BHO issue in IE 7, BHO still slowing IE down??

[astro3ron]

Had a false virus alert pop up on screen, but didn't click on anything. Didn't take a note of what it was other than I terminated IE. However, IE web browsing was slow after that. Scanned with MBAM and SpyHunter4. MBAM found a BHO,

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{afd4ad01-58c1-47db-a404-fbe00a6c5486} (Trojan.BHO) -> Quarantined and deleted successfully.

Further MBAM scans showed no sign of anything else. But I'm having hard time connecting to some web pages, including home page.

ESET online scan found remnants (2) of Win32/BHO.NMM trojan in the SysVol Info file Restore.... but nothing else

Tried to run GMER. 1st time it ran for a bit, then rebooted the machine. Running GMER in the account where the virus alert pop up occurred. Ran GMER a 2nd time. Hung the system. So no GMER logs, just MBAM.

Attahced is MBAM log

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4301

Windows 5.1.2600 Service Pack 2

Internet Explorer 7.0.5730.13

7/11/2010 7:16:37 AM

mbam-log-2010-07-11 (07-16-37).txt

Scan type: Full scan (C:\|E:\|)

Objects scanned: 298247

Time elapsed: 58 minute(s), 30 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{afd4ad01-58c1-47db-a404-fbe00a6c5486} (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Program Files\Shared\lib.dll (Adware.Deepdive) -> Quarantined and deleted successfully.

C:\Program Files\Shared\lib.sig (Adware.Deepdive) -> Quarantined and deleted successfully.

[Elise]

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

• The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  
• Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  
• The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  
• Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.
  

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Please download OTL from one of the following mirrors:
  • This is THE Mirror
    

  [*]Save it to your desktop.

  [*]Double click on the icon on your desktop.

  [*]Click the "Scan All Users" checkbox.

  [*]Push the button.

  [*]Two reports will open, copy and paste them in a reply here:

  • OTListIt.txt <-- Will be opened
    
  • Extra.txt <-- Will be minimized
    

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
  
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  

• Disconnect from the Internet and close all running programs.
  
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  
• Now click the Scan button. If you see a rootkit warning window, click OK.
  
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  
• Click the Copy button and paste the results into your next reply.
  
• Exit GMER and re-enable all active protection when done.
  

-- If you encounter any problems, try running GMER in Safe Mode.

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

• A detailed description of your problems
  
• A new OTL log (don't forget extra.txt)
  
• GMER log
  

[astro3ron]

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

• The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  
• Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  
• The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  
• Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.
  

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Please download OTL from one of the following mirrors:
  • This is THE Mirror
    

  [*]Save it to your desktop.

  [*]Double click on the icon on your desktop.

  [*]Click the "Scan All Users" checkbox.

  [*]Push the button.

  [*]Two reports will open, copy and paste them in a reply here:

  • OTListIt.txt <-- Will be opened
    
  • Extra.txt <-- Will be minimized
    

Please download GMER from one of the following locations and save it to your desktop:

• Main Mirror
  This version will download a randomly named file (Recommended)
  
• Zipped Mirror
  This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  

• Disconnect from the Internet and close all running programs.
  
• Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  
• Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  
• Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
  
  
• GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  
• If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  
• Now click the Scan button. If you see a rootkit warning window, click OK.
  
• When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  
• Click the Copy button and paste the results into your next reply.
  
• Exit GMER and re-enable all active protection when done.
  

-- If you encounter any problems, try running GMER in Safe Mode.

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

• A detailed description of your problems
  
• A new OTL log (don't forget extra.txt)
  
• GMER log
  

- OK Elise, here's what I got. I ran OTL in normal mode from the account, (adminron), which is the account where I encountered the problem. This account has a limited and not an admin permission. I ran GMER in safe mode from an account, (adminfull), that has full admin privs. GMER completed this time.

NOTES/COMMENTS:

These apps for ISS/BlackIce are legit, they're the firewall that we use for VPN at work.

Service C:\Program Files\ISS\BlackICE\blackd.exe (*** hidden *** ) BlackICE <-- ROOTKIT !!!

Service C:\Program Files\ISS\BlackICE\RapApp.exe (*** hidden *** ) RapApp <-- ROOTKIT !!!

Service C:\Program Files\ISS\BlackICE\vpatch.exe (*** hidden *** ) VPatch <-- ROOTKIT !!!

---------

IE 7 is the version of the web browser I use. Also use latest version of Firefox. Pop up message about system infested with virus occurred while visiting a web page (didn't note wh url) with IE7. False virus warning requested to scan whole system. I did not, nor did I click on anything in the popup. I did terminated IE7 via windows task manager.

Other accounts, some with limited and other with admin privs, work fine and I can get to web pages with either IE7 or Firefox. So it seems damage is limited to account, adminron.

Proventia Desktop (BlackIce) has reported a number of "events" from 216.245.195.235 (???) and 207.69.189.111 (Earthlink)

7/11/2010 12:53:34 PM, HTTP_IE_Script_HRAlign_Overflow

7/11/2010 9:17:57 PM, HTTP_Favorites_Icon_Overflow

7/11/2010 12:52:35 PM, Image_ICON_Malformed

That's about all I have.

Thanks

Ron

----------

OTL report

OTL logfile created on: 7/12/2010 5:41:26 AM - Run 1

OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\adminron\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 484.00 Mb Available Physical Memory | 47.00% Memory free

2.00 Gb Paging File | 2.00 Gb Available in Paging File | 86.00% Paging File free

Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 73.84 Gb Total Space | 21.52 Gb Free Space | 29.15% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

Drive E: | 75.17 Gb Total Space | 67.12 Gb Free Space | 89.29% Space Free | Partition Type: NTFS

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: RON3000

Current User Name: adminron

NOT logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/06/27 11:33:51 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\adminron\Desktop\OTL.com

PRC - [2007/06/13 03:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2006/09/27 21:33:44 | 000,125,168 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\VPTray.exe

PRC - [2006/07/19 20:26:04 | 000,052,896 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe

PRC - [2005/09/30 12:48:14 | 001,601,882 | ---- | M] (Internet Security Systems, Inc.) -- C:\Program Files\ISS\BlackICE\blackice.exe

PRC - [2005/02/16 17:15:20 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

PRC - [2003/06/20 02:43:00 | 000,024,576 | ---- | M] (BVRP Software) -- C:\Program Files\Digital Line Detect\DLG.exe

PRC - [2002/06/11 10:45:10 | 000,286,720 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

PRC - [2002/06/11 10:31:50 | 000,323,646 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe

PRC - [2001/02/13 00:58:54 | 000,226,720 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office10\MSOFFICE.EXE

========== Modules (SafeList) ==========

MOD - [2010/06/27 11:33:51 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\adminron\Desktop\OTL.com

MOD - [2006/08/25 08:45:55 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll

MOD - [2004/08/03 23:01:18 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\msscript.ocx

========== Win32 Services (SafeList) ==========

========== Driver Services (SafeList) ==========

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3242676782-1459987966-1782763977-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.jpl.nasa.gov/index.html"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.8

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2008/01/08 23:56:21 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/07/11 10:39:30 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/07/03 17:29:47 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/05/26 06:36:40 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.24\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2010/04/08 22:18:38 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Netscape 7.01\Extensions\\Components: C:\Program Files\Netscape\Netscape\Components [2010/06/16 19:36:18 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Netscape 7.01\Extensions\\Plugins: C:\Program Files\Netscape\Netscape\Plugins [2010/07/03 17:29:48 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Netscape 7.1\Extensions\\Components: C:\Program Files\Netscape\Netscape\Components [2010/06/16 19:36:18 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Netscape 7.1\Extensions\\Plugins: C:\Program Files\Netscape\Netscape\Plugins [2010/07/03 17:29:48 | 000,000,000 | ---D | M]

[2009/02/18 20:40:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adminron\Application Data\Mozilla\Extensions

[2010/07/09 16:45:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adminron\Application Data\Mozilla\Firefox\Profiles\ho27aq9r.default\extensions

[2010/05/27 07:35:15 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\adminron\Application Data\Mozilla\Firefox\Profiles\ho27aq9r.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2009/12/26 22:21:56 | 000,000,000 | ---D | M] (Web Developer) -- C:\Documents and Settings\adminron\Application Data\Mozilla\Firefox\Profiles\ho27aq9r.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}

[2010/07/09 16:45:06 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2010/07/11 12:58:24 | 000,000,734 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.

