Jump to content

oplease

Honorary Members
  • Posts

    23
  • Joined

  • Last visited

Everything posted by oplease

  1. Yes, I read through those logs and it looks good to me, too......(just kidding, I have no idea). It's running good. Those folks at McAfee should be ashamed of themselves. I had everything up to date, and that includes Systems Guard, which is supposed to prevent Registry changes. Thank you very much for your help.
  2. You said to "let the program run unhindered", which made me think it would run awhile. It was done in an instant. Here is the log - ========== OTL ========== C:\Documents and Settings\All Users\Application Data\Jd7i63U6u moved successfully. C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Jd7i63U6u moved successfully. C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\ave.exe moved successfully. C:\WINDOWS\system32\vefebuku moved successfully. ========== FILES ========== C:\WINDOWS\System32\drivers\pcesbimb.sys moved successfully. C:\WINDOWS\System32\drivers\rjxkmitn.sys moved successfully. OTL by OldTimer - Version 3.1.37.0 log created on 03202010_110859 Here is the follow-up scan - OTL logfile created on: 3/20/2010 11:11:21 AM - Run 2 OTL by OldTimer - Version 3.1.37.0 Folder = C:\Documents and Settings\Compaq_Owner\My Documents Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 503.00 Mb Total Physical Memory | 102.00 Mb Available Physical Memory | 20.00% Memory free 1.00 Gb Paging File | 1.00 Gb Available in Paging File | 59.00% Paging File free Paging file location(s): C:\pagefile.sys 756 1512 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 142.07 Gb Total Space | 20.38 Gb Free Space | 14.34% Space Free | Partition Type: NTFS Drive D: | 6.96 Gb Total Space | 2.58 Gb Free Space | 37.03% Space Free | Partition Type: FAT32 Drive E: | 677.09 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: NEW Current User Name: Compaq_Owner Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Documents and Settings\Compaq_Owner\My Documents\OTL.exe (OldTimer Tools) PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.) PRC - C:\Program Files\DivX\DivX Codec\DivXsm.exe (DivX Inc.) PRC - c:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.) PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.) PRC - C:\Program Files\Real\RealPlayer\realplay.exe (RealNetworks, Inc.) PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe (Adobe Systems Incorporated) PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) PRC - C:\Program Files\Electronic Fantasy World\Terminus 6\T6SvcsManager.exe (Electronic Fantasy World) PRC - C:\Program Files\Electronic Fantasy World\Terminus 6\T6CommCenter.exe (Electronic Fantasy World) ========== Modules (SafeList) ========== MOD - C:\Documents and Settings\Compaq_Owner\My Documents\OTL.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (McAfee SiteAdvisor Service) -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.) SRV - (MpfService) -- C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.) SRV - (McODS) -- C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.) SRV - (McShield) -- C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.) SRV - (McSysmon) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.) SRV - (mcmscsvc) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) SRV - (McProxy) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.) SRV - (McNASvc) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.) SRV - (WinDefend) -- C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) SRV - (lxcc_device) -- C:\WINDOWS\System32\lxcccoms.exe (Lexmark International, Inc.) ========== Driver Services (SafeList) ========== DRV - (mfehidk) -- C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.) DRV - (mfeavfk) -- C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.) DRV - (mfesmfk) -- C:\WINDOWS\system32\drivers\mfesmfk.sys (McAfee, Inc.) DRV - (mfebopk) -- C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.) DRV - (mferkdk) -- C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.) DRV - (MPFP) -- C:\WINDOWS\system32\drivers\Mpfp.sys (McAfee, Inc.) DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems) DRV - (HdAudAddService) -- C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows ® Server 2003 DDK provider) DRV - (Pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.) DRV - (Iviaspi) -- C:\WINDOWS\system32\drivers\iviaspi.sys (InterVideo, Inc.) DRV - (rtl8139) -- C:\WINDOWS\system32\drivers\R8139n51.sys (Realtek Semiconductor Corporation ) DRV - (Ps2) -- C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company) ========== Standard Registry (All) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = <local> ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.0 FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.%(version)s FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6 FF - prefs.js..network.proxy.ftp: "<local>" FF - prefs.js..network.proxy.gopher: "<local>" FF - prefs.js..network.proxy.http: "<local>" FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1" FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.socks: "<local>" FF - prefs.js..network.proxy.ssl: "<local>" FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/05/19 16:51:03 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/02/18 00:40:50 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: c:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/06/06 09:39:36 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/02 23:05:54 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/28 10:31:04 | 000,000,000 | ---D | M] [2009/06/10 12:38:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Extensions [2009/06/10 12:38:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/06/10 12:38:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\1bz3acg5.default\extensions [2010/03/20 00:19:24 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2010/01/28 10:31:06 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/08/31 17:01:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [2009/12/14 17:12:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [2010/01/15 23:09:51 | 000,023,000 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll [2010/01/15 23:09:52 | 000,138,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll [2009/10/11 05:17:27 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll [2009/11/13 20:47:38 | 000,098,304 | ---- | M] (DivX, Inc) -- C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll [2010/01/15 23:09:53 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll [2010/01/15 20:13:03 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml [2010/01/15 20:13:03 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml [2010/01/15 20:13:03 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml [2010/01/15 20:13:03 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml [2010/01/15 20:13:03 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml [2010/01/15 20:13:03 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml [2010/01/15 20:13:03 | 000,001,096 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml O1 HOSTS File: ([2010/03/15 14:14:56 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\hdaudpropshortcut.exe (Windows ® Server 2003 DDK provider) O4 - HKLM..\Run: [LXCCCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.DLL () O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.) O4 - HKLM..\Run: [soundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk = C:\Program Files\Compaq Connections\6750491\Program\Compaq Connections.exe (Hewlett-Packard) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\sslaunch.exe (InterMute, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Terminus Command Center.lnk = C:\Program Files\Electronic Fantasy World\Terminus 6\T6CommCenter.exe (Electronic Fantasy World) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Terminus Services Manager.lnk = C:\Program Files\Electronic Fantasy World\Terminus 6\T6SvcsManager.exe (Electronic Fantasy World) O4 - Startup: C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\Compaq Organize.lnk = C:\Program Files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe (NeoPlanet) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html () O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b...heckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl...indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation) O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation) O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation) O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation) O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation) O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation) O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O24 - Desktop Components:0 (My Current Home Page) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (ntoskrnl.dll) - File not found O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation) O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004/10/14 23:38:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2001/07/28 05:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010/03/20 11:08:59 | 000,000,000 | ---D | C] -- C:\_OTL [2010/03/19 13:36:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\My Documents\tdsskiller [2010/03/17 14:22:54 | 003,558,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\moviemk.exe [2010/03/15 14:50:17 | 000,000,000 | -HSD | C] -- C:\RECYCLER [2010/03/15 14:00:06 | 000,000,000 | ---D | C] -- C:\ComboFix [2010/03/12 17:00:48 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2010/03/12 17:00:48 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2010/03/12 17:00:48 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2010/03/12 17:00:48 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2010/03/12 16:56:47 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2010/03/12 16:54:13 | 000,000,000 | ---D | C] -- C:\Qoobox [2010/03/11 22:15:17 | 000,555,520 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\My Documents\OTL.exe [2010/03/07 21:57:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe [2010/03/07 21:56:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Adobe [2010/03/07 00:51:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia [2010/03/07 00:13:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Macromedia [2010/03/07 00:11:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Windows Server [2010/02/26 15:28:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\My Documents\DVDVideoSoft [2010/02/26 15:27:41 | 000,000,000 | ---D | C] -- C:\Program Files\DVDVideoSoft [2010/02/26 15:27:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DVDVideoSoft [2009/09/18 09:55:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\McAfee [2009/05/08 11:52:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\SACore [2009/01/19 18:23:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft [2008/09/01 01:39:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth [2008/08/28 23:44:44 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft [2008/05/20 10:13:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple [2007/05/25 20:36:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Help [2007/05/25 20:36:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Help [2006/08/03 19:25:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Macromedia [2005/03/13 02:26:34 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft [2005/03/13 02:26:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010/03/20 11:04:45 | 012,582,912 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\ntuser.dat [2010/03/20 10:40:39 | 000,016,605 | ---- | M] () -- C:\WINDOWS\System32\Config.MPF [2010/03/20 03:46:15 | 000,031,184 | ---- | M] () -- C:\WINDOWS\T6.TRK [2010/03/20 03:22:32 | 000,003,649 | ---- | M] () -- C:\WINDOWS\viassary-hp.reg [2010/03/20 03:21:34 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010/03/20 03:19:02 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010/03/20 03:19:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010/03/20 03:18:59 | 527,814,656 | -HS- | M] () -- C:\hiberfil.sys [2010/03/20 03:14:30 | 000,014,434 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\H5obFSC7MF62 [2010/03/20 03:14:29 | 000,014,434 | -HS- | M] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\H5obFSC7MF62 [2010/03/20 02:55:55 | 000,237,568 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/03/20 02:21:00 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job [2010/03/19 23:03:09 | 792,723,456 | -HS- | M] () -- C:\pagefile.sys.terminus.adr [2010/03/19 13:35:00 | 000,155,752 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\tdsskiller.zip [2010/03/17 14:25:38 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Compaq_Owner\ntuser.ini [2010/03/15 14:15:08 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2010/03/15 14:14:56 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010/03/15 01:00:00 | 000,000,354 | ---- | M] () -- C:\WINDOWS\tasks\McDefragTask.job [2010/03/14 10:56:46 | 000,382,022 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010/03/14 10:56:46 | 000,053,640 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010/03/14 10:56:44 | 000,441,626 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010/03/12 16:47:47 | 003,888,122 | R--- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\ComboFix.exe [2010/03/11 22:15:34 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\My Documents\OTL.exe [2010/03/09 17:09:41 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\RootkitScanner.exe [2010/03/09 16:28:45 | 000,524,288 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\dds.scr [2010/03/09 16:05:13 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\defogger_reenable [2010/03/07 12:43:55 | 000,000,856 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\regtool.vbs [2010/03/07 12:38:28 | 000,000,610 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\UnHookExec.inf [2010/03/01 02:00:00 | 000,000,346 | ---- | M] () -- C:\WINDOWS\tasks\McQcTask.job [2010/02/26 15:28:32 | 000,000,900 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Desktop\DVDVideoSoft Free Studio.lnk [2010/02/24 10:16:06 | 000,181,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2010/03/20 03:12:03 | 000,014,434 | -HS- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\H5obFSC7MF62 [2010/03/20 03:12:03 | 000,014,434 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\H5obFSC7MF62 [2010/03/19 13:34:57 | 000,155,752 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\tdsskiller.zip [2010/03/19 02:10:05 | 012,582,912 