11-05 04:11 . 2008-05-02 00:22 -------- d-----w- c:\documents and settings\Joe and Courtney.JOEANDCOURTNEY\Application Data\DNA

    2009-11-02 22:25 . 2008-08-30 14:11 -------- d-----w- c:\program files\Norton SystemWorks Basic Edition

    2009-10-27 23:44 . 2005-12-15 07:44 -------- d-----w- c:\program files\Trend Micro

    2009-10-18 12:32 . 2006-01-04 23:13 41664 ----a-w- c:\documents and settings\Joe and Courtney.JOEANDCOURTNEY\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

    2009-09-21 22:45 . 2009-09-21 22:45 -------- d-----w- c:\documents and settings\Joe and Courtney.JOEANDCOURTNEY\Application Data\Malwarebytes

    2009-09-21 22:45 . 2009-09-21 22:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

    2009-09-21 10:26 . 2004-08-10 19:03 78819 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

    2009-09-15 01:27 . 2008-06-14 00:59 1924440 ----a-w- c:\documents and settings\Joe and Courtney.JOEANDCOURTNEY\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe

    2009-09-11 14:18 . 2004-08-10 18:51 136192 ----a-w- c:\windows\system32\msv1_0.dll

    2009-09-04 21:03 . 2004-08-10 18:51 58880 ----a-w- c:\windows\system32\msasn1.dll

    2009-08-29 08:08 . 2004-08-10 18:51 916480 ----a-w- c:\windows\system32\wininet.dll

    2009-08-26 08:00 . 2004-08-10 18:51 247326 ----a-w- c:\windows\system32\strmdll.dll

    2009-08-16 22:27 . 2009-08-16 22:03 256 ----a-w- c:\windows\system32\pool.bin

    2009-08-16 22:02 . 2009-08-16 22:02 26694 ----a-r- c:\documents and settings\Joe and Courtney.JOEANDCOURTNEY\Application Data\Microsoft\Installer\{03F78428-4DF6-4426-AACD-53FC353D94E0}\BlackBerry.exe

    2008-02-28 00:49 . 2008-02-28 00:49 27976 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll

    2008-02-28 00:49 . 2008-02-28 00:49 125848 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll

    2008-02-28 00:49 . 2008-02-28 00:50 46408 ----a-w- c:\program files\mozilla firefox\plugins\atmccli.dll

    2008-02-28 00:50 . 2008-02-28 00:50 98712 ----a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll

    2007-11-07 01:31 . 2006-01-17 02:45 56 --sh--r- c:\windows\system32\A96B932EBF.sys

    2007-11-07 01:31 . 2006-03-13 00:34 3766 --sha-w- c:\windows\system32\KGyGaAvL.sys

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "OE_OEM"="c:\program files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [2006-04-11 176201]

    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-23 68856]

    "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]

    "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-10-07 323392]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 32881]

    "Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]

    "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]

    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-06 344064]

    "PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]

    "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2005-09-01 684032]

    "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]

    "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]

    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]

    "pccguide.exe"="c:\program files\Trend Micro\Internet Security 12\pccguide.exe" [2005-08-30 823362]

    "BuildBU"="c:\dell\bldbubg.exe" [2005-12-15 61440]

    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-03-05 180269]

    "sealmon"="c:\program files\SealedMedia\sealmon.exe" [2007-04-03 296080]

    "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]

    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-02-01 385024]

    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]

    "Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]

    "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-09-06 115560]

    "NSWosCheck"="c:\program files\Norton SystemWorks Basic Edition\osCheck.exe" [2007-09-18 25472]

    "Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-09-28 936960]

    "VerizonServicepoint.exe"="c:\program files\Verizon\VSP\VerizonServicepoint.exe" [2008-09-17 2065648]

    "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\explorer.exe" [2009-11-01 1312080]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

    "RunNarrator"="Narrator.exe" - c:\windows\system32\narrator.exe [2008-04-14 53760]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\

    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

    Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-12-15 24576]

    dlbcserv.lnk - c:\program files\Dell Photo Printer 720\dlbcserv.exe [2006-1-28 315392]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]