O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)

O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\hpztsb07.exe (HP)

O4 - HKLM..\Run: [iSUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)

O4 - HKLM..\Run: [iSUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)

O4 - HKLM..\Run: [MacLicense] C:\Program Files\Conversions Plus\MacLic.exe (DataViz Inc.)

O4 - HKLM..\Run: [Vptray] C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe (Hewlett-Packard Co.)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Proventia Desktop Agent.lnk = File not found

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk = C:\Program Files\cisco systems\vpn client\vpngui.exe (Cisco Systems, Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRemoteRecursiveEvents = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-3242676782-1459987966-1782763977-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-3242676782-1459987966-1782763977-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-3242676782-1459987966-1782763977-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-3242676782-1459987966-1782763977-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_16.dll (Sun Microsystems, Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\ISS\BlackICE\IBE\ICELSP_8.0.675.0.dll (Internet Security Systems, Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\ISS\BlackICE\IBE\ICELSP_8.0.675.0.dll (Internet Security Systems, Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\ISS\BlackICE\IBE\ICELSP_8.0.675.0.dll (Internet Security Systems, Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\Program Files\ISS\BlackICE\IBE\ICELSP_8.0.675.0.dll (Internet Security Systems, Inc.)

O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)

O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)

O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} http://downloadcenter.samsung.com/content/...trolLite_EN.cab (DjVuCtl Class)

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab (CKAVWebScan Object)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/microsoftu...b?1261437161937 (WUWebControl Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu...b?1261437142515 (MUWebControl Class)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0...oUploader55.cab (Facebook Photo Uploader 5 Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/autodl...indows-i586.cab (Java Plug-in 1.6.0_16)

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} http://v4.windowsupdate.microsoft.com/CAB/...8046.9385069444 (Reg Error: Key error.)

O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} http://www.microsoft.com/security/controls.../20/SassCln.CAB (SassCln Object)

O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} http://office.microsoft.com/officeupdate/content/opuc4.cab (Office Update Installation Engine)

O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} Reg Error: Key error. (Java Plug-in 1.4.0_01)

O16 - DPF: {CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA} Reg Error: Key error. (Java Plug-in 1.4.1_02)

O16 - DPF: {CAFEEFAC-0014-0002-0018-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl...indows-i586.cab (Java Plug-in 1.4.2_18)

O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa...ash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O16 - DPF: Microsoft XML Parser for Java file:///C:/WINDOWS/Java/classes/xmldso.cab (Reg Error: Key error.)

O18 - Protocol\Handler\lbxfile {56831180-F115-11d2-B6AA-00104B2B9943} - C:\Program Files\Libronix DLS\System\FileProt.dll (Libronix Corporation)

O18 - Protocol\Handler\lbxres {24508F1B-9E94-40EE-9759-9AF5795ADF52} - C:\Program Files\Libronix DLS\System\ResProt.dll (Libronix Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\SYSTEM32\NavLogon.dll (Symantec Corporation)

O24 - Desktop WallPaper: C:\Documents and Settings\adminron\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\adminron\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2002/09/03 12:36:02 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.001 -- [ NTFS ]

O32 - AutoRun File - [2004/05/28 19:55:33 | 000,000,177 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/07/12 05:40:04 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\adminron\Desktop\OTL.com

[2010/07/11 20:53:39 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2010/07/08 14:39:44 | 000,000,000 | ---D | C] -- C:\Program Files\Shared

[2010/06/29 22:05:30 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2010/06/29 19:36:39 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2010/06/29 11:38:39 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010/06/28 22:59:19 | 000,000,000 | RHSD | C] -- C:\cmdcons

[2010/06/28 22:59:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\setup.pss

[2010/06/28 22:58:58 | 000,000,000 | ---D | C] -- C:\WINDOWS\setupupd

[2010/06/26 21:45:21 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard

[2010/06/26 21:38:17 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group

[2010/06/16 14:46:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\adminron\My Documents\Church-web-6-16-10

========== Files - Modified Within 30 Days ==========

[2010/07/12 05:38:23 | 000,000,882 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2010/07/12 05:11:15 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2010/07/11 21:30:58 | 000,001,230 | ---- | M] () -- C:\WINDOWS\System32\WPA.DBL

[2010/07/11 21:27:53 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\adminron\NTUSER.INI

[2010/07/11 21:13:37 | 000,520,570 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010/07/11 21:13:37 | 000,440,488 | ---- | M] () -- C:\WINDOWS\System32\PERFH009.DAT

[2010/07/11 21:13:37 | 000,070,588 | ---- | M] () -- C:\WINDOWS\System32\PERFC009.DAT

[2010/07/11 21:07:20 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010/07/11 21:07:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\BOOTSTAT.DAT

[2010/07/11 21:07:01 | 000,762,120 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010/07/11 21:07:00 | 1072,762,880 | -HS- | M] () -- C:\hiberfil.sys

[2010/07/11 21:05:39 | 000,057,136 | ---- | M] () -- C:\WINDOWS\WIN.INI

[2010/07/11 20:26:05 | 008,650,752 | -H-- | M] () -- C:\Documents and Settings\adminron\NTUSER.DAT

[2010/07/11 18:53:09 | 000,000,440 | RHS- | M] () -- C:\Documents and Settings\adminron\ntuser.pol

[2010/07/11 17:47:31 | 000,000,606 | ---- | M] () -- C:\Documents and Settings\adminron\Application Data\wklnhst.dat

[2010/07/11 17:09:38 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\adminron\Desktop\6dq4fb1i.exe

[2010/07/11 17:09:38 | 000,293,376 | ---- | M] () -- C:\6dq4fb1i.exe

[2010/07/11 12:58:24 | 000,000,734 | ---- | M] () -- C:\WINDOWS\System32\drivers\ETC\hosts

[2010/07/09 07:37:33 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\adminron\My Documents\Sudoku-Numbers-9c.xls

[2010/07/08 21:55:50 | 000,000,083 | ---- | M] () -- C:\WINDOWS\CDMP_HtmlViewer.INI

[2010/07/08 21:55:12 | 000,000,032 | ---- | M] () -- C:\WINDOWS\CD_Start.INI

[2010/07/08 21:53:45 | 000,002,491 | ---- | M] () -- C:\Documents and Settings\adminron\Desktop\CDMenuPro V6 Editor.lnk

[2010/07/05 20:03:08 | 000,000,151 | ---- | M] () -- C:\WINDOWS\PhotoSnapViewer.INI

[2010/07/03 21:12:17 | 000,007,108 | ---- | M] () -- C:\WINDOWS\GWSPRO.INI

[2010/06/30 15:42:09 | 000,220,496 | ---- | M] () -- C:\Documents and Settings\adminron\Application Data\GDIPFONTCACHEV1.DAT

[2010/06/30 12:57:23 | 000,220,888 | ---- | M] () -- C:\Documents and Settings\adminron\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

[2010/06/29 11:56:46 | 000,000,252 | ---- | M] () -- C:\WINDOWS\system.ini

[2010/06/28 23:00:01 | 000,000,282 | RHS- | M] () -- C:\boot.ini

[2010/06/28 08:07:01 | 000,000,211 | RHS- | M] () -- C:\BOOT.BAK

[2010/06/27 22:10:40 | 000,032,256 | ---- | M] () -- C:\Documents and Settings\adminron\Desktop\AscensionVideoSystem.vsd

[2010/06/27 19:27:43 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\wininet_dll.iss

[2010/06/27 19:27:41 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\urlmon_dll.iss

[2010/06/27 19:27:41 | 000,000,028 | ---- | M] () -- C:\WINDOWS\System32\url_dll.iss

[2010/06/27 11:33:51 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\adminron\Desktop\OTL.com

[2010/06/27 05:10:56 | 015,487,048 | ---- | M] () -- C:\Dir0627-0500.lis

[2010/06/26 18:10:28 | 000,000,013 | ---- | M] () -- C:\WINDOWS\System32\WinSys32.crc

[2010/06/14 18:06:01 | 000,000,065 | ---- | M] () -- C:\Documents and Settings\adminron\default.pls