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\ntuser.dat [2010/03/16 15:32:07 | 000,003,649 | ---- | C] () -- C:\WINDOWS\viassary-hp.reg [2010/03/12 17:00:48 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe [2010/03/12 17:00:48 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2010/03/12 17:00:48 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2010/03/12 17:00:48 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe [2010/03/12 17:00:48 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2010/03/12 16:47:33 | 003,888,122 | R--- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\ComboFix.exe [2010/03/09 17:09:36 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\RootkitScanner.exe [2010/03/09 16:28:27 | 000,524,288 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\dds.scr [2010/03/09 16:05:13 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\defogger_reenable [2010/03/07 12:43:54 | 000,000,856 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\regtool.vbs [2010/03/07 12:38:27 | 000,000,610 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\UnHookExec.inf [2010/02/26 15:28:32 | 000,000,900 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Desktop\DVDVideoSoft Free Studio.lnk [2008/04/01 09:10:03 | 000,000,144 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Application Data\wklnhst.dat [2008/03/31 12:25:07 | 000,005,149 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI [2006/08/03 19:32:57 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXPRMON.DLL [2006/08/03 19:32:57 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\LXPMONUI.DLL [2006/06/01 18:10:25 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2005/05/29 22:52:54 | 000,010,086 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2005/05/26 19:54:54 | 000,237,568 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2005/05/26 17:06:44 | 000,000,135 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\fusioncache.dat [2005/03/13 03:21:25 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2005/03/13 03:18:15 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2005/03/13 03:18:15 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2005/03/13 03:18:15 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2005/03/13 03:18:14 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2005/03/13 03:18:14 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2005/03/13 03:18:14 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2005/03/13 02:50:50 | 000,013,975 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS [2005/03/13 02:50:44 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll [2005/03/13 02:50:22 | 000,002,154 | ---- | C] () -- C:\WINDOWS\System32\ssmute.ini [2005/03/13 02:47:26 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2005/03/13 02:35:46 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2005/03/13 02:33:40 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2005/03/13 02:23:51 | 000,000,788 | ---- | C] () -- C:\WINDOWS\orun32.ini [2005/03/13 02:22:42 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\pythoncom22.dll [2005/03/13 02:22:42 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\pywintypes22.dll [2005/03/13 02:22:20 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll [2004/10/26 18:39:05 | 003,375,104 | ---- | C] () -- C:\WINDOWS\System32\qt-mt331.dll [2004/09/13 12:35:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2004/08/19 23:14:46 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\PcdrKernelModeServices.dll [2004/08/19 23:14:46 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\ProgressTrace.dll [2004/08/04 00:00:00 | 001,287,680 | ---- | C] () -- C:\WINDOWS\System32\quartz(2).dll [2004/07/02 08:42:38 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxccvs.dll [2004/06/15 17:38:02 | 000,000,572 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2003/04/10 19:04:00 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\JAWTAccessBridge.dll [2003/01/07 19:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002/01/24 05:29:26 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\lxaxlcnp.dll < End of report >
  3. OTL logfile created on: 3/19/2010 11:56:57 PM - Run 2 OTL by OldTimer - Version 3.1.37.0 Folder = C:\Documents and Settings\Compaq_Owner\My Documents Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 503.00 Mb Total Physical Memory | 175.00 Mb Available Physical Memory | 35.00% Memory free 1.00 Gb Paging File | 1.00 Gb Available in Paging File | 72.00% Paging File free Paging file location(s): C:\pagefile.sys 756 1512 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 142.07 Gb Total Space | 22.07 Gb Free Space | 15.54% Space Free | Partition Type: NTFS Drive D: | 6.96 Gb Total Space | 2.58 Gb Free Space | 37.03% Space Free | Partition Type: FAT32 Drive E: | 677.09 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: NEW Current User Name: Compaq_Owner Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Documents and Settings\Compaq_Owner\My Documents\OTL.exe (OldTimer Tools) PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.) PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.) PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) PRC - C:\Program Files\Electronic Fantasy World\Terminus 6\T6SvcsManager.exe (Electronic Fantasy World) PRC - C:\Program Files\Electronic Fantasy World\Terminus 6\T6CommCenter.exe (Electronic Fantasy World) ========== Modules (SafeList) ========== MOD - C:\Documents and Settings\Compaq_Owner\My Documents\OTL.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (McAfee SiteAdvisor Service) -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.) SRV - (MpfService) -- C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.) SRV - (McODS) -- C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.) SRV - (McShield) -- C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.) SRV - (McSysmon) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.) SRV - (mcmscsvc) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) SRV - (McProxy) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.) SRV - (McNASvc) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.) SRV - (WinDefend) -- C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) SRV - (lxcc_device) -- C:\WINDOWS\System32\lxcccoms.exe (Lexmark International, Inc.) ========== Driver Services (SafeList) ========== DRV - (mfehidk) -- C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.) DRV - (mfeavfk) -- C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.) DRV - (mfesmfk) -- C:\WINDOWS\system32\drivers\mfesmfk.sys (McAfee, Inc.) DRV - (mfebopk) -- C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.) DRV - (mferkdk) -- C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.) DRV - (MPFP) -- C:\WINDOWS\system32\drivers\Mpfp.sys (McAfee, Inc.) DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems) DRV - (HdAudAddService) -- C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows ® Server 2003 DDK provider) DRV - (Pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.) DRV - (Iviaspi) -- C:\WINDOWS\system32\drivers\iviaspi.sys (InterVideo, Inc.) DRV - (rtl8139) -- C:\WINDOWS\system32\drivers\R8139n51.sys (Realtek Semiconductor Corporation ) DRV - (Ps2) -- C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company) ========== Standard Registry (All) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = <local> ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.0 FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.%(version)s FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6 FF - prefs.js..network.proxy.ftp: "<local>" FF - prefs.js..network.proxy.gopher: "<local>" FF - prefs.js..network.proxy.http: "<local>" FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1" FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.socks: "<local>" FF - prefs.js..network.proxy.ssl: "<local>" FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/05/19 16:51:03 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/02/18 00:40:50 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: c:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/06/06 09:39:36 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/02 23:05:54 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/28 10:31:04 | 000,000,000 | ---D | M] [2009/06/10 12:38:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Extensions [2009/06/10 12:38:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/06/10 12:38:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\1bz3acg5.default\extensions [2010/03/19 22:31:14 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2010/01/28 10:31:06 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/08/31 17:01:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [2009/12/14 17:12:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [2010/01/15 23:09:51 | 000,023,000 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll [2010/01/15 23:09:52 | 000,138,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll [2009/10/11 05:17:27 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll [2009/11/13 20:47:38 | 000,098,304 | ---- | M] (DivX, Inc) -- C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll [2010/01/15 23:09:53 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll [2010/01/15 20:13:03 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml [2010/01/15 20:13:03 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml [2010/01/15 20:13:03 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml [2010/01/15 20:13:03 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml [2010/01/15 20:13:03 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml [2010/01/15 20:13:03 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml [2010/01/15 20:13:03 | 000,001,096 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml O1 HOSTS File: ([2010/03/15 14:14:56 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\hdaudpropshortcut.exe (Windows ® Server 2003 DDK provider) O4 - HKLM..\Run: [LXCCCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.DLL () O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.) O4 - HKLM..\Run: [soundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk = C:\Program Files\Compaq Connections\6750491\Program\Compaq Connections.exe (Hewlett-Packard) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\sslaunch.exe (InterMute, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Terminus Command Center.lnk = C:\Program Files\Electronic Fantasy World\Terminus 6\T6CommCenter.exe (Electronic Fantasy World) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Terminus Services Manager.lnk = C:\Program Files\Electronic Fantasy World\Terminus 6\T6SvcsManager.exe (Electronic Fantasy World) O4 - Startup: C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\Compaq Organize.lnk = C:\Program Files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe (NeoPlanet) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html () O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b...heckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl...indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation) O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation) O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation) O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation) O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation) O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation) O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O24 - Desktop Components:0 (My Current Home Page) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (ntoskrnl.dll) - File not found O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation) O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004/10/14 23:38:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2001/07/28 05:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010/03/19 13:36:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\My Documents\tdsskiller [2010/03/17 14:22:54 | 003,558,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\moviemk.exe [2010/03/15 14:50:17 | 000,000,000 | -HSD | C] -- C:\RECYCLER [2010/03/15 14:00:06 | 000,000,000 | ---D | C] -- C:\ComboFix [2010/03/12 17:00:48 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2010/03/12 17:00:48 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2010/03/12 17:00:48 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2010/03/12 17:00:48 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2010/03/12 16:56:47 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2010/03/12 16:54:13 | 000,000,000 | ---D | C] -- C:\Qoobox [2010/03/11 22:15:17 | 000,555,520 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\My Documents\OTL.exe [2010/03/07 21:57:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe [2010/03/07 21:56:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Adobe [2010/03/07 00:51:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia [2010/03/07 00:13:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Macromedia [2010/03/07 00:11:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Windows Server [2010/02/26 15:28:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\My Documents\DVDVideoSoft [2010/02/26 15:27:41 | 000,000,000 | ---D | C] -- C:\Program Files\DVDVideoSoft [2010/02/26 15:27:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DVDVideoSoft [2009/09/18 09:55:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\McAfee [2009/05/08 11:52:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\SACore [2009/01/19 18:23:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft [2008/09/01 01:39:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth [2008/08/28 23:44:44 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft [2008/05/20 10:13:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple [2007/05/25 20:36:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Help [2007/05/25 20:36:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Help [2006/08/03 19:25:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Macromedia [2005/03/13 02:26:34 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft [2005/03/13 02:26:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010/03/19 23:54:43 | 000,031,184 | ---- | M] () -- C:\WINDOWS\T6.TRK [2010/03/19 23:49:45 | 000,016,605 | ---- | M] () -- C:\WINDOWS\System32\Config.MPF [2010/03/19 23:47:25 | 012,582,912 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\ntuser.dat [2010/03/19 23:46:44 | 000,003,649 | ---- | M] () -- C:\WINDOWS\viassary-hp.reg [2010/03/19 23:46:39 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010/03/19 