lrizzlenizzleman

August 3, 2008

I haven't noticed any sound issues. These are the results, but it said that the file had already been analyzed. Thanks!

File Alcmtr.exe received on 08.03.2008 18:57:58 (CET)

Current status: finished

Result: 0/36 (0.00%)

Compact Compact

Print results Print results

Antivirus Version Last Update Result

AhnLab-V3 2008.7.29.1 2008.08.02 -

AntiVir 7.8.1.15 2008.08.01 -

Authentium 5.1.0.4 2008.08.03 -

Avast 4.8.1195.0 2008.08.03 -

AVG 8.0.0.156 2008.08.02 -

BitDefender 7.2 2008.08.03 -

CAT-QuickHeal 9.50 2008.08.02 -

ClamAV 0.93.1 2008.08.03 -

DrWeb 4.44.0.09170 2008.08.03 -

eSafe 7.0.17.0 2008.08.03 -

eTrust-Vet 31.6.6002 2008.08.02 -

Ewido 4.0 2008.08.03 -

F-Prot 4.4.4.56 2008.08.03 -

F-Secure 7.60.13501.0 2008.08.03 -

Fortinet 3.14.0.0 2008.08.03 -

GData 2.0.7306.1023 2008.08.03 -

Ikarus T3.1.1.34.0 2008.08.03 -

K7AntiVirus 7.10.402 2008.08.02 -

Kaspersky 7.0.0.125 2008.08.03 -

McAfee 5352 2008.08.01 -

Microsoft 1.3807 2008.08.03 -

NOD32v2 3322 2008.08.03 -

Norman 5.80.02 2008.08.01 -

Panda 9.0.0.4 2008.08.03 -

PCTools 4.4.2.0 2008.08.03 -

Prevx1 V2 2008.08.03 -

Rising 20.55.62.00 2008.08.03 -

Sophos 4.31.0 2008.08.03 -

Sunbelt 3.1.1537.1 2008.08.01 -

Symantec 10 2008.08.03 -

TheHacker 6.2.96.392 2008.08.02 -

TrendMicro 8.700.0.1004 2008.08.01 -

VBA32 3.12.8.2 2008.08.02 -

ViRobot 2008.8.1.1321 2008.08.01 -

VirusBuster 4.5.11.0 2008.08.02 -

Webwasher-Gateway 6.6.2 2008.08.03 -

Additional information

File size: 69632 bytes

MD5...: 8b4cbba1ea526830c7f97e7822e2493a

SHA1..: e519f493e42694c564aaa347745bab035bbcb3d9

SHA256: 1dfd05b1c0050db44f5b4293e5574bfc292af804a63fc0a70131bb498c326977

SHA512: d1264f010d21aed0db2cc5749327866605ed701db42541cfe712ba2cedba7836

0cb2322b76d7101ddf18b7f9311c185d3c08589a4b66d00ea57977664299c6e6

PEiD..: Armadillo v1.71

PEInfo: PE Structure information

( base data )

entrypointaddress.: 0x403be0

timedatestamp.....: 0x427755ce (Tue May 03 10:43:26 2005)

machinetype.......: 0x14c (I386)

( 4 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x610e 0x7000 5.95 8847136ed928b3d6bf22476d6cfa16dc

.rdata 0x8000 0x11be 0x2000 3.62 44d6d751816684771102662d858f1eb7

.data 0xa000 0x325c 0x3000 1.32 db9e3f59949d45ef77c97f790cfa285b

.rsrc 0xe000 0x3c60 0x4000 2.71 f7d9818085605d7244ef821b6becc72e

( 7 imports )

> DSOUND.dll: -

> SETUPAPI.dll: SetupDiGetDeviceRegistryPropertyA, SetupDiGetClassDevsA, SetupDiEnumDeviceInfo, SetupDiGetDeviceInstanceIdA, SetupDiDestroyDeviceInfoList, SetupDiEnumDeviceInterfaces, SetupDiGetDeviceInterfaceDetailA