[2010/06/14 18:05:53 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

[2010/06/14 18:04:48 | 000,011,776 | ---- | M] () -- C:\Documents and Settings\adminron\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

========== Files Created - No Company Name ==========

[2010/07/11 17:50:07 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\adminron\Desktop\6dq4fb1i.exe

[2010/07/11 17:09:32 | 000,293,376 | ---- | C] () -- C:\6dq4fb1i.exe

[2010/06/30 15:37:10 | 000,000,606 | ---- | C] () -- C:\Documents and Settings\adminron\Application Data\wklnhst.dat

[2010/06/28 23:00:01 | 000,000,211 | RHS- | C] () -- C:\BOOT.BAK

[2010/06/28 22:59:55 | 000,260,272 | RHS- | C] () -- C:\cmldr

[2010/06/27 22:10:39 | 000,032,256 | ---- | C] () -- C:\Documents and Settings\adminron\Desktop\AscensionVideoSystem.vsd

[2010/06/27 19:27:42 | 000,000,028 | ---- | C] () -- C:\WINDOWS\System32\wininet_dll.iss

[2010/06/27 19:27:41 | 000,000,028 | ---- | C] () -- C:\WINDOWS\System32\urlmon_dll.iss

[2010/06/27 19:27:41 | 000,000,028 | ---- | C] () -- C:\WINDOWS\System32\url_dll.iss

[2010/06/27 05:08:24 | 015,487,048 | ---- | C] () -- C:\Dir0627-0500.lis

[2010/06/27 05:03:35 | 000,000,545 | ---- | C] () -- C:\WINDOWS\TXTPAD.PIF

[2010/06/26 15:52:45 | 000,000,440 | RHS- | C] () -- C:\Documents and Settings\adminron\ntuser.pol

[2010/06/26 15:37:00 | 1072,762,880 | -HS- | C] () -- C:\hiberfil.sys

[2009/10/12 21:48:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\CDMP_RtfViewer.INI

[2009/10/12 13:08:52 | 000,000,083 | ---- | C] () -- C:\WINDOWS\CDMP_HtmlViewer.INI

[2009/10/11 20:21:03 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI

[2009/10/03 20:35:51 | 000,000,037 | ---- | C] () -- C:\WINDOWS\Viewer.ini

[2009/09/01 19:12:38 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll

[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll

[2009/02/16 22:10:52 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Isdbg.ini

[2009/01/22 22:28:40 | 000,000,395 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI

[2009/01/15 20:39:05 | 000,000,453 | ---- | C] () -- C:\WINDOWS\I_VIEW32.INI

[2008/11/18 20:44:02 | 000,000,067 | ---- | C] () -- C:\WINDOWS\iltwain.ini

[2008/09/28 21:10:59 | 000,004,018 | ---- | C] () -- C:\WINDOWS\logos20.ini

[2008/03/30 18:14:40 | 000,000,214 | ---- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini

[2008/03/16 13:28:18 | 000,299,454 | ---- | C] () -- C:\WINDOWS\ALLSIM.INI

[2008/03/16 13:28:18 | 000,061,268 | ---- | C] () -- C:\WINDOWS\BIUTILSM.INI

[2008/03/16 13:28:18 | 000,057,969 | ---- | C] () -- C:\WINDOWS\SIMSIM.INI

[2008/03/16 13:28:18 | 000,000,580 | ---- | C] () -- C:\WINDOWS\Common.ini

[2008/03/16 13:28:17 | 000,051,712 | ---- | C] () -- C:\WINDOWS\System32\ngprtserv.dll

[2008/03/16 13:28:13 | 000,000,645 | ---- | C] () -- C:\WINDOWS\Setupwizard.ini

[2008/01/08 22:16:20 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini

[2007/03/05 22:52:56 | 000,000,070 | ---- | C] () -- C:\WINDOWS\etrack.ini

[2007/03/05 22:37:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\PROTOCOL.INI

[2007/02/27 18:07:57 | 000,000,161 | ---- | C] () -- C:\WINDOWS\System32\tdbgpp.dll

[2007/02/24 09:42:42 | 000,005,557 | ---- | C] () -- C:\WINDOWS\POWERUP.INI

[2007/01/21 22:42:33 | 000,202,752 | ---- | C] () -- C:\WINDOWS\CDAC14BA.DLL

[2007/01/21 22:42:31 | 000,011,376 | ---- | C] () -- C:\WINDOWS\System32\drivers\CdaC15BA.SYS

[2007/01/21 22:40:59 | 000,001,383 | ---- | C] () -- C:\WINDOWS\MPCWIN02.INI

[2006/12/21 21:45:11 | 000,000,000 | ---- | C] () -- C:\WINDOWS\autorun.INI

[2006/11/21 21:41:58 | 000,000,000 | ---- | C] () -- C:\WINDOWS\BWW.INI

[2006/10/18 22:06:54 | 000,000,776 | ---- | C] () -- C:\WINDOWS\CLARIS.INI

[2006/10/18 22:05:08 | 000,001,169 | ---- | C] () -- C:\WINDOWS\ALCHUPDT.INI

[2006/09/08 19:54:34 | 000,000,052 | ---- | C] () -- C:\WINDOWS\cool.ini

[2006/09/08 19:50:46 | 000,000,011 | ---- | C] () -- C:\WINDOWS\wordpad.ini

[2006/08/28 18:10:58 | 000,000,458 | ---- | C] () -- C:\WINDOWS\SIERRA.INI

[2006/08/01 20:22:52 | 000,001,417 | ---- | C] () -- C:\WINDOWS\QfnOnl.ini

[2006/08/01 20:22:51 | 000,000,792 | ---- | C] () -- C:\WINDOWS\QUICKEN.INI

[2006/08/01 20:22:51 | 000,000,052 | ---- | C] () -- C:\WINDOWS\intuprof.ini

[2006/08/01 20:22:49 | 000,000,362 | ---- | C] () -- C:\WINDOWS\QDQICK.INI

[2006/08/01 20:22:49 | 000,000,038 | ---- | C] () -- C:\WINDOWS\ACCWIZ.INI

[2006/02/14 21:30:10 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI

[2006/01/13 22:08:20 | 000,000,052 | ---- | C] () -- C:\WINDOWS\hpqwrap.INI

[2005/12/28 21:06:50 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2005/11/03 20:44:02 | 000,000,042 | ---- | C] () -- C:\WINDOWS\AlchemyMindworksUpdateList.INI

[2005/11/03 20:43:47 | 000,003,784 | ---- | C] () -- C:\WINDOWS\prspro.ini

[2005/09/03 18:57:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI

[2005/06/10 20:59:54 | 000,177,152 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll

[2005/06/10 20:53:52 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll

[2005/02/10 23:10:06 | 000,000,076 | ---- | C] () -- C:\WINDOWS\ccard100.ini

[2005/02/10 23:09:14 | 000,000,032 | ---- | C] () -- C:\WINDOWS\GRAPH5.INI

[2005/02/10 23:09:10 | 000,007,128 | ---- | C] () -- C:\WINDOWS\MSACC20.INI

[2004/11/28 21:22:14 | 000,000,229 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2004/09/14 21:59:44 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SafeGuard20.INI

[2004/06/30 15:04:46 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\SDelete.dll

[2004/06/27 20:29:17 | 000,000,022 | ---- | C] () -- C:\WINDOWS\kodakpcd.adminron.ini

[2004/06/27 20:17:07 | 000,000,034 | ---- | C] () -- C:\WINDOWS\hpfsched.ini

[2004/06/27 17:38:12 | 000,000,281 | ---- | C] () -- C:\WINDOWS\MATLAB.INI

[2004/05/28 19:55:33 | 000,037,376 | ---- | C] () -- C:\WINDOWS\System32\f90SQLDVF.dll

[2004/05/20 22:56:53 | 000,000,163 | ---- | C] () -- C:\WINDOWS\ed4w.ini

[2004/05/20 22:06:03 | 000,000,073 | ---- | C] () -- C:\WINDOWS\PTMail.INI

[2004/05/19 19:58:13 | 000,041,984 | ---- | C] () -- C:\WINDOWS\System32\aecrm.dll

[2004/05/19 19:47:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MTSTACK.INI