23:46:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010/03/19 23:46:36 | 527,814,656 | -HS- | M] () -- C:\hiberfil.sys [2010/03/19 23:45:15 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Compaq_Owner\ntuser.ini [2010/03/19 23:05:52 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010/03/19 23:03:09 | 792,723,456 | -HS- | M] () -- C:\pagefile.sys.terminus.adr [2010/03/19 22:59:04 | 000,017,390 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\Jd7i63U6u [2010/03/19 22:59:03 | 000,017,390 | -HS- | M] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Jd7i63U6u [2010/03/19 22:51:25 | 000,202,752 | -HS- | M] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\ave.exe [2010/03/19 18:10:46 | 000,238,080 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/03/19 13:35:00 | 000,155,752 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\tdsskiller.zip [2010/03/19 02:34:24 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job [2010/03/15 14:15:08 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2010/03/15 14:14:56 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010/03/15 01:00:00 | 000,000,354 | ---- | M] () -- C:\WINDOWS\tasks\McDefragTask.job [2010/03/14 10:56:46 | 000,382,022 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010/03/14 10:56:46 | 000,053,640 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010/03/14 10:56:44 | 000,441,626 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010/03/12 16:47:47 | 003,888,122 | R--- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\ComboFix.exe [2010/03/11 22:15:34 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\My Documents\OTL.exe [2010/03/09 17:09:41 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\RootkitScanner.exe [2010/03/09 16:28:45 | 000,524,288 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\dds.scr [2010/03/09 16:05:13 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\defogger_reenable [2010/03/07 12:43:55 | 000,000,856 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\regtool.vbs [2010/03/07 12:38:28 | 000,000,610 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\UnHookExec.inf [2010/03/01 02:00:00 | 000,000,346 | ---- | M] () -- C:\WINDOWS\tasks\McQcTask.job [2010/02/26 15:28:32 | 000,000,900 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Desktop\DVDVideoSoft Free Studio.lnk [2010/02/24 10:16:06 | 000,181,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2099/01/01 12:00:00 | 000,006,456 | -H-- | C] () -- C:\WINDOWS\System32\vefebuku [2010/03/19 22:51:25 | 000,202,752 | -HS- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\ave.exe [2010/03/19 22:51:25 | 000,017,390 | -HS- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Jd7i63U6u [2010/03/19 22:51:25 | 000,017,390 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\Jd7i63U6u [2010/03/19 13:34:57 | 000,155,752 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\tdsskiller.zip [2010/03/19 02:10:05 | 012,582,912 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\ntuser.dat [2010/03/16 15:32:07 | 000,003,649 | ---- | C] () -- C:\WINDOWS\viassary-hp.reg [2010/03/12 17:00:48 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe [2010/03/12 17:00:48 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2010/03/12 17:00:48 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2010/03/12 17:00:48 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe [2010/03/12 17:00:48 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2010/03/12 16:47:33 | 003,888,122 | R--- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\ComboFix.exe [2010/03/09 17:09:36 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\RootkitScanner.exe [2010/03/09 16:28:27 | 000,524,288 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\dds.scr [2010/03/09 16:05:13 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\defogger_reenable [2010/03/07 12:43:54 | 000,000,856 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\regtool.vbs [2010/03/07 12:38:27 | 000,000,610 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\UnHookExec.inf [2010/02/26 15:28:32 | 000,000,900 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Desktop\DVDVideoSoft Free Studio.lnk [2008/04/01 09:10:03 | 000,000,144 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Application Data\wklnhst.dat [2008/03/31 12:25:07 | 000,005,149 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI [2006/08/03 19:32:57 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXPRMON.DLL [2006/08/03 19:32:57 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\LXPMONUI.DLL [2006/06/01 18:10:25 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2005/05/29 22:52:54 | 000,010,086 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2005/05/26 19:54:54 | 000,238,080 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2005/05/26 17:06:44 | 000,000,135 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\fusioncache.dat [2005/03/13 03:21:25 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2005/03/13 03:18:15 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2005/03/13 03:18:15 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2005/03/13 03:18:15 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2005/03/13 03:18:14 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2005/03/13 03:18:14 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2005/03/13 03:18:14 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2005/03/13 02:50:50 | 000,013,975 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS [2005/03/13 02:50:44 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll [2005/03/13 02:50:22 | 000,002,154 | ---- | C] () -- C:\WINDOWS\System32\ssmute.ini [2005/03/13 02:47:26 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2005/03/13 02:35:46 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2005/03/13 02:33:40 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2005/03/13 02:23:51 | 000,000,788 | ---- | C] () -- C:\WINDOWS\orun32.ini [2005/03/13 02:22:42 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\pythoncom22.dll [2005/03/13 02:22:42 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\pywintypes22.dll [2005/03/13 02:22:20 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll [2004/10/26 18:39:05 | 003,375,104 | ---- | C] () -- C:\WINDOWS\System32\qt-mt331.dll [2004/09/13 12:35:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2004/08/19 23:14:46 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\PcdrKernelModeServices.dll [2004/08/19 23:14:46 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\ProgressTrace.dll [2004/08/04 00:00:00 | 001,287,680 | ---- | C] () -- C:\WINDOWS\System32\quartz(2).dll [2004/07/02 08:42:38 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxccvs.dll [2004/06/15 17:38:02 | 000,000,572 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2003/04/10 19:04:00 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\JAWTAccessBridge.dll [2003/01/07 19:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002/01/24 05:29:26 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\lxaxlcnp.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 356 bytes -> C:\WINDOWS\System32\drivers\pcesbimb.sys:changelist @Alternate Data Stream - 352 bytes -> C:\WINDOWS\System32\drivers\rjxkmitn.sys:changelist < End of report >
  4. If you are concerned about the part that says there's a Memory Object infected but not cured on reboot, I have run it again and that no longer is the result. Here is the relevant new result Memory objects infected / cured / cured on reboot: 0 / 0 / 0 Registry objects infected / cured / cured on reboot: 0 / 0 / 0 File objects infected / cured / cured on reboot: 0 / 0 / 0
  5. 13:37:25:171 1832 TDSS rootkit removing tool 2.2.8 Mar 10 2010 15:53:20 13:37:25:171 1832 ================================================================================ 13:37:25:171 1832 SystemInfo: 13:37:25:171 1832 OS Version: 5.1.2600 ServicePack: 3.0 13:37:25:171 1832 Product type: Workstation 13:37:25:171 1832 ComputerName: NEW 13:37:25:187 1832 UserName: Compaq_Owner 13:37:25:187 1832 Windows directory: C:\WINDOWS 13:37:25:187 1832 Processor architecture: Intel x86 13:37:25:187 1832 Number of processors: 1 13:37:25:187 1832 Page size: 0x1000 13:37:25:187 1832 Boot type: Normal boot 13:37:25:187 1832 ================================================================================ 13:37:25:281 1832 UnloadDriverW: NtUnloadDriver error 2 13:37:25:281 1832 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2 13:37:25:421 1832 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system 13:37:25:421 1832 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 13:37:25:421 1832 wfopen_ex: Trying to KLMD file open 13:37:25:421 1832 wfopen_ex: File opened ok (Flags 2) 13:37:25:421 1832 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software 13:37:25:421 1832 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 13:37:25:421 1832 wfopen_ex: Trying to KLMD file open 13:37:25:421 1832 wfopen_ex: File opened ok (Flags 2) 13:37:25:421 1832 Initialize success 13:37:25:421 1832 13:37:25:421 1832 Scanning Services ... 13:37:26:015 1832 GetAdvancedServicesInfo: Raw services enum returned 311 services 13:37:26:015 1832 13:37:26:015 1832 Scanning Kernel memory ... 13:37:26:015 1832 Devices to scan: 11 13:37:26:015 1832 13:37:26:015 1832 Driver Name: Disk 13:37:26:015 1832 IRP_MJ_CREATE : F85B9BB0 13:37:26:015 1832 IRP_MJ_CREATE_NAMED_PIPE : 804F355A 13:37:26:015 1832 IRP_MJ_CLOSE : F85B9BB0 13:37:26:015 1832 IRP_MJ_READ : F85B3D1F 13:37:26:015 1832 IRP_MJ_WRITE : F85B3D1F 13:37:26:015 1832 IRP_MJ_QUERY_INFORMATION : 804F355A 13:37:26:015 1832 IRP_MJ_SET_INFORMATION : 804F355A 13:37:26:015 1832 IRP_MJ_QUERY_EA : 804F355A 13:37:26:015 1832 IRP_MJ_SET_EA : 804F355A 13:37:26:015 1832 IRP_MJ_FLUSH_BUFFERS : F85B42E2 13:37:26:015 1832 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F355A 13:37:26:015 1832 IRP_MJ_SET_VOLUME_INFORMATION : 804F355A 13:37:26:015 1832 IRP_MJ_DIRECTORY_CONTROL : 804F355A 13:37:26:015 1832 IRP_MJ_FILE_SYSTEM_CONTROL : 804F355A 13:37:26:015 1832 IRP_MJ_DEVICE_CONTROL : F85B43BB 13:37:26:015 1832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F85B7F28 13:37:26:015 1832 IRP_MJ_SHUTDOWN : F85B42E2 13:37:26:015 1832 IRP_MJ_LOCK_CONTROL : 804F355A 13:37:26:015 1832 IRP_MJ_CLEANUP : 804F355A 13:37:26:015 1832 IRP_MJ_CREATE_MAILSLOT : 804F355A 13:37:26:015 1832 IRP_MJ_QUERY_SECURITY : 804F355A 13:37:26:015 1832 IRP_MJ_SET_SECURITY : 804F355A 13:37:26:015 1832 IRP_MJ_POWER : F85B5C82 13:37:26:015 1832 IRP_MJ_SYSTEM_CONTROL : F85BA99E 13:37:26:015 1832 IRP_MJ_DEVICE_CHANGE : 804F355A 13:37:26:015 1832 IRP_MJ_QUERY_QUOTA : 804F355A 13:37:26:015 1832 IRP_MJ_SET_QUOTA : 804F355A 13:37:26:031 1832 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 13:37:26:031 1832 13:37:26:031 1832 Driver Name: Disk 13:37:26:031 1832 IRP_MJ_CREATE : F85B9BB0 13:37:26:031 1832 IRP_MJ_CREATE_NAMED_PIPE : 804F355A 13:37:26:031 1832 IRP_MJ_CLOSE : F85B9BB0 13:37:26:031 1832 IRP_MJ_READ : F85B3D1F 13:37:26:031 1832 IRP_MJ_WRITE : F85B3D1F 13:37:26:031 1832 IRP_MJ_QUERY_INFORMATION : 804F355A 13:37:26:031 1832 IRP_MJ_SET_INFORMATION : 804F355A 13:37:26:031 1832 IRP_MJ_QUERY_EA : 804F355A 13:37:26:031 1832 IRP_MJ_SET_EA : 804F355A 13:37:26:031 1832 IRP_MJ_FLUSH_BUFFERS : F85B42E2 13:37:26:031 1832 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F355A 13:37:26:031 1832 IRP_MJ_SET_VOLUME_INFORMATION : 804F355A 13:37:26:031 1832 IRP_MJ_DIRECTORY_CONTROL : 804F355A 13:37:26:031 1832 IRP_MJ_FILE_SYSTEM_CONTROL : 804F355A 13:37:26:031 1832 IRP_MJ_DEVICE_CONTROL : F85B43BB 13:37:26:031 1832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F85B7F28 13:37:26:031 1832 IRP_MJ_SHUTDOWN : F85B42E2 13:37:26:031 1832 IRP_MJ_LOCK_CONTROL : 804F355A 13:37:26:031 1832 IRP_MJ_CLEANUP : 804F355A 13:37:26:031 1832 IRP_MJ_CREATE_MAILSLOT : 804F355A 13:37:26:031 1832 IRP_MJ_QUERY_SECURITY : 804F355A 13:37:26:031 1832 IRP_MJ_SET_SECURITY : 804F355A 13:37:26:031 1832 IRP_MJ_POWER : F85B5C82 13:37:26:031 1832 IRP_MJ_SYSTEM_CONTROL : F85BA99E 13:37:26:031 1832 IRP_MJ_DEVICE_CHANGE : 804F355A 13:37:26:031 1832 IRP_MJ_QUERY_QUOTA : 804F355A 13:37:26:031 1832 IRP_MJ_SET_QUOTA : 804F355A 13:37:26:031 1832 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 13:37:26:031 1832 13:37:26:031 1832 Driver Name: Disk 13:37:26:031 1832 IRP_MJ_CREATE : F85B9BB0 13:37:26:031 1832 IRP_MJ_CREATE_NAMED_PIPE : 804F355A 13:37:26:031 1832 IRP_MJ_CLOSE : F85B9BB0 13:37:26:031 1832 IRP_MJ_READ : F85B3D1F 13:37:26:031 1832 IRP_MJ_WRITE : F85B3D1F 13:37:26:031 1832 IRP_MJ_QUERY_INFORMATION : 804F355A 13:37:26:031 1832 IRP_MJ_SET_INFORMATION : 804F355A 13:37:26:031 1832 IRP_MJ_QUERY_EA : 804F355A 13:37:26:031 1832 IRP_MJ_SET_EA : 804F355A 13:37:26:031 1832 IRP_MJ_FLUSH_BUFFERS : F85B42E2 13:37:26:031 1832 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F355A 13:37:26:031 1832 IRP_MJ_SET_VOLUME_INFORMATION : 804F355A 13:37:26:031 1832 IRP_MJ_DIRECTORY_CONTROL : 804F355A 13:37:26:031 1832 IRP_MJ_FILE_SYSTEM_CONTROL : 804F355A 13:37:26:031 1832 IRP_MJ_DEVICE_CONTROL : F85B43BB 13:37:26:031 1832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F85B7F28 13:37:26:031 1832 IRP_MJ_SHUTDOWN : F85B42E2 13:37:26:031 1832 IRP_MJ_LOCK_CONTROL : 804F355A 13:37:26:031 1832 IRP_MJ_CLEANUP : 804F355A 13:37:26:031 1832 IRP_MJ_CREATE_MAILSLOT : 804F355A 13:37:26:031 1832 IRP_MJ_QUERY_SECURITY : 804F355A 13:37:26:031 1832 IRP_MJ_SET_SECURITY : 804F355A 13:37:26:031 1832 IRP_MJ_POWER : F85B5C82 13:37:26:031 1832 IRP_MJ_SYSTEM_CONTROL : F85BA99E 13:37:26:031 1832 IRP_MJ_DEVICE_CHANGE : 804F355A 13:37:26:031 1832 IRP_MJ_QUERY_QUOTA : 804F355A 13:37:26:031 1832 IRP_MJ_SET_QUOTA : 804F355A 13:37:26:031 1832 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 13:37:26:031 1832 13:37:26:031 1832 Driver Name: Disk 13:37:26:031 1832 IRP_MJ_CREATE : F85B9BB0 13:37:26:031 1832 IRP_MJ_CREATE_NAMED_PIPE : 804F355A 13:37:26:031 1832 IRP_MJ_CLOSE : F85B9BB0 13:37:26:031 1832 IRP_MJ_READ : F85B3D1F 13:37:26:031 1832 IRP_MJ_WRITE : F85B3D1F 13:37:26:031 1832 IRP_MJ_QUERY_INFORMATION : 804F355A 13:37:26:031 1832 IRP_MJ_SET_INFORMATION : 804F355A 13:37:26:031 1832 IRP_MJ_QUERY_EA : 804F355A 13:37:26:031 1832 IRP_MJ_SET_EA : 804F355A 13:37:26:031 1832 IRP_MJ_FLUSH_BUFFERS : F85B42E2 13:37:26:031 1832 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F355A 13:37:26:031 1832 IRP_MJ_SET_VOLUME_INFORMATION : 804F355A 13:37:26:031 1832 IRP_MJ_DIRECTORY_CONTROL : 804F355A 13:37:26:046 1832 IRP_MJ_FILE_SYSTEM_CONTROL : 804F355A 13:37:26:046 1832 IRP_MJ_DEVICE_CONTROL : F85B43BB 13:37:26:046 1832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F85B7F28 13:37:26:046 