    2004-09-07 22:08 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk

    backup=c:\windows\pss\America Online 9.0 Tray Icon.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

    backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk

    backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk

    backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk

    backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]

    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk

    backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]

    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]

    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "%windir%\\system32\\sessmgr.exe"=

    "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=

    "c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

    "c:\\Program Files\\America Online 9.0\\waol.exe"=

    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

    "c:\\Program Files\\Common Files\\AOL\\1136593465\\ee\\aolsoftware.exe"=

    "c:\\Program Files\\Common Files\\AOL\\1136593465\\ee\\aim6.exe"=

    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

    "c:\\Program Files\\iTunes\\iTunes.exe"=

    "c:\\Program Files\\DNA\\btdna.exe"=

    "c:\\Program Files\\BitTorrent\\bittorrent.exe"=

    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

    "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

    "c:\\Program Files\\Symantec\\LiveUpdate\\AluSchedulerSvc.exe"=

    "c:\\Program Files\\iPod\\bin\\iPodService.exe"=

    "c:\\Program Files\\Dell Photo Printer 720\\dlbcserv.exe"=

    "c:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"=

    "c:\\Program Files\\DellSupport\\DSAgnt.exe"=

    R2 NProtectService;Norton UnErase Protection;c:\progra~1\NORTON~1\NORTON~1\NPROTECT.EXE [11/3/2005 10:08 PM 95832]

    R2 Tmfilter;Tmfilter;c:\windows\system32\drivers\tmxpflt.sys [8/30/2005 5:30 PM 205328]

    R2 Tmntsrv;Trend Micro Real-time Service;c:\progra~1\TRENDM~1\INTERN~1\Tmntsrv.exe [8/30/2005 5:30 PM 290889]

    R2 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe [8/30/2005 5:30 PM 585792]

    R2 Tmpreflt;Tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [8/30/2005 5:30 PM 36368]

    R2 tmproxy;Trend Micro Proxy Service;c:\progra~1\TRENDM~1\INTERN~1\tmproxy.exe [8/30/2005 5:30 PM 262215]

    R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [6/24/2008 3:47 PM 24652]

    S1 iacsoumf;iacsoumf;\??\c:\windows\system32\drivers\iacsoumf.sys --> c:\windows\system32\drivers\iacsoumf.sys [?]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - MBR

    *Deregistered* - mbr

    .

    Contents of the 'Scheduled Tasks' folder

    2009-10-30 c:\windows\Tasks\AppleSoftwareUpdate.job

    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 21:57]

    2009-11-02 c:\windows\Tasks\Norton SystemWorks One Button Checkup.job

    - c:\program files\Norton SystemWorks Basic Edition\OBC.exe [2007-09-18 12:22]

    .

    .

    ------- Supplementary Scan -------

    .

    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

    uStart Page = hxxp://www.google.com/

    uInternet Settings,ProxyOverride = *.local

    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

    FF - ProfilePath - c:\documents and settings\Joe and Courtney.JOEANDCOURTNEY\Application Data\Mozilla\Firefox\Profiles\4fa3wskl.default\

    FF - prefs.js: browser.search.selectedEngine - Google

    FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava11.dll

    FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava12.dll

    FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava13.dll

    FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava14.dll

    FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJava32.dll

    FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPJPI142_03.dll

    FF - plugin: c:\program files\Java\j2re1.4.2_03\bin\NPOJI610.dll

    FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll

    FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

    FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll

    FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll

    FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

    .

    - - - - ORPHANS REMOVED - - - -

    BHO-{f67a7771-7e39-4f42-9e5d-ce0bb6a38989} - zozobuve.dll

    HKCU-Run-Aim6 - (no file)

    HKLM-Run-behivahoy - c:\windows\system32\yivozizi.dll

    HKLM-Run-halomufuva - korivigi.dll

    SharedTaskScheduler-{b4a22866-cb22-458c-93d2-fc2c54642f3e} - (no file)

    SharedTaskScheduler-{72df3803-9b7c-4155-80bc-87a4d9921bd1} - c:\windows\system32\yivozizi.dll

    SSODL-hekovevum-{72df3803-9b7c-4155-80bc-87a4d9921bd1} - c:\windows\system32\yivozizi.dll

    Notify-NavLogon - (no file)

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2009-11-04 23:06

    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully

    hidden files: 0

    **************************************************************************

    .