[2004/05/07 22:24:41 | 000,000,009 | ---- | C] () -- C:\WINDOWS\WINHLP32.INI

[2004/05/04 20:32:27 | 000,007,108 | ---- | C] () -- C:\WINDOWS\GWSPRO.INI

[2004/05/01 22:54:35 | 000,000,177 | ---- | C] () -- C:\WINDOWS\Winamp.ini

[2004/05/01 19:23:48 | 000,000,138 | ---- | C] () -- C:\WINDOWS\WinInit.ini.backup

[2004/04/28 21:24:11 | 000,000,120 | ---- | C] () -- C:\WINDOWS\setihome.ini

[2004/04/28 11:19:43 | 000,000,131 | ---- | C] () -- C:\WINDOWS\Readiris.ini

[2004/04/28 11:09:54 | 000,000,158 | ---- | C] () -- C:\WINDOWS\pagesuit.ini

[2004/04/28 11:09:52 | 000,023,040 | ---- | C] () -- C:\WINDOWS\System32\irisco32.dll

[2004/03/07 13:51:00 | 000,024,924 | ---- | C] () -- C:\WINDOWS\System32\openports.dll

[2004/03/02 01:36:06 | 000,000,185 | ---- | C] () -- C:\WINDOWS\mdm.ini

[2004/03/02 00:14:53 | 000,000,225 | ---- | C] () -- C:\WINDOWS\netscape.INI

[2004/02/29 22:56:33 | 000,000,010 | ---- | C] () -- C:\WINDOWS\System32\drivers\tmbi.sys

[2004/02/20 23:02:47 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2004/02/20 22:54:59 | 000,001,315 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2004/02/20 22:50:53 | 000,000,138 | ---- | C] () -- C:\WINDOWS\WinInit.ini

[2004/02/20 22:39:16 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2004/02/20 22:39:02 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini

[2004/02/20 22:23:12 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI

[2003/10/16 14:50:50 | 000,000,791 | ---- | C] () -- C:\WINDOWS\ORUN32.INI

[2003/08/13 21:54:00 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini

[2002/11/22 11:50:06 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\hpodinet.dll

[2002/08/29 04:00:00 | 000,022,150 | ---- | C] () -- C:\WINDOWS\msvideo.dll

[2002/05/29 06:50:02 | 000,552,960 | ---- | C] () -- C:\WINDOWS\System32\hpotscl.dll

[2001/11/09 14:27:16 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\glut32.dll

[2000/09/08 18:53:50 | 000,073,839 | ---- | C] () -- C:\WINDOWS\System32\KodakOneTouch.dll

[1999/01/22 11:46:58 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

[1998/06/10 01:00:00 | 000,015,120 | ---- | C] () -- C:\WINDOWS\System32\REPUTIL.DLL

[1998/05/18 01:00:00 | 000,014,017 | ---- | C] () -- C:\WINDOWS\JAUTOEXP.INI

[1998/04/24 01:00:00 | 000,000,218 | ---- | C] () -- C:\WINDOWS\FRONTPG.INI

[1997/07/11 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\ODBCSTF.DLL

[1997/07/11 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL

[1997/05/11 07:20:50 | 000,062,464 | ---- | C] () -- C:\WINDOWS\System32\hs_regex.dll

[1996/11/14 00:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL

[1979/12/31 23:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll

< End of report >

------------------------ Extras report ----------------

OTL Extras logfile created on: 7/12/2010 5:41:26 AM - Run 1

OTL by OldTimer - Version 3.2.7.0 Folder = C:\Documents and Settings\adminron\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,023.00 Mb Total Physical Memory | 484.00 Mb Available Physical Memory | 47.00% Memory free

2.00 Gb Paging File | 2.00 Gb Available in Paging File | 86.00% Paging File free

Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 73.84 Gb Total Space | 21.52 Gb Free Space | 29.15% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

Drive E: | 75.17 Gb Total Space | 67.12 Gb Free Space | 89.29% Space Free | Partition Type: NTFS

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: RON3000

Current User Name: adminron

NOT logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.inf [@ = TextPad.inf] -- C:\Program Files\TextPad\TXTPAD32.EXE (Helios Software Solutions)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htafile [open] -- "%1" %*

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Program Files\Winamp\Winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 1

"AntiVirusOverride" = 0

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\ISS\BlackICE\blackice.exe" = C:\Program Files\ISS\BlackICE\blackice.exe:LocalSubNet:Enabled:BlackICE PC Protection -- (Internet Security Systems, Inc.)

"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealOne Player -- (RealNetworks, Inc.)

"C:\Program Files\TurboTax\Deluxe 2006\32bit\ttax.exe" = C:\Program Files\TurboTax\Deluxe 2006\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax -- (Intuit, Inc.)

"C:\Program Files\TurboTax\Deluxe 2006\32bit\updatemgr.exe" = C:\Program Files\TurboTax\Deluxe 2006\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager -- (Intuit, Inc.)

"C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\ttax.exe:LocalSubNet:Enabled:TurboTax -- (Intuit, Inc.)

"C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe" = C:\Program Files\TurboTax\Deluxe 2007\32bit\updatemgr.exe:LocalSubNet:Enabled:TurboTax Update Manager -- (Intuit, Inc.)

"C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe" = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare -- ()

"C:\Ziphold\Pwr-9258\ipEdit-1.exe" = C:\Ziphold\Pwr-9258\ipEdit-1.exe:*:Enabled:ipEdit IPCam Scan Utility -- (Aviosys Inc.)

"C:\Program Files\FileZilla FTP Client\filezilla.exe" = C:\Program Files\FileZilla FTP Client\filezilla.exe:*:Enabled:FileZilla FTP Client -- (FileZilla Project)

"C:\WINDOWS\SYSTEM32\mmc.exe" = C:\WINDOWS\SYSTEM32\mmc.exe:*:Enabled:Microsoft Management Console -- (Microsoft Corporation)

"C:\Program Files\Symantec AntiVirus\VPC32.exe" = C:\Program Files\Symantec AntiVirus\VPC32.exe:LocalSubNet:Enabled:Symantec AntiVirus -- (Symantec Corporation)

"C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe" = C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe:LocalSubNet:Disabled:Intuit Update Shared Downloads Server -- (Intuit Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{00040409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 SR-1 Disc 2

"{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}" = Notifier

"{04410044-9149-45C6-A806-F2BF9CFCE762}" = Microsoft Encarta Encyclopedia Standard 2004

"{059AE187-404C-47C5-B846-097DAF59DC44}" = Adobe Stock Photos 1.0

"{073F22CE-9A5B-4A40-A604-C7270AC6BF34}" = ESSSONIC

"{085FE193-B676-11D4-82BC-00A0C993905F}" = Thomas Bros. Street Guide Digital Edition

"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager

"{0AD5AD99-6172-4385-8765-385FBE3A1013}" = Sunbelt CounterSpy

"{0F819909-B465-4F8D-B271-EBB1C7E03696}" = CDMenuPro V5

"{11F1920A-56A2-4642-B6E0-3B31A12C9288}" = Dell Solution Center

"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD

"{15F4085A-BC98-4590-AFFD-03BBBE49524E}" = Garmin Communicator Plugin

"{19991EAD-C273-47EB-87E8-0D274925230B}" = OEB Resource Driver

"{1D643CD7-4DD6-11D7-A4E0-000874180BB3}" = Microsoft Money 2004

"{231F68F4-70E4-41A6-BEDA-7E7934169B54}" = Maxtor OneTouch

"{2554D4F3-CB25-4917-863F-198E897D25C6}" = CDMenuPro V6

"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Dell Media Experience

"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java 6 Update 16

"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime

"{29521505-F489-4822-ADFA-32C6DEE4F114}" = TurboTax 2008 WinPerUserEducation

"{29D135E8-59AB-4B92-8E7B-9F29D9CC914D}" = Canvas 7

"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt

"{33BEE6F3-9987-4F98-A069-97A64EC8321A}" = Microsoft Works Suite Add-in for Microsoft Word

"{33CFCF98-F8D6-4549-B469-6F4295676D83}" = Symantec AntiVirus

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page

"{360EDFB0-EAA2-012B-AD16-000000000000}" = TurboTax 2009 wcaiper

"{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset

"{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine

"{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport

"{3A3521B3-5910-4941-A0F6-65E089DA5E85}" = Grade Machine

"{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper

"{3CA39B0C-BA85-4D42-AC0F-1FF5F60C3353}" = OTtBPSDK

"{3CA9D105-113C-11D8-AB3E-000102B0F79A}" = Readiris Pro 9

"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting

"{40F3846A-55FB-41BF-8B57-345DFB29B674}" = Screen Shot Deluxe 5.0

"{43FCA273-9534-40DB-B7C5-D7758875616A}" = Dell Support

"{45EBDA59-D33B-433A-956E-B2F236468B56}" = MUSICMATCH

[Elise]

Hello again,

Thank you for clarifying the Black Ice detections.