1832 IRP_MJ_SHUTDOWN : F85B42E2 13:37:26:046 1832 IRP_MJ_LOCK_CONTROL : 804F355A 13:37:26:046 1832 IRP_MJ_CLEANUP : 804F355A 13:37:26:046 1832 IRP_MJ_CREATE_MAILSLOT : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_SECURITY : 804F355A 13:37:26:046 1832 IRP_MJ_SET_SECURITY : 804F355A 13:37:26:046 1832 IRP_MJ_POWER : F85B5C82 13:37:26:046 1832 IRP_MJ_SYSTEM_CONTROL : F85BA99E 13:37:26:046 1832 IRP_MJ_DEVICE_CHANGE : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_QUOTA : 804F355A 13:37:26:046 1832 IRP_MJ_SET_QUOTA : 804F355A 13:37:26:046 1832 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 13:37:26:046 1832 13:37:26:046 1832 Driver Name: USBSTOR 13:37:26:046 1832 IRP_MJ_CREATE : F8838218 13:37:26:046 1832 IRP_MJ_CREATE_NAMED_PIPE : 804F355A 13:37:26:046 1832 IRP_MJ_CLOSE : F8838218 13:37:26:046 1832 IRP_MJ_READ : F883823C 13:37:26:046 1832 IRP_MJ_WRITE : F883823C 13:37:26:046 1832 IRP_MJ_QUERY_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_SET_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_EA : 804F355A 13:37:26:046 1832 IRP_MJ_SET_EA : 804F355A 13:37:26:046 1832 IRP_MJ_FLUSH_BUFFERS : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_SET_VOLUME_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_DIRECTORY_CONTROL : 804F355A 13:37:26:046 1832 IRP_MJ_FILE_SYSTEM_CONTROL : 804F355A 13:37:26:046 1832 IRP_MJ_DEVICE_CONTROL : F8838180 13:37:26:046 1832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F88339E6 13:37:26:046 1832 IRP_MJ_SHUTDOWN : 804F355A 13:37:26:046 1832 IRP_MJ_LOCK_CONTROL : 804F355A 13:37:26:046 1832 IRP_MJ_CLEANUP : 804F355A 13:37:26:046 1832 IRP_MJ_CREATE_MAILSLOT : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_SECURITY : 804F355A 13:37:26:046 1832 IRP_MJ_SET_SECURITY : 804F355A 13:37:26:046 1832 IRP_MJ_POWER : F88375F0 13:37:26:046 1832 IRP_MJ_SYSTEM_CONTROL : F8835A6E 13:37:26:046 1832 IRP_MJ_DEVICE_CHANGE : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_QUOTA : 804F355A 13:37:26:046 1832 IRP_MJ_SET_QUOTA : 804F355A 13:37:26:046 1832 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1 13:37:26:046 1832 13:37:26:046 1832 Driver Name: USBSTOR 13:37:26:046 1832 IRP_MJ_CREATE : F8838218 13:37:26:046 1832 IRP_MJ_CREATE_NAMED_PIPE : 804F355A 13:37:26:046 1832 IRP_MJ_CLOSE : F8838218 13:37:26:046 1832 IRP_MJ_READ : F883823C 13:37:26:046 1832 IRP_MJ_WRITE : F883823C 13:37:26:046 1832 IRP_MJ_QUERY_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_SET_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_EA : 804F355A 13:37:26:046 1832 IRP_MJ_SET_EA : 804F355A 13:37:26:046 1832 IRP_MJ_FLUSH_BUFFERS : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_SET_VOLUME_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_DIRECTORY_CONTROL : 804F355A 13:37:26:046 1832 IRP_MJ_FILE_SYSTEM_CONTROL : 804F355A 13:37:26:046 1832 IRP_MJ_DEVICE_CONTROL : F8838180 13:37:26:046 1832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F88339E6 13:37:26:046 1832 IRP_MJ_SHUTDOWN : 804F355A 13:37:26:046 1832 IRP_MJ_LOCK_CONTROL : 804F355A 13:37:26:046 1832 IRP_MJ_CLEANUP : 804F355A 13:37:26:046 1832 IRP_MJ_CREATE_MAILSLOT : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_SECURITY : 804F355A 13:37:26:046 1832 IRP_MJ_SET_SECURITY : 804F355A 13:37:26:046 1832 IRP_MJ_POWER : F88375F0 13:37:26:046 1832 IRP_MJ_SYSTEM_CONTROL : F8835A6E 13:37:26:046 1832 IRP_MJ_DEVICE_CHANGE : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_QUOTA : 804F355A 13:37:26:046 1832 IRP_MJ_SET_QUOTA : 804F355A 13:37:26:046 1832 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1 13:37:26:046 1832 13:37:26:046 1832 Driver Name: USBSTOR 13:37:26:046 1832 IRP_MJ_CREATE : F8838218 13:37:26:046 1832 IRP_MJ_CREATE_NAMED_PIPE : 804F355A 13:37:26:046 1832 IRP_MJ_CLOSE : F8838218 13:37:26:046 1832 IRP_MJ_READ : F883823C 13:37:26:046 1832 IRP_MJ_WRITE : F883823C 13:37:26:046 1832 IRP_MJ_QUERY_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_SET_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_EA : 804F355A 13:37:26:046 1832 IRP_MJ_SET_EA : 804F355A 13:37:26:046 1832 IRP_MJ_FLUSH_BUFFERS : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_SET_VOLUME_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_DIRECTORY_CONTROL : 804F355A 13:37:26:046 1832 IRP_MJ_FILE_SYSTEM_CONTROL : 804F355A 13:37:26:046 1832 IRP_MJ_DEVICE_CONTROL : F8838180 13:37:26:046 1832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F88339E6 13:37:26:046 1832 IRP_MJ_SHUTDOWN : 804F355A 13:37:26:046 1832 IRP_MJ_LOCK_CONTROL : 804F355A 13:37:26:046 1832 IRP_MJ_CLEANUP : 804F355A 13:37:26:046 1832 IRP_MJ_CREATE_MAILSLOT : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_SECURITY : 804F355A 13:37:26:046 1832 IRP_MJ_SET_SECURITY : 804F355A 13:37:26:046 1832 IRP_MJ_POWER : F88375F0 13:37:26:046 1832 IRP_MJ_SYSTEM_CONTROL : F8835A6E 13:37:26:046 1832 IRP_MJ_DEVICE_CHANGE : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_QUOTA : 804F355A 13:37:26:046 1832 IRP_MJ_SET_QUOTA : 804F355A 13:37:26:046 1832 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1 13:37:26:046 1832 13:37:26:046 1832 Driver Name: USBSTOR 13:37:26:046 1832 IRP_MJ_CREATE : F8838218 13:37:26:046 1832 IRP_MJ_CREATE_NAMED_PIPE : 804F355A 13:37:26:046 1832 IRP_MJ_CLOSE : F8838218 13:37:26:046 1832 IRP_MJ_READ : F883823C 13:37:26:046 1832 IRP_MJ_WRITE : F883823C 13:37:26:046 1832 IRP_MJ_QUERY_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_SET_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_EA : 804F355A 13:37:26:046 1832 IRP_MJ_SET_EA : 804F355A 13:37:26:046 1832 IRP_MJ_FLUSH_BUFFERS : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_SET_VOLUME_INFORMATION : 804F355A 13:37:26:046 1832 IRP_MJ_DIRECTORY_CONTROL : 804F355A 13:37:26:046 1832 IRP_MJ_FILE_SYSTEM_CONTROL : 804F355A 13:37:26:046 1832 IRP_MJ_DEVICE_CONTROL : F8838180 13:37:26:046 1832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F88339E6 13:37:26:046 1832 IRP_MJ_SHUTDOWN : 804F355A 13:37:26:046 1832 IRP_MJ_LOCK_CONTROL : 804F355A 13:37:26:046 1832 IRP_MJ_CLEANUP : 804F355A 13:37:26:046 1832 IRP_MJ_CREATE_MAILSLOT : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_SECURITY : 804F355A 13:37:26:046 1832 IRP_MJ_SET_SECURITY : 804F355A 13:37:26:046 1832 IRP_MJ_POWER : F88375F0 13:37:26:046 1832 IRP_MJ_SYSTEM_CONTROL : F8835A6E 13:37:26:046 1832 IRP_MJ_DEVICE_CHANGE : 804F355A 13:37:26:046 1832 IRP_MJ_QUERY_QUOTA : 804F355A 13:37:26:046 1832 IRP_MJ_SET_QUOTA : 804F355A 13:37:26:062 1832 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: 1 13:37:26:062 1832 13:37:26:062 1832 Driver Name: Disk 13:37:26:062 1832 IRP_MJ_CREATE : F85B9BB0 13:37:26:062 1832 IRP_MJ_CREATE_NAMED_PIPE : 804F355A 13:37:26:062 1832 IRP_MJ_CLOSE : F85B9BB0 13:37:26:062 1832 IRP_MJ_READ : F85B3D1F 13:37:26:062 1832 IRP_MJ_WRITE : F85B3D1F 13:37:26:062 1832 IRP_MJ_QUERY_INFORMATION : 804F355A 13:37:26:062 1832 IRP_MJ_SET_INFORMATION : 804F355A 13:37:26:062 1832 IRP_MJ_QUERY_EA : 804F355A 13:37:26:062 1832 IRP_MJ_SET_EA : 804F355A 13:37:26:062 1832 IRP_MJ_FLUSH_BUFFERS : F85B42E2 13:37:26:062 1832 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F355A 13:37:26:062 1832 IRP_MJ_SET_VOLUME_INFORMATION : 804F355A 13:37:26:062 1832 IRP_MJ_DIRECTORY_CONTROL : 804F355A 13:37:26:062 1832 IRP_MJ_FILE_SYSTEM_CONTROL : 804F355A 13:37:26:062 1832 IRP_MJ_DEVICE_CONTROL : F85B43BB 13:37:26:062 1832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F85B7F28 13:37:26:062 1832 IRP_MJ_SHUTDOWN : F85B42E2 13:37:26:062 1832 IRP_MJ_LOCK_CONTROL : 804F355A 13:37:26:062 1832 IRP_MJ_CLEANUP : 804F355A 13:37:26:062 1832 IRP_MJ_CREATE_MAILSLOT : 804F355A 13:37:26:062 1832 IRP_MJ_QUERY_SECURITY : 804F355A 13:37:26:062 1832 IRP_MJ_SET_SECURITY : 804F355A 13:37:26:062 1832 IRP_MJ_POWER : F85B5C82 13:37:26:062 1832 IRP_MJ_SYSTEM_CONTROL : F85BA99E 13:37:26:062 1832 IRP_MJ_DEVICE_CHANGE : 804F355A 13:37:26:062 1832 IRP_MJ_QUERY_QUOTA : 804F355A 13:37:26:062 1832 IRP_MJ_SET_QUOTA : 804F355A 13:37:26:062 1832 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 13:37:26:062 1832 13:37:26:062 1832 Driver Name: Disk 13:37:26:062 1832 IRP_MJ_CREATE : F85B9BB0 13:37:26:062 1832 IRP_MJ_CREATE_NAMED_PIPE : 804F355A 13:37:26:062 1832 IRP_MJ_CLOSE : F85B9BB0 13:37:26:062 1832 IRP_MJ_READ : F85B3D1F 13:37:26:062 1832 IRP_MJ_WRITE : F85B3D1F 13:37:26:062 1832 IRP_MJ_QUERY_INFORMATION : 804F355A 13:37:26:062 1832 IRP_MJ_SET_INFORMATION : 804F355A 13:37:26:062 1832 IRP_MJ_QUERY_EA : 804F355A 13:37:26:062 1832 IRP_MJ_SET_EA : 804F355A 13:37:26:062 1832 IRP_MJ_FLUSH_BUFFERS : F85B42E2 13:37:26:062 1832 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F355A 13:37:26:062 1832 IRP_MJ_SET_VOLUME_INFORMATION : 804F355A 13:37:26:062 1832 IRP_MJ_DIRECTORY_CONTROL : 804F355A 13:37:26:062 1832 IRP_MJ_FILE_SYSTEM_CONTROL : 804F355A 13:37:26:062 1832 IRP_MJ_DEVICE_CONTROL : F85B43BB 13:37:26:062 1832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F85B7F28 13:37:26:062 1832 IRP_MJ_SHUTDOWN : F85B42E2 13:37:26:062 1832 IRP_MJ_LOCK_CONTROL : 804F355A 13:37:26:062 1832 IRP_MJ_CLEANUP : 804F355A 13:37:26:062 1832 IRP_MJ_CREATE_MAILSLOT : 804F355A 13:37:26:062 1832 IRP_MJ_QUERY_SECURITY : 804F355A 13:37:26:062 1832 IRP_MJ_SET_SECURITY : 804F355A 13:37:26:062 1832 IRP_MJ_POWER : F85B5C82 13:37:26:062 1832 IRP_MJ_SYSTEM_CONTROL : F85BA99E 13:37:26:062 1832 IRP_MJ_DEVICE_CHANGE : 804F355A 13:37:26:062 1832 IRP_MJ_QUERY_QUOTA : 804F355A 13:37:26:062 1832 IRP_MJ_SET_QUOTA : 804F355A 13:37:26:062 1832 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: 1 13:37:26:062 1832 13:37:26:062 1832 Driver Name: atapi 13:37:26:062 1832 IRP_MJ_CREATE : F8405B3A 13:37:26:062 1832 IRP_MJ_CREATE_NAMED_PIPE : F8405B3A 13:37:26:062 1832 IRP_MJ_CLOSE : F8405B3A 13:37:26:062 1832 IRP_MJ_READ : F8405B3A 13:37:26:062 1832 IRP_MJ_WRITE : F8405B3A 13:37:26:062 1832 IRP_MJ_QUERY_INFORMATION : F8405B3A 13:37:26:062 1832 IRP_MJ_SET_INFORMATION : F8405B3A 13:37:26:062 1832 IRP_MJ_QUERY_EA : F8405B3A 13:37:26:062 1832 IRP_MJ_SET_EA : F8405B3A 13:37:26:062 1832 IRP_MJ_FLUSH_BUFFERS : F8405B3A 13:37:26:062 1832 IRP_MJ_QUERY_VOLUME_INFORMATION : F8405B3A 13:37:26:062 1832 IRP_MJ_SET_VOLUME_INFORMATION : F8405B3A 13:37:26:062 1832 IRP_MJ_DIRECTORY_CONTROL : F8405B3A 13:37:26:062 1832 IRP_MJ_FILE_SYSTEM_CONTROL : F8405B3A 13:37:26:062 1832 IRP_MJ_DEVICE_CONTROL : F8405B3A 13:37:26:062 1832 IRP_MJ_INTERNAL_DEVICE_CONTROL : F8405B3A 13:37:26:062 1832 IRP_MJ_SHUTDOWN : F8405B3A 13:37:26:062 1832 IRP_MJ_LOCK_CONTROL : F8405B3A 13:37:26:062 1832 IRP_MJ_CLEANUP : F8405B3A 13:37:26:062 1832 IRP_MJ_CREATE_MAILSLOT : F8405B3A 13:37:26:062 1832 IRP_MJ_QUERY_SECURITY : F8405B3A 13:37:26:062 1832 IRP_MJ_SET_SECURITY : F8405B3A 13:37:26:062 1832 IRP_MJ_POWER : F8405B3A 13:37:26:062 1832 IRP_MJ_SYSTEM_CONTROL : F8405B3A 13:37:26:062 1832 IRP_MJ_DEVICE_CHANGE : F8405B3A 13:37:26:062 1832 IRP_MJ_QUERY_QUOTA : F8405B3A 13:37:26:062 1832 IRP_MJ_SET_QUOTA : F8405B3A 13:37:26:062 1832 Driver "atapi" infected by TDSS rootkit! 13:37:26:078 1832 C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: 1 13:37:26:078 1832 File "C:\WINDOWS\system32\DRIVERS\atapi.sys" infected by TDSS rootkit ... 13:37:26:078 1832 Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys 13:37:26:078 1832 ProcessDirEnumEx: FindFirstFile(C:\WINDOWS\system32\DriverStore\FileRepository\*) error 3 13:37:26:312 1832 vfvi6 13:37:26:500 1832 !dsvbh1 13:37:29:515 1832 dsvbh2 13:37:29:515 1832 fdfb2 13:37:29:515 1832 Backup copy found, using it.. 13:37:29:562 1832 will be cured on next reboot 13:37:29:562 1832 Reboot required for cure complete.. 13:37:29:703 1832 Cure on reboot scheduled successfully 13:37:29:703 1832 13:37:29:703 1832 Completed 13:37:29:703 1832 13:37:29:703 1832 Results: 13:37:29:703 1832 Memory objects infected / cured / cured on reboot: 1 / 0 / 0 13:37:29:703 1832 Registry objects infected / cured / cured on reboot: 0 / 0 / 0 13:37:29:703 1832 File objects infected / cured / cured on reboot: 1 / 0 / 1 13:37:29:703 1832 13:37:29:703 1832 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system 13:37:29:703 1832 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software 13:37:29:703 1832 UnloadDriverW: NtUnloadDriver error 1 13:37:29:703 1832 KLMD_Unload: UnloadDriverW(klmd21) error 1 13:37:29:859 1832 KLMD(ARK) unloaded successfully
  6. Wcatia.exe is a thing that MBAM said it would delete on reboot. I didn't do the reboot, but on the next scan it wasn't there. I just searched my computer and something with Wcatia in the name was in the prefetch folder. Should I delete that item?
  7. Malwarebytes' Anti-Malware 1.44 Database version: 3874 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 3/17/2010 9:55:25 PM mbam-log-2010-03-17 (21-55-25).txt Scan type: Quick Scan Objects scanned: 123725 Time elapsed: 11 minute(s), 58 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 3 Registry Values Infected: 2 Registry Data Items Infected: 3 Folders Infected: 0 Files Infected: 4 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\TOY5KNQ8OC (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\WEK9EMDHI9 (Trojan.Agent) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wek9emdhi9 (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\toy5knq8oc (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 93.188.162.10,93.188.166.94 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{07e638c8-b22b-4c0b-a143-fb62483d8505}\DhcpNameServer (Trojan.DNSChanger) -> Data: 93.188.162.10,93.188.166.94 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{6df2e62b-299d-4800-a278-9a8d09713632}\NameServer (Trojan.DNSChanger) -> Data: 93.188.162.10,93.188.166.94 -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\Wcatia.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\system32\spool\prtprocs\w32x86\000002ed.tmp (Trojan.FakeAlert) -> Delete on reboot. ________________________________________________________________________________ ________________ Next scan produced this Malwarebytes' Anti-Malware 1.44 Database version: 3874 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 3/18/2010 1:56:02 AM mbam-log-2010-03-18 (01-56-02).txt Scan type: Quick Scan Objects scanned: 123795 Time elapsed: 24 minute(s), 30 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\Software\WEK9EMDHI9 (Trojan.Agent) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\system32\spool\prtprocs\w32x86\000002ed.tmp (Trojan.FakeAlert) -> Delete on reboot. ________________________________________________________________________________ _______________ 6 scans since have produced nothing. But the re-directs from google searches and occasional random opening of new windows are still happening. Not the machine-killer that the original problem was, but still a problem.