    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(988)

    c:\windows\system32\Ati2evxx.dll

    c:\program files\Intel\Wireless\Bin\LgNotify.dll

    - - - - - - - > 'explorer.exe'(4036)

    c:\windows\system32\WININET.dll

    c:\windows\system32\ieframe.dll

    c:\windows\system32\webcheck.dll

    .

    ------------------------ Other Running Processes ------------------------

    .

    c:\windows\system32\Ati2evxx.exe

    c:\program files\Intel\Wireless\Bin\EvtEng.exe

    c:\program files\Intel\Wireless\Bin\S24EvMon.exe

    c:\program files\Intel\Wireless\Bin\WLKeeper.exe

    c:\program files\Intel\Wireless\Bin\ZcfgSvc.exe

    c:\windows\system32\Ati2evxx.exe

    c:\program files\Common Files\Symantec Shared\ccSvcHst.exe

    c:\windows\system32\LEXBCES.EXE

    c:\windows\system32\LEXPPS.EXE

    c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe

    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

    c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

    c:\program files\Bonjour\mDNSResponder.exe

    c:\progra~1\Intel\Wireless\Bin\1XConfig.exe

    c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    c:\program files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

    c:\progra~1\TRENDM~1\INTERN~1\PcCtlCom.exe

    c:\windows\system32\HPZipm12.exe

    c:\program files\Intel\Wireless\Bin\RegSrvc.exe

    c:\progra~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

    c:\windows\system32\wdfmgr.exe

    c:\progra~1\TRENDM~1\INTERN~1\PccGuide.exe

    c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe

    c:\program files\Apoint\Apntex.exe

    c:\program files\iPod\bin\iPodService.exe

    c:\progra~1\Yahoo!\MESSEN~1\ymsgr_tray.exe

    .

    **************************************************************************

    .

    Completion time: 2009-11-05 23:23 - machine was rebooted

    ComboFix-quarantined-files.txt 2009-11-05 04:23

    Pre-Run: 9,907,388,416 bytes free

    Post-Run: 9,831,071,744 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

    [boot loader]

    timeout=2

    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

    [operating systems]

    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

    Vundo

    in Resolved Malware Removal Logs

    Posted

    Have had a personal guard and vundo issue for the last week. Each time I think I've cleared it up it pops back a few days later.

    Had to rename the exe file, and was able to update and scan. Below is my most recent malwarebytes scan log and after that is my most recent hijackthis scan log.

    Any advice on the next steps to eradicate this mess, would be greatly appreciated.

    Following is a log of my most recent scan Malware bytes scan:

    Malwarebytes' Anti-Malware 1.41

    Database version: 3097

    Windows 5.1.2600 Service Pack 3

    11/3/2009 8:59:10 PM

    mbam-log-2009-11-03 (20-59-10).txt

    Scan type: Quick Scan

    Objects scanned: 126696

    Time elapsed: 12 minute(s), 43 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 1

    Registry Keys Infected: 1

    Registry Values Infected: 3

    Registry Data Items Infected: 3

    Folders Infected: 0

    Files Infected: 2

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    C:\WINDOWS\system32\zelafuza.dll (Trojan.Vundo.H) -> Delete on reboot.

    Registry Keys Infected:

    HKEY_CLASSES_ROOT\CLSID\{cf0b9c66-d80f-4bed-b489-a5daf2cfc519} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    Registry Values Infected:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\behivahoy (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{cf0b9c66-d80f-4bed-b489-a5daf2cfc519} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\sufojogiz (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    Registry Data Items Infected:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\zelafuza.dll -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\zelafuza.dll -> Quarantined and deleted successfully.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:

    (No malicious items detected)

    Files Infected:

    c:\WINDOWS\system32\zelafuza.dll (Trojan.Vundo.H) -> Delete on reboot.