Before continuing, one question: is there a reason you are still using XP Service Pack 2? Are you aware Microsoft has ended all support for the Service Pack version? This means that windows will no longer get critical updates and thus your system is open for infections that exploit such vulnerabilities.

For now, do not install Service Pack 3 yet; in you do so on an infected computer, there might be complications, so lets first make sure everything is clean.

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  
• Double click on Combofix.exe and follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

[astro3ron]

ComboFix log:

I tried to run ComboFix on the adminron account (Limited account), but got msg Trying to run CFScript? CFScript is spelt wrong. ComboFix terminated. So I ran ComboFix on the Full admin account. Attached is the log.

Note: Lahey ED Developer .lnk is legit.. (c:\documents and settings\adminron\Start Menu\Lahey ED Developer .lnk)

Question: why were these quarantined?

c:\program files\Shared

c:\windows\msvideo.dll

FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} I thought I'd removed ZA a long time ago????

-----------------

ComboFix 10-07-12.06 - adminfull 07/13/2010 8:52.2.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.425 [GMT -7:00]

Running from: c:\documents and settings\adminfull\Desktop\ComboFix.exe

AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: Proventia Desktop *enabled* {73198F12-4C15-41ED-9303-1EF5FEC6BBA4}

FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\adminron\Start Menu\Lahey ED Developer .lnk

c:\program files\Shared

c:\windows\msvideo.dll

.

((((((((((((((((((((((((( Files Created from 2010-06-13 to 2010-07-13 )))))))))))))))))))))))))))))))

.

2010-07-13 15:37 . 2010-07-13 15:37 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google

2010-07-12 00:09 . 2010-07-12 00:09 293376 ----a-w- C:\6dq4fb1i.exe

2010-07-11 17:39 . 2010-07-11 17:39 -------- d-----w- c:\documents and settings\adminfull\Local Settings\Application Data\Mozilla

2010-06-30 05:05 . 2010-06-30 05:05 -------- d-----w- c:\program files\ESET

2010-06-27 19:28 . 2010-06-27 19:28 -------- d-----w- c:\documents and settings\adminfull\Application Data\Scooter Software

2010-06-27 12:03 . 1998-02-15 10:21 545 ----a-w- c:\windows\TXTPAD.PIF

2010-06-27 04:49 . 2010-06-27 04:49 110080 ----a-r- c:\documents and settings\adminfull\Application Data\Microsoft\Installer\{6D1E8360-2F35-4C84-8D53-C614FBCA621C}\IconD7F16134.exe

2010-06-27 04:49 . 2010-06-27 04:49 110080 ----a-r- c:\documents and settings\adminfull\Application Data\Microsoft\Installer\{6D1E8360-2F35-4C84-8D53-C614FBCA621C}\IconF7A21AF7.exe

2010-06-27 04:45 . 2010-06-27 04:45 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2010-06-27 04:38 . 2010-06-27 04:38 -------- d-----w- c:\program files\Enigma Software Group

2010-06-27 02:58 . 2010-06-27 02:58 -------- d-----w- c:\documents and settings\adminron1\Local Settings\Application Data\Symantec

2010-06-27 01:08 . 2010-06-27 01:08 -------- d-----w- c:\documents and settings\adminfull\Application Data\CoffeeCup Software

2010-06-26 19:17 . 2010-06-26 19:17 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2010-06-26 19:07 . 2010-06-26 19:07 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Symantec

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-13 15:43 . 2008-02-01 07:39 -------- d-----w- c:\program files\Symantec AntiVirus

2010-07-13 04:54 . 2004-03-01 05:43 -------- d-----w- c:\program files\WinPoET Broadband Connection

2010-07-13 02:45 . 2006-10-19 05:31 -------- d-----w- c:\program files\Mozilla Thunderbird

2010-07-13 01:35 . 2010-07-13 01:35 0 ----a-w- c:\documents and settings\adminron1\Application Data\wklnhst.dat

2010-07-12 03:45 . 2009-02-12 04:33 798 ----a-w- c:\documents and settings\adminfull\Application Data\wklnhst.dat

2010-07-12 00:47 . 2010-06-30 22:37 606 ----a-w- c:\documents and settings\adminron\Application Data\wklnhst.dat

2010-07-04 00:29 . 2009-08-25 04:31 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2010-06-30 19:57 . 2004-02-28 04:12 220888 ----a-w- c:\documents and settings\adminron\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-06-30 19:52 . 2004-02-21 06:02 220888 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-06-27 12:03 . 2004-03-01 06:27 -------- d-----w- c:\program files\TextPad

2010-06-27 01:08 . 2009-02-26 05:15 -------- d-----w- c:\program files\CoffeeCup Software

2010-06-16 22:14 . 2009-01-24 21:33 -------- d-----w- c:\documents and settings\adminron\Application Data\FileZilla

2010-06-16 21:39 . 2009-01-24 21:33 -------- d-----w- c:\program files\FileZilla FTP Client

2010-05-26 13:36 . 2010-05-26 13:36 -------- d-----w- c:\documents and settings\adminfull\Application Data\Thunderbird

2010-05-20 08:00 . 2009-04-30 05:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-05-20 03:19 . 2004-02-21 05:22 -------- d-----w- c:\program files\Java

2010-05-20 03:14 . 2010-05-20 03:14 -------- d-----w- c:\program files\Common Files\Java

2010-05-17 00:15 . 2005-11-27 01:22 -------- d-----w- c:\program files\Google

2010-05-16 21:03 . 2010-05-16 21:03 -------- d-----w- c:\documents and settings\adminron\Application Data\Amazon

2010-05-16 21:02 . 2010-05-16 21:02 -------- d-----w- c:\program files\Amazon

2010-05-04 17:20 . 2006-04-28 17:58 832512 ----a-w- c:\windows\system32\wininet.dll

2010-05-04 17:20 . 2006-09-03 02:31 78336 ----a-w- c:\windows\system32\ieencode.dll

2010-05-04 17:20 . 2002-08-29 11:00 17408 ----a-w- c:\windows\system32\corpol.dll

2010-05-02 05:56 . 2002-08-29 11:00 1850880 ----a-w- c:\windows\system32\win32k.sys

2010-04-29 22:39 . 2009-04-30 05:16 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 22:39 . 2009-04-30 05:16 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-20 05:51 . 2002-08-29 11:00 285696 ----a-w- c:\windows\system32\atmfd.dll

2004-06-10 01:30 . 2004-06-10 01:30 1906 ----a-w- c:\program files\Shortcut to Wtp700.exe.lnk

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-11-22 188416]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-20 52896]

"Vptray"="c:\progra~1\Symant~1\VPTray.exe" [2006-09-28 125168]

"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-17 221184]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]

"MacLicense"="c:\program files\Conversions Plus\MacLic.exe" [2001-09-16 163904]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

c:\documents and settings\adminfull\Start Menu\Programs\Startup\

Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-4-28 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-4-28 113664]

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2004-2-20 24576]

hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2002-6-11 323646]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma.lnk

backup=c:\windows\pss\Adobe Gamma.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk

backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MacName.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\MacName.lnk

backup=c:\windows\pss\MacName.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^officejet 6100.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\officejet 6100.lnk

backup=c:\windows\pss\officejet 6100.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-10-03 11:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2004-08-04 07:56 15360 ----a-w- c:\windows\SYSTEM32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon04]

2002-11-22 18:48 348160 ----a-w- c:\windows\SYSTEM32\hphmon04.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-03-18 04:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]

2002-04-11 11:19 69632 ----a-w- c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard]

2003-02-13 07:01 155648 ----a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-09-07 17:56 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunServer]