  8. Things have changed since I said everything was running well and MBAM was finding nothing. When I google then ckick on a result most of the time I get re-directed. A new browser window sometimes open on its own. I ran MBAM and it found either 14 or 16 things. None of them said Dr. Guard. It got rid of all but 2 of them, which it said would be deleted on reboot. However, I mistaken clicked No when asked to reboot. This apparently means that no log is produced either. On subsequent scan these 2 things weren't found. MBAM doesn't assume that because the user has chosen not to reboot that those items are okay and allows them, does it? I followed the instructions but could not find vefebuku . I used Search to search my entire drive for it in case I missed it. Yes, I did what you said regarding hidden files and folders first. The scan for the first file found nothing. There doesn't seem to be any report, just all the listed scanners "found nothing". When I entered the next file Jotti's kept saying it was the same as the previous file, so I used the other scanner and the report will be below. The third file could not be found. I used Search again, the only place it was located was the Qoobox folder. If that is the Quarantine folder shouldn't I delete it? If it's full of all these crazy things that infected my computer wouldn't it be best to get rid of it lest the things get out? Or does it not work that way? File rjxkmitn.sys received on 2010.03.18 22:12:24 (UTC) Antivirus Version Last Update Result a-squared 4.5.0.50 2010.03.18 - AhnLab-V3 5.0.0.2 2010.03.18 - AntiVir 8.2.1.194 2010.03.18 - Antiy-AVL 2.0.3.7 2010.03.18 - Authentium 5.2.0.5 2010.03.18 - Avast 4.8.1351.0 2010.03.18 - Avast5 5.0.332.0 2010.03.18 - AVG 9.0.0.787 2010.03.18 - BitDefender 7.2 2010.03.18 - CAT-QuickHeal 10.00 2010.03.18 - ClamAV 0.96.0.0-git 2010.03.18 - Comodo 4308 2010.03.18 - DrWeb 5.0.1.12222 2010.03.18 - eSafe 7.0.17.0 2010.03.18 - eTrust-Vet 35.2.7373 2010.03.18 - F-Prot 4.5.1.85 2010.03.18 - F-Secure 9.0.15370.0 2010.03.18 - Fortinet 4.0.14.0 2010.03.18 - GData 19 2010.03.18 - Ikarus T3.1.1.80.0 2010.03.18 - Jiangmin 13.0.900 2010.03.18 - K7AntiVirus 7.10.1001 2010.03.18 - McAfee 5924 2010.03.18 - McAfee+Artemis 5924 2010.03.18 - McAfee-GW-Edition 6.8.5 2010.03.18 - Microsoft 1.5605 2010.03.18 - NOD32 4956 2010.03.18 - Norman 6.04.09 2010.03.18 - nProtect 2009.1.8.0 2010.03.18 - Panda 10.0.2.2 2010.03.18 - PCTools 7.0.3.5 2010.03.18 - Rising 22.39.03.04 2010.03.18 - Sophos 4.51.0 2010.03.18 - Sunbelt 5958 2010.03.18 - Symantec 20091.2.0.41 2010.03.18 - TheHacker 6.5.2.0.237 2010.03.18 - TrendMicro 9.120.0.1004 2010.03.18 - VBA32 3.12.12.2 2010.03.17 - ViRobot 2010.3.18.2234 2010.03.18 - VirusBuster 5.0.27.0 2010.03.18 - Additional information File size: 30880 bytes MD5...: f58a27a27e41a1cd35eeb5ffdff95af8 SHA1..: 95c48438cfe9342a9b3061342ff782bbc96b3373 SHA256: b9850ac59707efd9487bb06c33164cf06e0e3c26070fd168de221c31eb0e3a07 ssdeep: 384:xGfVuMJKXXdOqp+kezAnFJWwHpyV9WkAWsLz4qjpv26me:0fOhRez0SVyz4q jpv22 PEiD..: - PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x5780 timedatestamp.....: 0x49680dd8 (Sat Jan 10 02:54:16 2009) machinetype.......: 0x14c (I386) ( 6 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x480 0x4796 0x4800 5.72 0c117cdd5987dc82a9332a1b88b31f9d .rdata 0x4c80 0xa4f 0xa80 7.40 e167596593d163a1a7a3a5d4bf8a792a .data 0x5700 0x14 0x80 0.80 e717e359a06dfafeef524f4d7d2d2cc1 INIT 0x5780 0x23a 0x280 4.90 c2430eec11d60da780dc7e3560b92d55 .rsrc 0x5a00 0x3a8 0x400 3.04 97739ef74a5748fffcd6a68fa7093d32 .reloc 0x5e00 0x284 0x300 4.84 f454a7f211e27e1093dca6da260db88f ( 1 imports ) > ntoskrnl.exe: ZwCreateKey, RtlInitUnicodeString, ZwDeleteValueKey, ZwSetValueKey, ZwQueryValueKey, ZwClose, ZwDeleteKey, ZwOpenKey, _vsnwprintf, ZwReadFile, ZwSetInformationFile, ZwCreateFile, ZwDeleteFile, ZwOpenFile, ZwQueryInformationFile, ZwWriteFile, ExAllocatePoolWithTag, ExFreePoolWithTag, KeTickCount, KeBugCheckEx, memset, memcpy ( 0 exports ) RDS...: NSRL Reference Data Set - pdfid.: - trid..: Clipper DOS Executable (33.3%) Generic Win/DOS Executable (33.0%) DOS Executable Generic (33.0%) VXD Driver (0.5%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%) sigcheck: publisher....: Microsoft Corporation copyright....: © Microsoft Corporation. All rights reserved. product......: Microsoft Malware Protection description..: Boot Time Removal Tool original name: BTR.sys internal name: BootTimeRemoval file version.: 1.1.0115.0 comments.....: n/a signers......: Microsoft Corporation Microsoft Code Signing PCA Microsoft Root Authority signing date.: 3:54 AM 1/10/2009 verified.....: -
  9. It seems to be running fine. After the OTL I did yet another MBAM scan and it found nothing. Here's the log of the OTL OTL logfile created on: 3/17/2010 1:29:53 PM - Run 1 OTL by OldTimer - Version 3.1.37.0 Folder = C:\Documents and Settings\Compaq_Owner\My Documents Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 503.00 Mb Total Physical Memory | 221.00 Mb Available Physical Memory | 44.00% Memory free 1.00 Gb Paging File | 1.00 Gb Available in Paging File | 60.00% Paging File free Paging file location(s): C:\pagefile.sys 756 1512 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 142.07 Gb Total Space | 16.20 Gb Free Space | 11.40% Space Free | Partition Type: NTFS Drive D: | 6.96 Gb Total Space | 2.58 Gb Free Space | 37.03% Space Free | Partition Type: FAT32 Drive E: | 677.09 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: NEW Current User Name: Compaq_Owner Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Documents and Settings\Compaq_Owner\My Documents\OTL.exe (OldTimer Tools) PRC - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee\MPF\MpfSrv.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.) PRC - C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) PRC - c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.) PRC - c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.) PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) PRC - C:\Program Files\Electronic Fantasy World\Terminus 6\T6SvcsManager.exe (Electronic Fantasy World) PRC - C:\Program Files\Electronic Fantasy World\Terminus 6\T6CommCenter.exe (Electronic Fantasy World) ========== Modules (SafeList) ========== MOD - C:\Documents and Settings\Compaq_Owner\My Documents\OTL.exe (OldTimer Tools) ========== Win32 Services (SafeList) ========== SRV - (McAfee SiteAdvisor Service) -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.) SRV - (MpfService) -- C:\Program Files\McAfee\MPF\MPFSrv.exe (McAfee, Inc.) SRV - (McODS) -- C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.) SRV - (McShield) -- C:\Program Files\McAfee\VirusScan\Mcshield.exe (McAfee, Inc.) SRV - (McSysmon) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe (McAfee, Inc.) SRV - (mcmscsvc) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe (McAfee, Inc.) SRV - (McProxy) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe (McAfee, Inc.) SRV - (McNASvc) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe (McAfee, Inc.) SRV - (WinDefend) -- C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) SRV - (lxcc_device) -- C:\WINDOWS\System32\lxcccoms.exe (Lexmark International, Inc.) ========== Driver Services (SafeList) ========== DRV - (mfehidk) -- C:\WINDOWS\system32\drivers\mfehidk.sys (McAfee, Inc.) DRV - (mfeavfk) -- C:\WINDOWS\system32\drivers\mfeavfk.sys (McAfee, Inc.) DRV - (mfesmfk) -- C:\WINDOWS\system32\drivers\mfesmfk.sys (McAfee, Inc.) DRV - (mfebopk) -- C:\WINDOWS\system32\drivers\mfebopk.sys (McAfee, Inc.) DRV - (mferkdk) -- C:\WINDOWS\system32\drivers\mferkdk.sys (McAfee, Inc.) DRV - (MPFP) -- C:\WINDOWS\system32\drivers\Mpfp.sys (McAfee, Inc.) DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems) DRV - (HdAudAddService) -- C:\WINDOWS\system32\drivers\Hdaudio.sys (Windows ® Server 2003 DDK provider) DRV - (Pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.) DRV - (Iviaspi) -- C:\WINDOWS\system32\drivers\iviaspi.sys (InterVideo, Inc.) DRV - (rtl8139) -- C:\WINDOWS\system32\drivers\R8139n51.sys (Realtek Semiconductor Corporation ) DRV - (Ps2) -- C:\WINDOWS\system32\drivers\PS2.sys (Hewlett-Packard Company) ========== Standard Registry (All) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = <local> ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}:6.0.17 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.0 FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.%(version)s FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.6 FF - prefs.js..network.proxy.ftp: "<local>" FF - prefs.js..network.proxy.gopher: "<local>" FF - prefs.js..network.proxy.http: "<local>" FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1" FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.socks: "<local>" FF - prefs.js..network.proxy.ssl: "<local>" FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/05/19 16:51:03 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010/02/18 00:40:50 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: c:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009/06/06 09:39:36 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/02 23:05:54 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/01/28 10:31:04 | 000,000,000 | ---D | M] [2009/06/10 12:38:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Extensions [2009/06/10 12:38:16 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009/06/10 12:38:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\1bz3acg5.default\extensions [2010/03/04 05:40:31 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2010/01/28 10:31:06 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/08/31 17:01:19 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [2009/12/14 17:12:16 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [2010/01/15 23:09:51 | 000,023,000 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll [2010/01/15 23:09:52 | 000,138,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll [2009/10/11 05:17:27 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeploytk.dll [2009/11/13 20:47:38 | 000,098,304 | ---- | M] (DivX, Inc) -- C:\Program Files\Mozilla Firefox\plugins\npDivxPlayerPlugin.dll [2010/01/15 23:09:53 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll [2010/01/15 20:13:03 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml [2010/01/15 20:13:03 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml [2010/01/15 20:13:03 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml [2010/01/15 20:13:03 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml [2010/01/15 20:13:03 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml [2010/01/15 20:13:03 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml [2010/01/15 20:13:03 | 000,001,096 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml O1 HOSTS File: ([2010/03/15 14:14:56 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\hdaudpropshortcut.exe (Windows ® Server 2003 DDK provider) O4 - HKLM..\Run: [LXCCCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCCtime.DLL () O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [soundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.) O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (Microsoft Corporation) O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10d.exe (Adobe Systems, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk = C:\Program Files\Compaq Connections\6750491\Program\Compaq Connections.exe (Hewlett-Packard) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\sslaunch.exe (InterMute, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Terminus Command Center.lnk = C:\Program Files\Electronic Fantasy World\Terminus 6\T6CommCenter.exe (Electronic Fantasy World) O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Terminus Services Manager.lnk = C:\Program Files\Electronic Fantasy World\Terminus 6\T6SvcsManager.exe (Electronic Fantasy World) O4 - Startup: C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\Compaq Organize.lnk = C:\Program Files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe (NeoPlanet) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: Add To Compaq Organize... - C:\PROGRA~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html () O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/b...heckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl...indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_17) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\system32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation) O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation) O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation) O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation) O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation) O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation) O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O24 - Desktop Components:0 (My Current Home Page) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (ntoskrnl.dll) - File not found O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation) O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004/10/14 23:38:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2001/07/28 05:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010/03/16 15:57:34 | 000,000,000 | ---D | C] -- C:\Program Files\ESET [2010/03/15 14:50:17 | 000,000,000 | -HSD | C] -- C:\RECYCLER [2010/03/15 14:00:06 | 000,000,000 | ---D | C] -- C:\ComboFix [2010/03/12 17:00:48 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2010/03/12 17:00:48 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2010/03/12 17:00:48 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2010/03/12 17:00:48 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2010/03/12 16:56:47 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2010/03/12 16:54:13 | 000,000,000 | ---D | C] -- C:\Qoobox [2010/03/11 22:15:17 | 000,555,520 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\My Documents\OTL.exe [2010/03/07 21:57:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe [2010/03/07 21:56:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Adobe [2010/03/07 00:51:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia [2010/03/07 00:13:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Macromedia [2010/03/07 00:11:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Windows Server [2010/02/26 15:28:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\My Documents\DVDVideoSoft [2010/02/26 15:27:41 | 000,000,000 | ---D | C] -- C:\Program Files\DVDVideoSoft [2010/02/26 