> KERNEL32.dll: CreateEventA, GetStringTypeA, LCMapStringW, LCMapStringA, MultiByteToWideChar, LoadLibraryA, GetProcAddress, HeapReAlloc, VirtualAlloc, HeapAlloc, GetOEMCP, GetACP, GetCPInfo, WriteFile, RtlUnwind, HeapFree, VirtualFree, HeapCreate, HeapDestroy, GetVersionExA, GetEnvironmentVariableA, GetFileType, GetStdHandle, SetHandleCount, GetEnvironmentStringsW, GetEnvironmentStrings, WideCharToMultiByte, FreeEnvironmentStringsW, FreeEnvironmentStringsA, GetModuleFileNameA, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, ExitProcess, GetVersion, GetCommandLineA, GetStartupInfoA, CreateFileA, DeviceIoControl, LocalAlloc, LocalFree, WaitForMultipleObjects, SetEvent, WaitForSingleObject, WinExec, lstrcmpA, Sleep, CreateMutexA, GetLastError, CloseHandle, GetStringTypeW, CreateThread, lstrcpyA, GetModuleHandleA

> USER32.dll: DispatchMessageA, TranslateMessage, GetMessageA, ShowWindow, LoadStringA, FindWindowA, CharUpperA, BeginPaint, FillRect, EndPaint, SetTimer, GetSysColor, SystemParametersInfoA, GetDC, GetMenuCheckMarkDimensions, ReleaseDC, CreatePopupMenu, InsertMenuItemA, SendMessageA, GetCursorPos, TrackPopupMenu, DestroyMenu, KillTimer, PostQuitMessage, SetForegroundWindow, DefWindowProcA, RegisterWindowMessageA, GetDesktopWindow, GetWindow, GetClassNameA, PostMessageA, LoadIconA, LoadCursorA, RegisterClassA, CreateWindowExA, SetWindowRgn, LoadImageA

> GDI32.dll: FrameRgn, CreateCompatibleDC, BitBlt, DeleteDC, CreatePen, MoveToEx, LineTo, CreateBrushIndirect, Rectangle, GetTextColor, SetTextColor, GetBkMode, SetBkMode, GetTextAlign, SetTextAlign, ExtTextOutA, CreateFontIndirectA, SelectObject, GetTextExtentPoint32A, DeleteObject, CreateRoundRectRgn, CreatePolygonRgn, CombineRgn

> ADVAPI32.dll: RegOpenKeyExA, RegQueryValueExA, RegCreateKeyExA, RegSetValueExA, RegCloseKey

> SHELL32.dll: Shell_NotifyIconA

( 0 exports )

ATENTION ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

August 2, 2008

After uninstalling Spybot again, I added

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Alcmtr"=-

to the registry as deletereg.reg. Unfortunately the ALCMTR.exe is still there. I checked msconfig and its not listed in the startup, so I don't know how to disable it from the startup or how to get rid of it. Any suggestions?

heres the fresh HijackThis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:03:10 PM, on 8/2/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe

C:\HP\KBD\KBD.EXE

C:\WINDOWS\ALCMTR.EXE

C:\WINDOWS\ALCWZRD.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\HijackThis\HijackThis.exe

c:\windows\system\hpsysdrv.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\iPod\bin\iPodService.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: AT&&T Toolbar - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\PROGRA~1\ATTTOO~1\ATTTOO~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll

O2 - BHO: HpWebHelper - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\webhelper.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll

O3 - Toolbar: AT&&T Toolbar - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\PROGRA~1\ATTTOO~1\ATTTOO~1.DLL

O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe

O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\HP_Owner\Application Data\mjusbsp\cdloader2.exe" MAGICJACK

O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Updates From HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe

--

End of file - 7162 bytes

August 2, 2008

That worked.

Here's the fresh HijackThis log (anything else you see in it?):

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:34:40 AM, on 8/2/2008