2005-10-28 23:33 290816 ----a-w- c:\program files\Sunbelt Software\CounterSpy\Consumer\SunServer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

"c:\\Ziphold\\Pwr-9258\\ipEdit-1.exe"=

"c:\\Program Files\\FileZilla FTP Client\\filezilla.exe"=

"c:\\WINDOWS\\SYSTEM32\\mmc.exe"=

R0 MacOpen;MacOpen;c:\windows\SYSTEM32\DRIVERS\MacOpen.sys [5/19/2009 6:39 PM 176709]

R1 GhPciScan;GhostPciScanner;c:\program files\Symantec\Norton Ghost 2003\GhPciScan.sys [12/17/2003 3:41 PM 5632]

R2 SpyHunter 4 Service;SpyHunter 4 Service;c:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [5/18/2010 5:06 PM 327064]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [6/4/2010 9:07 PM 102448]

R3 MakoNT;MakoNT;c:\windows\SYSTEM32\DRIVERS\MakoNT.sys [3/18/2007 11:54 AM 76913]

R3 rap;rap;c:\windows\SYSTEM32\DRIVERS\RapDrv.sys [2/29/2004 11:25 PM 46001]

R4 BLACK;black;c:\windows\SYSTEM32\DRIVERS\Blackcat.sys [3/18/2007 11:54 AM 234155]

S2 gupdate1ca18aa2e626a8;Google Update Service (gupdate1ca18aa2e626a8);c:\program files\Google\Update\GoogleUpdate.exe [8/8/2009 9:29 PM 133104]

S3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [1/27/2010 6:10 PM 5248]

S3 RapFile;RapFile;c:\windows\SYSTEM32\DRIVERS\RapFile.sys [2/29/2004 11:25 PM 36644]

S3 RapNet;RapNet;c:\windows\SYSTEM32\DRIVERS\RapNet.sys [2/29/2004 11:25 PM 24344]

S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/27/2006 9:33 PM 116464]

S3 WrKPoET2000;WrKPoET2000;c:\program files\WinPoET Broadband Connection\WrKPoET2000.sys [2/29/2004 10:43 PM 52354]

UnknownUnknown BlackICE;BlackICE; [x]

UnknownUnknown VPatch;VPatch; [x]

.

Contents of the 'Scheduled Tasks' folder

2009-06-15 c:\windows\Tasks\FRU Task 2002-06-11 17:56ewlett-Packard2002-06-11 17:56p psc 2200 series0873DBB30DAF953F7DCEA1BDCC4F78BFDB130745237001639.job

- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2002-06-11 17:56]

2010-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-09 04:29]

2010-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-09 04:29]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://google.com/

mStart Page = hxxp://www.dell4me.com/myway

mSearch Bar =

uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000

LSP: c:\program files\ISS\BlackICE\IBE\ICELSP_8.0.675.0.dll

TCP: {69F81847-C4DA-49EF-8498-B8522C761206} = 192.168.1.254

DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab

FF - ProfilePath - c:\documents and settings\adminfull\Application Data\Mozilla\Firefox\Profiles\exyzoe92.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npaudio.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npavi32.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPBeatnk.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdrmv2.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdsplay.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPJPI142_18.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npnul32.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nppdf32.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nppl3260.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin2.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin3.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin4.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin5.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin6.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin7.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprfxins.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprjplug.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprpjplug.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npswf32.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npwmsdrm.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

.

------- File Associations -------

.

.scr=AutoCADScript

.txt=TextPad.txt

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-13 09:04

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]

"ImagePath"="\"\""

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\

.

Completion time: 2010-07-13 09:09:42

ComboFix-quarantined-files.txt 2010-07-13 16:09

Pre-Run: 22,578,659,328 bytes free

Post-Run: 22,597,275,648 bytes free

- - End Of File - - 3BCF55E9A0CA714CF2A403AECEF6EC27

[Elise]

Hello again,

Please make sure to reset your router (it should have a button on the backside).

Let me know if that fixes the connection issues.

[astro3ron]

HUH???? reset router??? Don't use a router. There's a Motorola DSL modem that I use to connect to the outside. But what does a router have to do with my problem? Sorry, Elsie, maybe I wasn't clear on the connection issue. The connection problem I had was with IE in the adminron account. The web browser wasn't connecting to the url of my home page, coming up real slow, if at all, usually timing out. I tried other urls and they were timing out sometime as well. These problems only happened in the one account where I first encountered the fake AV pop up. I can connect to the outside with a web browser in all the other accounts on the machine using IE7. I can even connect using Firefox in all the accounts, even the one (adminron) where the problem occurred. While in the adminron account, I just now tried connecting using the IE icon on the desktop and that works now... The way I brought up IE before was via the shortcut in the quick launch toolbar. Wonder if that was corrupt or pointed to something else. I've since deleted the IE shortcut in the quick launch toolbar and replaced it with a new copy.

So what if anything cleared up the problem using ComboFix or one of the other apps you had me run?

Any comment on these following issues?

Note: Lahey ED Developer .lnk is legit.. (c:\documents and settings\adminron\Start Menu\Lahey ED Developer .lnk) How can we get this back?

Question: why were these quarantined? ?????????????????????????????????

c:\program files\Shared

c:\windows\msvideo.dll

Wondering why ZA is even showing up in anything. Thought I uninstalled it long time ago when it was giving me problems with WinXP.

FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} I thought I'd removed ZA a long time ago????

WInXP sp3... probably going to update my system to that. sp3 was causing some issues a while back one year ago, so didn't install it. Don't recall what those issues were. Also, issues with older equipment and sp3 not supporting theose devices. At work we still use SP2 and get security updates from MS, granted were a large aerospace corp that has cut a deal with MS to get those patches. We also ONLY use IE6, not 7 or 8. 7 & 8 are still security risks... but I'm not that deep in the security part of IT at work.

I'll try using IE7 tonight some more in the adminron account to see what issues if any crop up. Thanks for your help. Did you see anything suspicious in the logs from before that might have indicated why IE was having a problem, like some rogue BHO in the registry?

Regards, Ron

[Elise]

First of all, SP2, even if you still get updates is NOT adequate anymore! SP3 had some issues way back when it came out, but not any longer. IE7 is not much of an improvement, but IE8 is sure recommended, its not only safer (and then I mean, a LOT safer) than IE6, but also faster and has some additional features.

If you want to make sure you don't get reinfected, my strong recommendation is to keep windows up to date (with service packs and latest IE releases)!!

Sorry for misunderstanding your connection issue and good to hear it seems to work fine now. Combofix indeed resets some default settings for IE.

C:\Program\Shared was most likely deleted because it was an empty folder.

We can dequarantine the other files with a script, the msvideo.dll file was a false positive detection. We will also remove ZoneAlarm then, since it is only a leftover (a setting in windows Security Center).

For now, I want to know what problems you are still having. If nothing serious, we will dequarantine the files.

[astro3ron]

Thanks, Elise. Everything seems to be running better. Do you know what IE settings were reset by ComboFix? Prior to running ComboFix, I had reset IE settings in Internet options, but it didn't seem to change things for the adminron account. The IT department at work must have locked down the settings on machines for IE6 or we have a vaiant of IE6. I know we're restricted from accessing many web sites. But anywho, my machine is working much better. Ron

[Elise]

Its difficult to say which options were reset by Combofix; it has a bunch of automatic routines that check and change all kind of default settings if needed.

Suffice it to say its not only options you can change in Internet Options, but also some registry entries that often are changed by malware.

CF-SCRIPT

-------------

We need to execute a CF-script.

• Close any open browsers.
  
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
• Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:
  

SecCenter::
{829BDA32-94B3-44F4-8446-F8FCFF809F8B}

DeQuarantine::
c:\qoobox\quarantine\c\documents and settings\adminron\Start Menu\Lahey ED Developer .vir
c:\qoobox\quarantine\c\windows\msvideo.vir

Quit::

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Please launch MBAM, update it and run a full scan. Post me the resulting log.

[astro3ron]

OK Elsie, here's the latest logs from ComboFix and MBAM.

Thanks for all your help. Guess I need to update to SP3 or maybe take the plunge to Win 7... But all the apps I have to reload... sigh.