15:27:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DVDVideoSoft [2009/09/18 09:55:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\McAfee [2009/05/08 11:52:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\SACore [2009/01/19 18:23:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft [2008/09/01 01:39:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\PCHealth [2008/08/28 23:44:44 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft [2008/05/20 10:13:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple [2007/05/25 20:36:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Help [2007/05/25 20:36:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Help [2006/08/03 19:25:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Macromedia [2005/03/13 02:26:34 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft [2005/03/13 02:26:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010/03/17 10:20:06 | 000,015,793 | ---- | M] () -- C:\WINDOWS\System32\Config.MPF [2010/03/17 02:27:09 | 000,000,330 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job [2010/03/17 02:23:28 | 000,226,816 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/03/16 23:41:33 | 012,582,912 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\ntuser.dat [2010/03/16 15:40:18 | 000,031,184 | ---- | M] () -- C:\WINDOWS\T6.TRK [2010/03/16 15:34:29 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010/03/16 15:32:07 | 000,003,649 | ---- | M] () -- C:\WINDOWS\viassary-hp.reg [2010/03/16 15:32:02 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010/03/16 15:32:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010/03/16 15:31:59 | 527,814,656 | -HS- | M] () -- C:\hiberfil.sys [2010/03/16 15:30:11 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Compaq_Owner\ntuser.ini [2010/03/15 14:15:08 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2010/03/15 14:14:56 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010/03/15 01:00:00 | 000,000,354 | ---- | M] () -- C:\WINDOWS\tasks\McDefragTask.job [2010/03/14 10:56:46 | 000,382,022 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010/03/14 10:56:46 | 000,053,640 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010/03/14 10:56:44 | 000,441,626 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010/03/12 17:21:11 | 792,723,456 | ---- | M] () -- C:\pagefile.sys.terminus.adr [2010/03/12 16:48:10 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn [2010/03/12 16:47:47 | 003,888,122 | R--- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\ComboFix.exe [2010/03/11 22:15:34 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\My Documents\OTL.exe [2010/03/09 17:09:41 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\RootkitScanner.exe [2010/03/09 16:28:45 | 000,524,288 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\dds.scr [2010/03/09 16:05:13 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\defogger_reenable [2010/03/07 21:55:42 | 000,001,409 | ---- | M] () -- C:\WINDOWS\QTFont.for [2010/03/07 12:43:55 | 000,000,856 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\regtool.vbs [2010/03/07 12:38:28 | 000,000,610 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\UnHookExec.inf [2010/03/01 02:00:00 | 000,000,346 | ---- | M] () -- C:\WINDOWS\tasks\McQcTask.job [2010/02/26 15:28:32 | 000,000,900 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Desktop\DVDVideoSoft Free Studio.lnk [2010/02/24 10:16:06 | 000,181,632 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MpSigStub.exe [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2099/01/01 12:00:00 | 000,006,456 | -H-- | C] () -- C:\WINDOWS\System32\vefebuku [2010/03/16 15:32:07 | 000,003,649 | ---- | C] () -- C:\WINDOWS\viassary-hp.reg [2010/03/12 17:00:48 | 000,261,632 | ---- | C] () -- C:\WINDOWS\PEV.exe [2010/03/12 17:00:48 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2010/03/12 17:00:48 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2010/03/12 17:00:48 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe [2010/03/12 17:00:48 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2010/03/12 16:47:33 | 003,888,122 | R--- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\ComboFix.exe [2010/03/09 17:09:36 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\RootkitScanner.exe [2010/03/09 16:28:27 | 000,524,288 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\dds.scr [2010/03/09 16:05:13 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\defogger_reenable [2010/03/07 21:55:42 | 000,054,156 | -H-- | C] () -- C:\WINDOWS\QTFont.qfn [2010/03/07 21:55:42 | 000,001,409 | ---- | C] () -- C:\WINDOWS\QTFont.for [2010/03/07 12:43:54 | 000,000,856 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\regtool.vbs [2010/03/07 12:38:27 | 000,000,610 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\UnHookExec.inf [2010/02/26 15:28:32 | 000,000,900 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Desktop\DVDVideoSoft Free Studio.lnk [2008/04/01 09:10:03 | 000,000,144 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Application Data\wklnhst.dat [2008/03/31 12:25:07 | 000,005,149 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI [2006/08/03 19:32:57 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXPRMON.DLL [2006/08/03 19:32:57 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\LXPMONUI.DLL [2006/06/01 18:10:25 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2005/05/29 22:52:54 | 000,010,086 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2005/05/26 19:54:54 | 000,226,816 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2005/05/26 17:06:44 | 000,000,135 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\fusioncache.dat [2005/03/13 03:21:25 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2005/03/13 03:18:15 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2005/03/13 03:18:15 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2005/03/13 03:18:15 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2005/03/13 03:18:14 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2005/03/13 03:18:14 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2005/03/13 03:18:14 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2005/03/13 02:50:50 | 000,013,975 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS [2005/03/13 02:50:44 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll [2005/03/13 02:50:22 | 000,002,154 | ---- | C] () -- C:\WINDOWS\System32\ssmute.ini [2005/03/13 02:47:26 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2005/03/13 02:35:46 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2005/03/13 02:33:40 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2005/03/13 02:23:51 | 000,000,788 | ---- | C] () -- C:\WINDOWS\orun32.ini [2005/03/13 02:22:42 | 000,323,584 | ---- | C] () -- C:\WINDOWS\System32\pythoncom22.dll [2005/03/13 02:22:42 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\pywintypes22.dll [2005/03/13 02:22:20 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll [2004/10/26 18:39:05 | 003,375,104 | ---- | C] () -- C:\WINDOWS\System32\qt-mt331.dll [2004/09/13 12:35:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2004/08/19 23:14:46 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\PcdrKernelModeServices.dll [2004/08/19 23:14:46 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\ProgressTrace.dll [2004/08/04 00:00:00 | 001,287,680 | ---- | C] () -- C:\WINDOWS\System32\quartz(2).dll [2004/07/02 08:42:38 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxccvs.dll [2004/06/15 17:38:02 | 000,000,572 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2003/04/10 19:04:00 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\JAWTAccessBridge.dll [2003/01/07 19:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002/01/24 05:29:26 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\lxaxlcnp.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 356 bytes -> C:\WINDOWS\System32\drivers\pcesbimb.sys:changelist @Alternate Data Stream - 352 bytes -> C:\WINDOWS\System32\drivers\rjxkmitn.sys:changelist < End of report >
  10. Here is the MBAM Log - I'm shocked it found all this still on my computer after updating. Also, I ran ESET - it found one thing, something with variant in the name. But there is no log file in the location you specified. Malwarebytes' Anti-Malware 1.44 Database version: 3874 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 3/16/2010 2:59:01 PM mbam-log-2010-03-16 (14-59-01).txt Scan type: Quick Scan Objects scanned: 122858 Time elapsed: 21 minute(s), 53 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 1 Files Infected: 14 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\Software\WEK9EMDHI9 (Trojan.Agent) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\appsecdll (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Dr. Guard (Rogue.DrGuard) -> Quarantined and deleted successfully. Files Infected: C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Dr. Guard\About.lnk (Rogue.DrGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Dr. Guard\Activate.lnk (Rogue.DrGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Dr. Guard\Buy.lnk (Rogue.DrGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Dr. Guard\Dr. Guard Support.lnk (Rogue.DrGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Dr. Guard\Dr. Guard.lnk (Rogue.DrGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Dr. Guard\Scan.lnk (Rogue.DrGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Dr. Guard\Settings.lnk (Rogue.DrGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Dr. Guard\Update.lnk (Rogue.DrGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Application Data\8b0466c6-e995-4c78-9012-973a83f93a09_.mkv (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\8b0466c6-e995-4c78-9012-973a83f93a09_.mkv (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\8b0466c6-e995-4c78-9012-973a83f93a09_.mkv (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Desktop\Dr. Guard Support.lnk (Rogue.DrGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Desktop\Dr. Guard.lnk (Rogue.DrGuard) -> Quarantined and deleted successfully. C:\Documents and Settings\Compaq_Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Dr. Guard.lnk (Rogue.DrGuard) -> Quarantined and deleted successfully.
  11. Yes, I was referring to the last log. Under "Other Deletions" it had some Lexmark printer stuff. What would a trojan or virus do in a printer? Looking at my first post in this thread, I did some Defogger thing. Given what I wrote in that post do I have to do someting to undo what was done, IF anything was done? Am I now uninfected, or is there anything else I have to do? Thank you.
  12. I know you're busy, and I appreciate your help, but I am still wondering about what you said regarding passwords - does that apply to anything on this computer ever, or only to things accessed during the infection? I don't understand any of this stuff, but I particularly don't understand why printer files were deleted. How are those involved in anything?
  13. 1. It didn't automatically upload the file, so I manually uploaded it to bleepingcomputer as instructed. Now I'm letting you know, as instructed at bleepingcomputer after the upload. 2. Here is the log - ComboFix 10-03-11.06 - Compaq_Owner 03/15/2010 14:02:18.2.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.301 [GMT -4:00] Running from: c:\documents and settings\Compaq_Owner\My Documents\ComboFix.exe Command switches used :: c:\documents and settings\Compaq_Owner\My Documents\CFScript.txt AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} file zipped: c:\documents and settings\All Users\Application Data\fiosejgfse.dll file zipped: c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Windows Server\mlthnj.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\fiosejgfse.dll c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Windows Server\mlthnj.dll c:\hp\drivers\hplsbwatcher\bak c:\hp\drivers\hplsbwatcher\bak\lsburnwatcher.exe c:\hp\KBD\bak c:\hp\KBD\bak\KBD.EXE c:\program files\Adobe\Reader 8.0\Reader\bak c:\program files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe c:\program files\Common Files\Real\Update_OB\bak c:\program files\Common Files\Real\Update_OB\bak\realsched.exe c:\program files\iTunes\bak c:\program files\iTunes\bak\iTunesHelper.exe c:\program files\Java\j2re1.4.2_03\bin\bak c:\program files\Java\j2re1.4.2_03\bin\bak\jusched.exe c:\program files\Lexmark 3300 Series\bak c:\program files\Lexmark 3300 Series\bak\lxccmon.exe c:\program files\Lexmark Fax Solutions\bak c:\program files\Lexmark Fax Solutions\bak\fm3032.exe c:\program files\QuickTime\bak c:\program files\QuickTime\bak\qttask.exe c:\windows\CREATOR\bak c:\windows\CREATOR\bak\Remind_XP.exe c:\windows\SMINST\bak c:\windows\SMINST\bak\RECGUARD.EXE c:\windows\system\bak c:\windows\system\bak\hpsysdrv.DAT c:\windows\system\bak\hpsysdrv.exe c:\windows\system32\bak c:\windows\system32\bak\ctfmon.exe c:\windows\system32\bak\hkcmd.exe c:\windows\system32\bak\LXSUPMON.EXE c:\windows\system32\bak\ps2.exe c:\windows\viassary-hp.reg . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_DJRZLW -------\Legacy_TDISNAP -------\Service_djrzlw -------\Service_tdisnap ((((((((((((((((((((((((( Files Created from 2010-02-15 to 2010-03-15 ))))))))))))))))))))))))))))))) . 2010-03-08 01:56 . 2010-03-09 15:57 -------- d-sh--w- c:\documents and settings\NetworkService\UserData 2010-03-08 01:55 . 2010-03-08 01:57 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe 2010-03-07 04:11 . 2010-03-15 18:11 -------- d-----w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Windows Server 2010-02-26 19:27 . 2010-02-26 19:28 -------- d-----w- c:\program files\Common Files\DVDVideoSoft 2010-02-26 19:27 . 2010-02-26 19:27 -------- d-----w- c:\program files\DVDVideoSoft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-03-15 18:02 . 2008-08-29 03:23 -------- d-----w- c:\program files\Windows Defender 2010-03-15 18:02 . 2005-03-13 06:48 -------- d-----w- c:\program files\QuickTime 2010-03-15 18:02 . 2005-03-13 06:48 -------- d-----w- c:\program files\iTunes 2010-03-14 14:53 . 2006-08-03 23:25 -------- d-----w- c:\program files\Lx_cats 2010-03-13 14:44 . 2009-09-25 15:58 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\vlc 2010-03-10 05:52 . 2006-12-27 18:35 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\DivX 2010-03-09 13:47 . 2009-03-08 06:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-03-09 13:41 . 2010-03-09 13:41 5115823 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2010-03-07 15:34 . 2009-06-06 17:45 -------- d-----w- c:\program files\McAfee 2010-02-24 14:16 . 