    C:\WINDOWS\system32\tujiwopu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

    Following is a log of my most recent scan hijack this scan:

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 9:10:37 PM, on 11/3/2009

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v8.00 (8.00.6001.18702)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

    C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe

    C:\WINDOWS\system32\Ati2evxx.exe

    C:\WINDOWS\Explorer.EXE

    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

    C:\WINDOWS\system32\LEXBCES.EXE

    C:\WINDOWS\system32\LEXPPS.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

    C:\Program Files\Bonjour\mDNSResponder.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

    C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE

    C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

    C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe

    C:\WINDOWS\system32\HPZipm12.exe

    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

    C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

    C:\WINDOWS\system32\svchost.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

    C:\Program Files\Viewpoint\Common\ViewpointService.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe

    C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

    C:\Program Files\Apoint\Apoint.exe

    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

    C:\Program Files\Dell\Media Experience\PCMService.exe

    C:\Program Files\Dell\QuickSet\quickset.exe

    C:\WINDOWS\system32\dla\tfswctrl.exe

    C:\Program Files\Apoint\Apntex.exe

    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\Program Files\SealedMedia\sealmon.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\Common Files\Symantec Shared\ccApp.exe

    C:\Program Files\Verizon\McciTrayApp.exe

    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

    C:\Program Files\Verizon\VSP\VerizonServicepoint.exe

    C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Messenger\msmsgs.exe

    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    C:\Program Files\DellSupport\DSAgnt.exe

    C:\Program Files\DNA\btdna.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Program Files\Digital Line Detect\DLG.exe

    C:\Program Files\Dell Photo Printer 720\dlbcserv.exe

    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Malwarebytes' Anti-Malware\explorer.exe

    C:\WINDOWS\system32\NOTEPAD.EXE

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

    O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

    O4 - HKLM\..\Run: [intelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless

    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe

    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

    O4 - HKLM\..\Run: [iSUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

    O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

    O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"

    O4 - HKLM\..\Run: [buildBU] c:\dell\bldbubg.exe

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    O4 - HKLM\..\Run: [sealmon] C:\Program Files\SealedMedia\sealmon.exe

    O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

    O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

    O4 - HKLM\..\Run: [NSWosCheck] "C:\Program Files\Norton SystemWorks Basic Edition\osCheck.exe"

    O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe

    O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN

    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\explorer.exe" /runcleanupscript

    O4 - HKLM\..\Run: [behivahoy] Rundll32.exe "c:\windows\system32\wideyuyu.dll",a

    O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup

    O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe"

    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

    O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

    O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O4 - Global Startup: Digital Line Detect.lnk = ?

    O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll

    O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk

    O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks Basic Edition\Norton Cleanup\WCQuick.lnk

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)

    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemyfios.verizon.net/sdcCommo...20Installer.cab

    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab

    O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/contr...vex/TmHcmsX.CAB

    O16 - DPF: {2DEF4530-8CE6-41C9-84B6-A54536C90213} (Crystal Report Viewer Control 9) - https://awreports.agencyworks.com/viewer9/a...tivexviewer.cab

    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

    O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab

    O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._2/axofupld.cab

    O16 - DPF: {7584C670-2274-4EFB-B00B-D6AABA6D3850} (Microsoft RDP Client Control (redist)) - https://www.pieofny.com/Remote/msrdp.cab

    O16 - DPF: {8A0019EB-51FA-4AE5-A40B-C0496BBFC739} (Verizon Wireless Media Upload) - http://picture.vzw.com/activex/VerizonWire...loadControl.cab

    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://freetrial.webex.com/client/T26L/webex/ieatgpc.cab

    O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...787/mcfscan.cab

    O20 - AppInit_DLLs: pimehori.dll c:\windows\system32\wideyuyu.dll ,dufazone.dll

    O21 - SSODL: bihusuduv - {ee6fde49-1fd2-4c8d-819b-24efb02d90f3} - c:\windows\system32\wideyuyu.dll

    O22 - SharedTaskScheduler: tokatiluy - {b4a22866-cb22-458c-93d2-fc2c54642f3e} - (no file)

    O22 - SharedTaskScheduler: gahurihor - {ee6fde49-1fd2-4c8d-819b-24efb02d90f3} - c:\windows\system32\wideyuyu.dll

    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe

    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

    O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE

    O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

    O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE

    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

    O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

    O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

    O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    O23 - Service: WLANKEEPER - Intel

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.