Ron

---------------------------------

ComboFix 10-07-12.06 - adminfull 07/14/2010 21:45:49.3.1 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.453 [GMT -7:00]

Running from: c:\documents and settings\adminfull\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\adminfull\Desktop\CFScript.txt

AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: Proventia Desktop *enabled* {73198F12-4C15-41ED-9303-1EF5FEC6BBA4}

* Resident AV is active

.

((((((((((((((((((((((((( Files Created from 2010-06-15 to 2010-07-15 )))))))))))))))))))))))))))))))

.

2010-07-13 15:37 . 2010-07-13 15:37 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Google

2010-07-12 00:09 . 2010-07-12 00:09 293376 ----a-w- C:\6dq4fb1i.exe

2010-07-11 17:39 . 2010-07-11 17:39 -------- d-----w- c:\documents and settings\adminfull\Local Settings\Application Data\Mozilla

2010-06-30 05:05 . 2010-06-30 05:05 -------- d-----w- c:\program files\ESET

2010-06-27 19:28 . 2010-06-27 19:28 -------- d-----w- c:\documents and settings\adminfull\Application Data\Scooter Software

2010-06-27 12:03 . 1998-02-15 10:21 545 ----a-w- c:\windows\TXTPAD.PIF

2010-06-27 04:49 . 2010-06-27 04:49 110080 ----a-r- c:\documents and settings\adminfull\Application Data\Microsoft\Installer\{6D1E8360-2F35-4C84-8D53-C614FBCA621C}\IconD7F16134.exe

2010-06-27 04:49 . 2010-06-27 04:49 110080 ----a-r- c:\documents and settings\adminfull\Application Data\Microsoft\Installer\{6D1E8360-2F35-4C84-8D53-C614FBCA621C}\IconF7A21AF7.exe

2010-06-27 04:45 . 2010-06-27 04:45 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2010-06-27 04:38 . 2010-06-27 04:38 -------- d-----w- c:\program files\Enigma Software Group

2010-06-27 02:58 . 2010-06-27 02:58 -------- d-----w- c:\documents and settings\adminron1\Local Settings\Application Data\Symantec

2010-06-27 01:08 . 2010-06-27 01:08 -------- d-----w- c:\documents and settings\adminfull\Application Data\CoffeeCup Software

2010-06-26 19:17 . 2010-06-26 19:17 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2010-06-26 19:07 . 2010-06-26 19:07 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Symantec

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-15 04:40 . 2008-02-01 07:39 -------- d-----w- c:\program files\Symantec AntiVirus

2010-07-15 02:52 . 2006-10-19 05:31 -------- d-----w- c:\program files\Mozilla Thunderbird

2010-07-14 20:17 . 2010-06-30 22:37 760 ----a-w- c:\documents and settings\adminron\Application Data\wklnhst.dat

2010-07-14 05:26 . 2010-06-27 02:57 220888 ----a-w- c:\documents and settings\adminron1\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-07-14 05:24 . 2004-03-01 05:43 -------- d-----w- c:\program files\WinPoET Broadband Connection

2010-07-14 05:20 . 2010-07-13 01:35 158 ----a-w- c:\documents and settings\adminron1\Application Data\wklnhst.dat

2010-07-12 03:45 . 2009-02-12 04:33 798 ----a-w- c:\documents and settings\adminfull\Application Data\wklnhst.dat

2010-07-04 00:29 . 2009-08-25 04:31 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2010-06-30 19:57 . 2004-02-28 04:12 220888 ----a-w- c:\documents and settings\adminron\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-06-30 19:52 . 2004-02-21 06:02 220888 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-06-27 12:03 . 2004-03-01 06:27 -------- d-----w- c:\program files\TextPad

2010-06-27 01:08 . 2009-02-26 05:15 -------- d-----w- c:\program files\CoffeeCup Software

2010-06-16 22:14 . 2009-01-24 21:33 -------- d-----w- c:\documents and settings\adminron\Application Data\FileZilla

2010-06-16 21:39 . 2009-01-24 21:33 -------- d-----w- c:\program files\FileZilla FTP Client

2010-05-26 13:36 . 2010-05-26 13:36 -------- d-----w- c:\documents and settings\adminfull\Application Data\Thunderbird

2010-05-20 08:00 . 2009-04-30 05:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-05-20 03:19 . 2004-02-21 05:22 -------- d-----w- c:\program files\Java

2010-05-20 03:14 . 2010-05-20 03:14 -------- d-----w- c:\program files\Common Files\Java

2010-05-17 00:15 . 2005-11-27 01:22 -------- d-----w- c:\program files\Google

2010-05-16 21:03 . 2010-05-16 21:03 -------- d-----w- c:\documents and settings\adminron\Application Data\Amazon

2010-05-16 21:02 . 2010-05-16 21:02 -------- d-----w- c:\program files\Amazon

2010-05-04 17:20 . 2006-04-28 17:58 832512 ----a-w- c:\windows\system32\wininet.dll

2010-05-04 17:20 . 2006-09-03 02:31 78336 ----a-w- c:\windows\system32\ieencode.dll

2010-05-04 17:20 . 2002-08-29 11:00 17408 ----a-w- c:\windows\system32\corpol.dll

2010-05-02 05:56 . 2002-08-29 11:00 1850880 ----a-w- c:\windows\system32\win32k.sys

2010-04-29 22:39 . 2009-04-30 05:16 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 22:39 . 2009-04-30 05:16 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-20 05:51 . 2002-08-29 11:00 285696 ----a-w- c:\windows\system32\atmfd.dll

2004-06-10 01:30 . 2004-06-10 01:30 1906 ----a-w- c:\program files\Shortcut to Wtp700.exe.lnk

.

((((((((((((((((((((((((((((( SnapShot@2010-07-13_16.05.14 )))))))))))))))))))))))))))))))))))))))))

.

- 2010-07-13 04:54 . 2010-07-13 04:54 16384 c:\windows\Temp\Perflib_Perfdata_730.dat

+ 2010-07-14 05:24 . 2010-07-14 05:24 16384 c:\windows\Temp\Perflib_Perfdata_730.dat

+ 2004-02-21 05:39 . 2010-07-14 05:28 70588 c:\windows\SYSTEM32\PERFC009.DAT

- 2004-02-21 05:39 . 2010-07-13 04:58 70588 c:\windows\SYSTEM32\PERFC009.DAT

+ 2004-02-21 05:39 . 2010-07-14 05:28 440488 c:\windows\SYSTEM32\PERFH009.DAT

- 2004-02-21 05:39 . 2010-07-13 04:58 440488 c:\windows\SYSTEM32\PERFH009.DAT

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-11-22 188416]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-20 52896]

"Vptray"="c:\progra~1\Symant~1\VPTray.exe" [2006-09-28 125168]

"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-17 221184]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-17 81920]

"MacLicense"="c:\program files\Conversions Plus\MacLic.exe" [2001-09-16 163904]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

c:\documents and settings\adminfull\Start Menu\Programs\Startup\

Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-4-28 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-4-28 113664]

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2004-2-20 24576]

hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2002-6-11 323646]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma.lnk

backup=c:\windows\pss\Adobe Gamma.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk

backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^MacName.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\MacName.lnk

backup=c:\windows\pss\MacName.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^officejet 6100.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\officejet 6100.lnk

backup=c:\windows\pss\officejet 6100.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

c:\windows\system32\dumprep 0 -k [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-10-03 11:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2004-08-04 07:56 15360 ----a-w- c:\windows\SYSTEM32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon04]

2002-11-22 18:48 348160 ----a-w- c:\windows\SYSTEM32\hphmon04.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-03-18 04:53 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon]

2002-04-11 11:19 69632 ----a-w- c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StorageGuard]

2003-02-13 07:01 155648 ----a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-09-07 17:56 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunServer]

2005-10-28 23:33 290816 ----a-w- c:\program files\Sunbelt Software\CounterSpy\Consumer\SunServer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

"c:\\Ziphold\\Pwr-9258\\ipEdit-1.exe"=

"c:\\Program Files\\FileZilla FTP Client\\filezilla.exe"=

"c:\\WINDOWS\\SYSTEM32\\mmc.exe"=

R0 MacOpen;MacOpen;c:\windows\SYSTEM32\DRIVERS\MacOpen.sys [5/19/2009 6:39 PM 176709]