2009-10-06 06:28 181632 ------w- c:\windows\system32\MpSigStub.exe 2010-01-28 14:20 . 2010-01-19 00:57 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Move Networks 2010-01-19 00:58 . 2010-01-19 00:58 144160 ----a-w- c:\documents and settings\Compaq_Owner\Application Data\Move Networks\uninstall.exe 2010-01-19 00:57 . 2009-12-10 19:26 4187512 ----a-w- c:\documents and settings\Compaq_Owner\Application Data\Move Networks\plugins\npqmp071505000011.dll 2010-01-07 21:07 . 2009-03-08 06:15 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-07 21:07 . 2009-03-08 06:15 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-01-05 10:00 . 2004-08-04 04:00 832512 ------w- c:\windows\system32\wininet.dll 2010-01-05 10:00 . 2004-08-04 04:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-01-05 10:00 . 2004-08-04 04:00 17408 ------w- c:\windows\system32\corpol.dll 2009-12-31 16:50 . 2009-01-19 16:53 353792 ----a-w- c:\windows\system32\drivers\srv.sys 2009-12-16 18:43 . 2004-08-04 04:00 343040 ----a-w- c:\windows\system32\mspaint.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-18 61952] "SoundMan"="SOUNDMAN.EXE" [2005-04-06 90112] "LXCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll" [2005-01-10 69632] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264] c:\documents and settings\Compaq_Owner\Start Menu\Programs\Startup\ Compaq Organize.lnk - c:\program files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe [2005-3-13 36864] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Compaq Connections.lnk - c:\program files\Compaq Connections\6750491\Program\Compaq Connections.exe [2005-3-13 45056] SpySubtract.lnk - c:\program files\InterMute\SpySubtract\sslaunch.exe [2005-3-13 73728] Terminus Command Center.lnk - c:\program files\Electronic Fantasy World\Terminus 6\T6CommCenter.exe [2004-10-1 494100] Terminus Services Manager.lnk - c:\program files\Electronic Fantasy World\Terminus 6\T6SvcsManager.exe [2004-10-1 483860] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls] AppSecDll REG_SZ c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Windows Server\mlthnj.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Compaq Connections\\6750491\\Program\\Compaq Connections.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [6/6/2009 1:50 PM 93320] S3 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592] . Contents of the 'Scheduled Tasks' folder 2005-07-22 c:\windows\Tasks\Easy Internet Sign-up.job - c:\program files\Easy Internet signup\HPSdpApp.exe [2004-08-13 09:50] 2010-03-15 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2009-06-06 16:22] 2010-03-01 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2009-06-06 16:22] 2010-03-15 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=desktop uInternet Settings,ProxyOverride = <local> uInternet Settings,ProxyServer = <local> IE: Add To Compaq Organize... - c:\progra~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\1bz3acg5.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: c:\documents and settings\Compaq_Owner\Application Data\Move Networks\plugins\npqmp071505000011.dll FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . - - - - ORPHANS REMOVED - - - - HKCU-Run-Anonymizer - c:\program files\Anonymizer\Anonymizer Software\Anonymizer.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-03-15 14:17 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run LXCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(2824) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\LEXBCES.EXE c:\windows\system32\LEXPPS.EXE c:\windows\SOUNDMAN.EXE c:\program files\Java\jre6\bin\jqs.exe c:\progra~1\McAfee\MSC\mcmscsvc.exe c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\progra~1\McAfee\VIRUSS~1\mcshield.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\McAfee\MPF\MPFSrv.exe c:\windows\system32\wdfmgr.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2010-03-15 14:26:22 - machine was rebooted ComboFix-quarantined-files.txt 2010-03-15 18:26 ComboFix2.txt 2010-03-12 21:32 Pre-Run: 10,748,018,688 bytes free Post-Run: 11,399,585,792 bytes free - - End Of File - - 3935A23A812A1BF6D592F31BE0BF0E39
  14. I did another MBAM scan and there was again 1 Trojan. This is the info C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
  15. ComboFix also produced this in a Folder named Qoobx, a text document named ComboFix-quarantined-files 2010-03-12 21:31:12 . 2010-03-12 21:31:12 934 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-FA7F5211-C629-4711-BD82-7DFFB08CB518.reg.dat 2010-03-12 21:31:12 . 2010-03-12 21:31:12 2,214 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Elecard Codec SDK G4 1.0.1.80507 Eval.reg.dat 2010-03-12 21:31:12 . 2010-03-12 21:31:12 778 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Dr. Guard.reg.dat 2010-03-12 21:31:12 . 2010-03-12 21:31:12 938 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-DE87FA96-7840-420C-86F9-33F3B7B3CED1.reg.dat 2010-03-12 21:31:12 . 2010-03-12 21:31:12 948 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-C43D84CD-EBFC-48D3-A330-7868C8AD415A.reg.dat 2010-03-12 21:31:12 . 2010-03-12 21:31:12 960 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-BFAF1EEC-E987-415B-BCB8-80CDB0BC6CDF.reg.dat 2010-03-12 21:31:12 . 2010-03-12 21:31:12 964 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-A2E85A38-C2D9-4EDF-AFDA-F76BCBFEBBC4.reg.dat 2010-03-12 21:31:11 . 2010-03-12 21:31:11 956 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-9D7E7CDA-051E-4B0D-8CEE-58F41F449CF9.reg.dat 2010-03-12 21:31:11 . 2010-03-12 21:31:11 934 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-75528D5F-DD82-402E-BA7C-045B7DC6A712.reg.dat 2010-03-12 21:31:11 . 2010-03-12 21:31:11 942 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-66195170-D19D-46C5-8FB7-8A4630071ADC.reg.dat 2010-03-12 21:31:11 . 2010-03-12 21:31:11 934 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-3330A279-CC39-4A17-AE19-DA464B26AD9A.reg.dat 2010-03-12 21:31:11 . 2010-03-12 21:31:11 944 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-29FF6D07-4A15-41F1-9D5E-E0F3A58012C6.reg.dat 2010-03-12 21:31:11 . 2010-03-12 21:31:11 930 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-26DC0ED6-93A7-43C1-8DC5-EC16079580F9.reg.dat 2010-03-12 21:31:11 . 2010-03-12 21:31:11 936 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-05E21449-3BA3-42BF-BBDA-95205F4EA40A.reg.dat 2010-03-12 21:30:47 . 2010-03-12 21:30:48 173 ----a-w- C:\Qoobox\Quarantine\Registry_backups\ShellExecuteHooks-{FA010552-4A27-4cb1-A1BB-3E2D697F1639}.reg.dat 2010-03-12 21:22:05 . 2004-05-01 02:01:14 53 ----a-w- C:\Qoobox\Quarantine\D\Autorun.inf.vir 2010-03-12 21:16:36 . 2010-03-12 21:16:36 774 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_6TO4.reg.dat 2010-03-12 21:16:24 . 2010-03-12 21:16:24 7,572 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg 2010-03-12 21:02:21 . 2008-04-13 18:40:30 96,512 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir 2010-03-12 20:56:47 . 2010-03-12 21:06:45 153 ----a-w- C:\Qoobox\Quarantine\catchme.log 2010-03-12 20:39:03 . 2010-03-12 21:06:38 260 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job.vir 2010-03-10 03:14:27 . 2010-03-10 03:14:28 39,936 ----a-w- C:\Qoobox\Quarantine\C\Program Files\Dr. Guard\drgext.dll.vir 2010-03-07 04:19:52 . 2010-03-07 04:19:52 94,208 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\app_dll.dll.vir 2010-03-07 04:16:17 . 2010-03-07 04:16:17 1 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\Flags.dtd.vir 2010-03-07 04:11:59 . 2010-03-07 04:11:59 20,000 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\p9iyao.dll.vir 2010-01-01 20:39:00 . 2010-01-01 20:39:12 6,429 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WORK.DAT.vir 2009-01-19 16:53:17 . 2008-04-13 18:40:30 96,512 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir_ 2007-08-15 02:42:18 . 2007-08-15 02:42:18 0 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Logs\Settings.dat.vir 2006-10-25 22:06:25 . 2006-10-25 22:06:25 0 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Compaq_Owner\Application Data\Install.dat.vir 2005-03-13 06:51:17 . 2010-03-12 17:46:43 3,649 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\viassary-hp.reg.vir 2005-03-13 06:37:46 . 2003-09-12 12:13:20 98,304 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\ps2.bat.vir 2004-08-04 04:00:00 . 2008-04-14 00:12:16 15,360 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\ctfmon .exe.vir 2004-08-04 04:00:00 . 2008-04-14 00:12:33 33,280 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\rundll32 .exe.vir
  16. Okay, that produced a lot of progress. First, though, regarding the stuff you posted about passwords - does that apply to any thing on this computer ever, or only to things accessed during the infection? ComboFix seems to have gotten rid of most things. regedit is enabled. System Restore now can be accessed, but there don't seem to be any restore points. After doing ComboFix I ran MBAM - it turned up one Trojan. I copied its info into the ComboFix document before rebooting, but it isn't there now. Here is the ComboFix log - ComboFix 10-03-11.06 - Compaq_Owner 03/12/2010 16:08:03.1.1 - x86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.115 [GMT -5:00] Running from: c:\documents and settings\Compaq_Owner\My Documents\ComboFix.exe AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\COMPAQ~1\LOCALS~1\Temp\taskmgr.exe c:\documents and settings\All Users\Application Data\Macromedia\SwUpdate c:\documents and settings\All Users\Application Data\Macromedia\SwUpdate\Flags.dtd c:\documents and settings\Compaq_Owner\Application Data\Install.dat c:\program files\Dr. Guard c:\program files\Dr. Guard\drgext.dll c:\program files\Helper c:\recycler\S-1-5-21-499991695-2126121627-880281741-1003 c:\windows\system32\app_dll.dll c:\windows\system32\ctfmon .exe c:\windows\system32\logs c:\windows\system32\logs\Settings.dat c:\windows\system32\p9IYao.dll c:\windows\system32\ps2.bat c:\windows\system32\rundll32 .exe c:\windows\system32\WORK.DAT c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job c:\windows\viassary-hp.reg D:\Autorun.inf Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected Restored copy from - c:\windows\ServicePackFiles\i386\atapi.sys . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_6TO4 ((((((((((((((((((((((((( Files Created from 2010-02-12 to 2010-03-12 ))))))))))))))))))))))))))))))) . 2010-03-08 01:56 . 2010-03-09 15:57 -------- d-sh--w- c:\documents and settings\NetworkService\UserData 2010-03-08 01:55 . 2010-03-08 01:57 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe 2010-03-07 04:14 . 2010-03-07 04:11 158208 ----a-w- c:\windows\wcatia.exe 2010-03-07 04:11 . 2010-03-07 04:11 -------- d-----w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Windows Server 2010-02-26 19:27 . 2010-02-26 19:28 -------- d-----w- c:\program files\Common Files\DVDVideoSoft 2010-02-26 19:27 . 2010-02-26 19:27 -------- d-----w- c:\program files\DVDVideoSoft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-03-12 21:23 . 2010-03-12 21:23 3649 ----a-w- c:\windows\viassary-hp.reg 2010-03-10 05:52 . 2006-12-27 18:35 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\DivX 2010-03-10 05:46 . 2009-09-25 15:58 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\vlc 2010-03-09 21:10 . 2010-03-07 04:31 8908 ----a-w- c:\documents and settings\All Users\Application Data\fiosejgfse.dll 2010-03-09 21:10 . 2010-03-07 04:31 8908 ----a-w- c:\documents and settings\All Users\Application Data\fiosejgfse.dll 2010-03-09 13:47 . 2009-03-08 06:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-03-09 13:41 . 2010-03-09 13:41 5115823 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe 2010-03-07 15:34 . 2009-06-06 17:45 -------- d-----w- c:\program files\McAfee 2010-03-07 10:23 . 2005-03-13 06:48 -------- d-----w- c:\program files\QuickTime 2010-03-07 10:12 . 2005-03-13 06:48 -------- d-----w- c:\program files\iTunes 2010-03-07 04:31 . 2008-08-29 03:23 -------- d-----w- c:\program files\Windows Defender 2010-02-24 14:16 . 2009-10-06 06:28 181632 ------w- c:\windows\system32\MpSigStub.exe 2010-02-12 04:48 . 2006-08-03 23:25 -------- d-----w- c:\program files\Lx_cats 2010-01-28 14:20 . 2010-01-19 00:57 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Move Networks 2010-01-19 00:58 . 2010-01-19 00:58 144160 ----a-w- c:\documents and settings\Compaq_Owner\Application Data\Move Networks\uninstall.exe 2010-01-19 00:57 . 2009-12-10 19:26 4187512 ----a-w- c:\documents and settings\Compaq_Owner\Application Data\Move Networks\plugins\npqmp071505000011.dll 2010-01-07 21:07 . 2009-03-08 06:15 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-01-07 21:07 . 2009-03-08 06:15 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-01-05 10:00 . 2004-08-04 04:00 832512 ----a-w- c:\windows\system32\wininet.dll 2010-01-05 10:00 . 2004-08-04 04:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-01-05 10:00 . 2004-08-04 04:00 17408 ------w- c:\windows\system32\corpol.dll 2009-12-31 16:50 . 2009-01-19 16:53 353792 ----a-w- c:\windows\system32\drivers\srv.sys 2009-12-16 18:43 . 2004-08-04 04:00 343040 ----a-w- c:\windows\system32\mspaint.exe 2009-12-14 21:03 . 2009-12-14 21:03 152576 ----a-w- c:\documents and settings\Compaq_Owner\Application Data\Sun\Java\jre1.6.0_17\lzma.dll 2009-12-14 21:02 . 2009-12-14 21:02 79488 ----a-w- c:\documents and settings\Compaq_Owner\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll 2009-12-14 07:08 . 2009-01-19 16:53 33280 ----a-w- c:\windows\system32\csrsrv.dll . <pre> c:\program files\Common Files\Real\Update_OB\realsched .exe c:\program files\iTunes\ituneshelper .exe c:\program files\Java\jre6\bin\jusched .exe c:\program files\McAfee.com\Agent\mcagent .exe c:\program files\QuickTime\qttask .exe c:\program files\Windows Defender\msascui .exe </pre> ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2005-03-13 06:43 . 2004-10-14 14:54 253952 c:\hp\drivers\hplsbwatcher\bak\lsburnwatcher.exe 2005-03-13 06:37 . 2003-02-11 12:02 61440 c:\hp\KBD\bak\KBD.EXE 2007-10-11 00:51 . 2007-10-11 00:51 39792 c:\program files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe 2008-10-15 05:04 . 2008-10-15 05:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe 2005-03-13 06:41 . 2005-05-27 00:49 180269 c:\program files\Common Files\Real\Update_OB\bak\realsched.exe 2004-10-14 00:04 . 2004-10-14 00:04 278528 c:\program files\iTunes\bak\iTunesHelper.exe 2005-03-13 06:27 . 2005-03-13 06:27 32881 c:\program files\Java\j2re1.4.2_03\bin\bak\jusched.exe 2006-08-03 23:27 . 2005-02-21 11:21 192512 c:\program files\Lexmark 3300 Series\bak\lxccmon.exe 2006-08-03 23:31 . 