R1 GhPciScan;GhostPciScanner;c:\program files\Symantec\Norton Ghost 2003\GhPciScan.sys [12/17/2003 3:41 PM 5632]

R2 SpyHunter 4 Service;SpyHunter 4 Service;c:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [5/18/2010 5:06 PM 327064]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [6/4/2010 9:07 PM 102448]

R3 MakoNT;MakoNT;c:\windows\SYSTEM32\DRIVERS\MakoNT.sys [3/18/2007 11:54 AM 76913]

R3 rap;rap;c:\windows\SYSTEM32\DRIVERS\RapDrv.sys [2/29/2004 11:25 PM 46001]

R4 BLACK;black;c:\windows\SYSTEM32\DRIVERS\Blackcat.sys [3/18/2007 11:54 AM 234155]

S2 gupdate1ca18aa2e626a8;Google Update Service (gupdate1ca18aa2e626a8);c:\program files\Google\Update\GoogleUpdate.exe [8/8/2009 9:29 PM 133104]

S3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [1/27/2010 6:10 PM 5248]

S3 RapFile;RapFile;c:\windows\SYSTEM32\DRIVERS\RapFile.sys [2/29/2004 11:25 PM 36644]

S3 RapNet;RapNet;c:\windows\SYSTEM32\DRIVERS\RapNet.sys [2/29/2004 11:25 PM 24344]

S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/27/2006 9:33 PM 116464]

S3 WrKPoET2000;WrKPoET2000;c:\program files\WinPoET Broadband Connection\WrKPoET2000.sys [2/29/2004 10:43 PM 52354]

UnknownUnknown BlackICE;BlackICE; [x]

UnknownUnknown VPatch;VPatch; [x]

.

Contents of the 'Scheduled Tasks' folder

2009-06-15 c:\windows\Tasks\FRU Task 2002-06-11 17:56ewlett-Packard2002-06-11 17:56p psc 2200 series0873DBB30DAF953F7DCEA1BDCC4F78BFDB130745237001639.job

- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2002-06-11 17:56]

2010-07-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-09 04:29]

2010-07-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-08-09 04:29]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://google.com/

mStart Page = hxxp://www.dell4me.com/myway

mSearch Bar =

uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000

LSP: c:\program files\ISS\BlackICE\IBE\ICELSP_8.0.675.0.dll

TCP: {69F81847-C4DA-49EF-8498-B8522C761206} = 192.168.1.254

DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab

FF - ProfilePath - c:\documents and settings\adminfull\Application Data\Mozilla\Firefox\Profiles\exyzoe92.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npaudio.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npavi32.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPBeatnk.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdrmv2.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npdsplay.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\NPJPI142_18.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npnul32.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nppdf32.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nppl3260.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin2.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin3.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin4.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin5.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin6.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npqtplugin7.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprfxins.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprjplug.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\nprpjplug.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npswf32.dll

FF - plugin: c:\program files\Netscape\Communicator\Program\Plugins\npwmsdrm.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-14 21:58

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]

"ImagePath"="\"\""

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1260)

c:\windows\system32\WININET.dll

c:\windows\system32\IEFRAME.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2010-07-14 22:02:28

ComboFix-quarantined-files.txt 2010-07-15 05:02

ComboFix2.txt 2010-07-13 16:09

Pre-Run: 22,485,671,936 bytes free

Post-Run: 22,495,809,536 bytes free

- - End Of File - - 18F827393ADF28907642DC27EDF301A2

------------------------------------ MBAM Log -------------------------------

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4315

Windows 5.1.2600 Service Pack 2

Internet Explorer 7.0.5730.13

7/15/2010 12:14:42 AM

mbam-log-2010-07-15 (00-14-42).txt

Scan type: Full scan (C:\|)

Objects scanned: 360162

Time elapsed: 2 hour(s), 5 minute(s), 47 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

--

[Elise]

Hello again,

ESET ONLINE SCANNER

----------------------------

I'd like us to scan your machine with ESET OnlineScan

1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
   ESET OnlineScan
   
2. Click the button.
   
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. 
      
   2. Click on to download the ESET Smart Installer. Save it to your desktop.
      
   3. Double click on the icon on your desktop.
      
      
   4. Check
      
   5. Click the button.
      
   6. Accept any security warnings from your browser.
      
   7. Check
      
   8. Push the Start button.
      
   9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
      
   10. When the scan completes, push
       
   11. Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
       Note - when ESET doesn't find any threats, no report will be created.
       
   12. Push the button.
       
   13. Push
       
       
       And indeed some instructions to update XP.
       UPDATE XP
       --------------
       Your Microsoft Windows installation is out of date. Using unpatched Windows systems on the Internet is a security risk to everyone. When there are insecure computers connected to the Internet, malware spreads faster and more extensively, distributed denial-of-service attacks are easier to launch, and spammers have more platforms from which to send e-mail. Whenever a security problem in its software is found, Microsoft will usually create a patch for it. After the patch is installed, attackers can't use the vulnerability to install malicious software on your computer. Keeping up-to-date with all these security patches will help prevent malware from reinfecting your machine. If you are not sure how to do this, see How to use Microsoft Update.
       For additional information, be sure to read "Windows Xp Service Pack 3 (sp3) Information".
       Then go here to check for & install updates to Microsoft applications.
       Note: The update process uses ActiveX, so you will need to use Internet Explorer for it, and allow the ActiveX control that it wants to install.
       Please reboot and repeat the update process until there are no more updates to install.

[astro3ron]

Eset results: Eset keeps saying that these files, ipEdit, are trojans. These files cam with the a power relay box.

ipEdit IPCam Scan Utility vs 1.2.0.6

ipEdit apps comes on CD with Remote Power Management switch

S/W made by AVIOSYS International Inc

Is there an issue I should be concerned with for them?

Anyway, here's Eset's results

C:\Ziphold\Pwr-9258\ipEdit-1.exe probably a variant of Win32/Genetik trojan cleaned by deleting - quarantined

C:\Ziphold\Pwr-9258\ipEdit.exe probably a variant of Win32/Genetik trojan cleaned by deleting - quarantined

I purged older restore files to get rid of a couple of other problems that Eset initially came across, some exe that's been there for some time (2006 and 2008), and these no longer show up on the ESET scan.

Thanks for you help and yes, I will upgrade to SP3. I'm also doing that on all the machines in the school computer lab.

Ron

[Elise]

Hi Ron,

No, these are most likely false-positive detections by ESET. If you want to be sure, you can upload them to www.virustotal.com

ALL CLEAN

--------------

Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it clean

Please do the following to remove the remaining programs from your PC:

• Delete the tools used during the disinfection:
  • Click start > run and type combofix /uninstall, press enter. This will remove Combofix from your computer.
    
  • Delete DDS, GMER (this is a random named file) and OTL.
    

Please read these advices, in order to prevent reinfecting your PC:

1. Install and update the following programs regularly:
   • an outbound firewall
     A comprehensive tutorial and a list of possible firewalls can be found here.
     
   • an AntiVirus Software
     It is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats.
     
   • an Anti-Spyware program
     Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
     SUPERAntiSpyware is another good scanner with high detection and removal rates.
     Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.
     
   • Spyware Blaster
     A tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating.
     
   • MVPs hosts file
     A tutorial for MVPs hosts file can be found here. If you would like automatic updates you might want to take a look at HostMan host file manager. For more information on thehosts file, and what it can do for you,please consult the Tutorial on the Hosts file
     

[*]Keep Windows (and your other Microsoft software) up to date!

I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.

Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!

[*]Keep your other software up to date as well

Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.

[*]Stay up to date!

The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing.

Some more links you might find of interest:

• Miekies' prevention suggestions
  
• So How did I get infected?
  
• Microsoft - 'Security at home'
  
• Calendar of Updates: See which updates have been released.
  
• How to backup your Data with Cobian Backup:because you never know, when your harddisk might fail :wink:
  
• Commonly Used Freeware Replacements: a nice list of freeware programs in all categories, that are regarded as useful by the users of this forum.
  
• osalt: Find (free) open source alternatives to known commercial software.
  

Please reply to this topic if you have read the above information. If your computer is working fine, this topic will be closed afterwards.

[astro3ron]

Thanks, Elsie. All done, working fine as far as I can tell. Again, thanks for the help. Ron

[Elise]

You are welcome Ron.

I will request this topic to be closed.