2005-01-20 02:19 299008 c:\program files\Lexmark Fax Solutions\bak\fm3032.exe 2005-03-13 06:48 . 2005-03-13 06:48 98304 c:\program files\QuickTime\bak\qttask.exe 2005-03-13 06:49 . 2004-12-14 02:23 663552 c:\windows\CREATOR\bak\Remind_XP.exe 2004-04-14 13:43 . 2004-04-14 13:43 233472 c:\windows\SMINST\bak\RECGUARD.EXE 2008-02-14 08:27 . 2008-04-22 03:52 181 c:\windows\system\bak\hpsysdrv.DAT 2005-05-26 21:00 . 2008-02-08 07:45 185 c:\windows\system\hpsysdrv.DAT 2005-03-13 06:30 . 1998-05-07 09:04 52736 c:\windows\system\bak\hpsysdrv.exe 2004-08-04 04:00 . 2004-08-04 04:00 15360 c:\windows\system32\bak\ctfmon.exe 2004-08-04 04:00 . 2008-04-14 00:12 15360 c:\windows\system32\ctfmon.exe 2005-03-13 06:33 . 2004-11-02 08:59 126976 c:\windows\system32\bak\hkcmd.exe 2002-01-28 12:48 . 2002-01-28 12:48 885760 c:\windows\system32\bak\LXSUPMON.EXE 2005-03-13 06:37 . 2003-09-12 12:13 98304 c:\windows\system32\bak\ps2.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Anonymizer"="c:\program files\Anonymizer\Anonymizer Software\Anonymizer.exe" [N/A] "Remote System Protection"="c:\windows\system32\p9iyao.dll" [N/A] "Dr. Guard"="c:\program files\Dr. Guard\drguard.exe" [N/A] "WEK9EMDHI9"="c:\windows\wcatia.exe" [2010-03-07 158208] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-18 61952] "SoundMan"="SOUNDMAN.EXE" [2005-04-06 90112] "funk"="funk.exe" [N/A] "LXCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll" [2005-01-10 69632] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-02-11 1218008] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264] "Remote System Protection"="c:\windows\system32\p9iyao.dll" [N/A] c:\documents and settings\Compaq_Owner\Start Menu\Programs\Startup\ Compaq Organize.lnk - c:\program files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe [2005-3-13 36864] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Compaq Connections.lnk - c:\program files\Compaq Connections\6750491\Program\Compaq Connections.exe [2005-3-13 45056] SpySubtract.lnk - c:\program files\InterMute\SpySubtract\sslaunch.exe [2005-3-13 73728] Terminus Command Center.lnk - c:\program files\Electronic Fantasy World\Terminus 6\T6CommCenter.exe [2004-10-1 494100] Terminus Services Manager.lnk - c:\program files\Electronic Fantasy World\Terminus 6\T6SvcsManager.exe [2004-10-1 483860] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls] AppSecDll REG_SZ c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Windows Server\mlthnj.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Compaq Connections\\6750491\\Program\\Compaq Connections.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [6/6/2009 12:50 PM 93320] S0 djrzlw;djrzlw; [x] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [3/8/2009 1:15 AM 38224] S3 tdisnap;tdisnap;\??\c:\windows\system32\tdisnap.sys --> c:\windows\system32\tdisnap.sys [?] S3 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 6:19 PM 13592] . Contents of the 'Scheduled Tasks' folder 2005-07-22 c:\windows\Tasks\Easy Internet Sign-up.job - c:\program files\Easy Internet signup\HPSdpApp.exe [2004-08-13 09:50] 2010-02-15 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2009-06-06 16:22] 2010-03-01 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2009-06-06 16:22] 2010-03-12 c:\windows\Tasks\MP Scheduled Scan.job - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20] 2010-03-12 c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job - c:\windows\wcatia.exe [2010-03-07 04:11] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=desktop uInternet Settings,ProxyOverride = <local> uInternet Settings,ProxyServer = <local> IE: Add To Compaq Organize... - c:\progra~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\1bz3acg5.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: c:\documents and settings\Compaq_Owner\Application Data\Move Networks\plugins\npqmp071505000011.dll FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . - - - - ORPHANS REMOVED - - - - ShellExecuteHooks-{FA010552-4A27-4cb1-A1BB-3E2D697F1639} - (no file) AddRemove-05E21449-3BA3-42BF-BBDA-95205F4EA40A - c:\program files\WildTangent\Apps\GameChannel\Games\05E21449-3BA3-42BF-BBDA-95205F4EA40A\Uninstall.exe AddRemove-26DC0ED6-93A7-43C1-8DC5-EC16079580F9 - c:\program files\WildTangent\Apps\GameChannel\Games\26DC0ED6-93A7-43C1-8DC5-EC16079580F9\Uninstall.exe AddRemove-29FF6D07-4A15-41F1-9D5E-E0F3A58012C6 - c:\program files\WildTangent\Apps\GameChannel\Games\29FF6D07-4A15-41F1-9D5E-E0F3A58012C6\Uninstall.exe AddRemove-3330A279-CC39-4A17-AE19-DA464B26AD9A - c:\program files\WildTangent\Apps\GameChannel\Games\3330A279-CC39-4A17-AE19-DA464B26AD9A\Uninstall.exe AddRemove-66195170-D19D-46C5-8FB7-8A4630071ADC - c:\program files\WildTangent\Apps\GameChannel\Games\66195170-D19D-46C5-8FB7-8A4630071ADC\Uninstall.exe AddRemove-75528D5F-DD82-402E-BA7C-045B7DC6A712 - c:\program files\WildTangent\Apps\GameChannel\Games\75528D5F-DD82-402E-BA7C-045B7DC6A712\Uninstall.exe AddRemove-9D7E7CDA-051E-4B0D-8CEE-58F41F449CF9 - c:\program files\WildTangent\Apps\GameChannel\Games\9D7E7CDA-051E-4B0D-8CEE-58F41F449CF9\Uninstall.exe AddRemove-A2E85A38-C2D9-4EDF-AFDA-F76BCBFEBBC4 - c:\program files\WildTangent\Apps\GameChannel\Games\A2E85A38-C2D9-4EDF-AFDA-F76BCBFEBBC4\Uninstall.exe AddRemove-BFAF1EEC-E987-415B-BCB8-80CDB0BC6CDF - c:\program files\WildTangent\Apps\GameChannel\Games\BFAF1EEC-E987-415B-BCB8-80CDB0BC6CDF\Uninstall.exe AddRemove-C43D84CD-EBFC-48D3-A330-7868C8AD415A - c:\program files\WildTangent\Apps\GameChannel\Games\C43D84CD-EBFC-48D3-A330-7868C8AD415A\Uninstall.exe AddRemove-DE87FA96-7840-420C-86F9-33F3B7B3CED1 - c:\program files\WildTangent\Apps\GameChannel\Games\DE87FA96-7840-420C-86F9-33F3B7B3CED1\Uninstall.exe AddRemove-Dr. Guard - c:\program files\Dr. Guard\Uninstall.exe AddRemove-Elecard Codec SDK G4 1.0.1.80507 Eval - c:\program files\Elecard\Elecard Codec SDK G4 Eval\Uninstall.exe AddRemove-FA7F5211-C629-4711-BD82-7DFFB08CB518 - c:\program files\WildTangent\Apps\GameChannel\Games\FA7F5211-C629-4711-BD82-7DFFB08CB518\Uninstall.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-03-12 16:22 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run LXCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(600) c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Windows Server\mlthnj.dll - - - - - - - > 'explorer.exe'(3776) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\LEXBCES.EXE c:\windows\system32\LEXPPS.EXE c:\program files\Java\jre6\bin\jqs.exe c:\progra~1\McAfee\MSC\mcmscsvc.exe c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\progra~1\McAfee\VIRUSS~1\mcshield.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\McAfee\MPF\MPFSrv.exe c:\windows\system32\wdfmgr.exe c:\progra~1\mcafee.com\agent\mcagent.exe c:\windows\system32\wscntfy.exe c:\windows\SOUNDMAN.EXE . ************************************************************************** . Completion time: 2010-03-12 16:32:20 - machine was rebooted ComboFix-quarantined-files.txt 2010-03-12 21:32 Pre-Run: 17,536,528,384 bytes free Post-Run: 18,155,044,864 bytes free - - End Of File - - 323FC4F82285D5F915262C6C0A6D02EB
  17. There's also a Dr. Guard Folder. I can delete everything but drgext.dll . I used MBAM's File Assasin to delete that once. It required reboot to delete. It was gone upon reboot, but it was quickly re-installed along with the other 6 or so things in the Dr. Guard folder.
  18. Thanks for helping! It's been 2 days primarily because my computer keeps shutting itself down every 30 to 60 minutes. And the GMER scan took forever. I did that OTL thing twice; both times it stopped at "Checking service: hkmsvc" Here is the GMER scan log [i put in bold the 2 items near the end that were in red prior to the creation of the .txt] - GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-03-11 19:04:09 Windows 5.1.2600 Service Pack 3 Running: RootkitScanner.exe; Driver: C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\ugldqpow.sys ---- System - GMER 1.0.15 ---- Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xAA4478CA] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateKey [0xAA447710] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xAA447878] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xAA44788C] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xAA447724] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xAA447750] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xAA4477BE] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xAA4477A8] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xAA44790A] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xAA4477EA] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xAA4476FC] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xAA447850] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xAA447864] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xAA4478DE] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xAA447826] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xAA447792] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xAA44777C] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xAA44773A] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xAA447812] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xAA4477FE] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xAA4478B6] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xAA4478A2] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetValueKey [0xAA447766] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xAA447939] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xAA4477D4] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xAA447920] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xAA4478F4] Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs 82D04EA8 AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [F82BFB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]} Device \Driver\atapi \Device\Ide\IdePort0 [F82BFB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]} Device \Driver\atapi \Device\Ide\IdePort1 [F82BFB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]} Device \Driver\atapi \Device\Ide\IdePort2 [F82BFB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]} Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e [F82BFB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]} AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.) AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ---- Processes - GMER 1.0.15 ---- Process C:\docume~1\compaq~1\locals~1\temp\t749cy2h .exe (*** hidden *** ) 1824 ---- Services - GMER 1.0.15 ---- Service (*** hidden *** ) [bOOT] djrzlw <-- ROOTKIT !!! ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\djrzlw@Type 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\djrzlw@Start 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\djrzlw@ErrorControl 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\djrzlw@Group Boot Bus Extender Reg HKLM\SYSTEM\ControlSet002\Services\djrzlw@Type 1 Reg HKLM\SYSTEM\ControlSet002\Services\djrzlw@Start 0 Reg HKLM\SYSTEM\ControlSet002\Services\djrzlw@ErrorControl 0 Reg HKLM\SYSTEM\ControlSet002\Services\djrzlw@Group Boot Bus Extender ---- Files - GMER 1.0.15 ---- File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification ---- EOF - GMER 1.0.15 ----
  19. I googled djrzlw.sys and there are zero results. How can that be a real thing if it's never been mentioned anywhere before?
  20. I was told that I probably have a new variant of Dr. Guard based on my posts here http://forums.malwarebytes.org/index.php?showtopic=42669 I started to follow the instructions to clean my system but quickly failed - I did the defogger thing, but after it said Finished! and I clicked OK it did not prompt me to reboot. I would have done the Defogger again, but it specifically says not to do it twice. So the instructions say to post the log. Here it is defogger_disable by jpshortstuff (23.02.10.1) Log created at 15:05 on 09/03/2010 (Compaq_Owner) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... Unable to read djrzlw.sys -=E.O.F=-
  21. It seems that you have to be connected to the internet for Malwarebytes to proceed. Once I did that it instantly removed the items. However, on reboot thay are all there. It also says that 'For Malwarebytes to complete changes, Registry Editing must be enabled. Click to enable Registry Editing.' I click to enable registry editing, but instantly get the same message caused by Dr Guard = "Registry editing has been disabled by administrator'. Then the computer reboots and Dr Guard is still in charge. The fix doesn't work unless we can ger registry editing to work. I've tried the manual command from Run, I've tried a VBS script that I found that others said worked, but nothing works.
  22. Hi. I've already done that. I'm at the 'Remove' stage, but it doesn't seem to be removing. 4 hours and no progress on the progress bar at removing just the first of 9 things found can't be the way it works, can it?
  23. In spite of having McAfee and Windows Defender actively protecting my computer, I got the Dr Guard malware infection. This is a vicious and fiendishly clever thing - it turns off Defender, tries to delete Malwarebytes, and takes over the command of your computer so that you cannot use systen restore. It takes over control of the registry whatever so that you cannot use regedit to turn on system restore. Then it spams from your machine like crazy, while redirecting every google search that you do to try to find solutions. I'm using a library computer now. I'm a novice at computers, but through HOURS of googling and using copy and paste to get around the re-direct, I managed to get Windows Defender back. I figured that since Dr Guard knocks Defender out it must be an existiential threat. The Windows Defender scan said that NOTHING was infected! So I tried the other thing Dr Guard tries to knock out - Malwarebytes. That revealed 9 things, trojans and Regisrty items. However, when I clicked to remove them, Malwarebytes says that it is 'quarantining' the items. Four hours later the progress bar shows nothing, and the text says it is quarantining the same item still (but no progress). It can't take that long to quarantine something, can it? What can I do to get this to work? I have 20 minutes left on the library computer, then I'm going home and I'll have to plug the DSL line back into my computer (I don't want Dr Guard logging my computer onto the net and doing things) and try to access this site. Thank you for any help. McAfee s@#$s and Windows Defender is useless.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.