Jump to content

Internet Browser Redirect Issues


Recommended Posts

Hello,

I've been suffering from browser re-directs for several weeks. They seem to fall into two types. The first type is a redirect when I try to click on a google search result. The second type is when I am viewing a web page normally and a second IE window opens and brings up a random website. Thanks for your help.

Malwarebytes' Anti-Malware log file:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4426

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

8/13/2010 4:59:27 PM

mbam-log-2010-08-13 (16-59-27).txt

Scan type: Quick scan

Objects scanned: 144457

Time elapsed: 8 minute(s), 53 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (c:\windows\system32\userinit.exe,c:\program files\microsoft\desktoplayer.exe,) Good: (userinit.exe) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS log file:

DDS (Ver_10-03-17.01) - NTFSx86

Run by Owner at 21:34:43.67 on Fri 08/13/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.33 [GMT -5:00]

AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe

C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

svchost.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\WINDOWS\system32\dllhost.exe

C:\PROGRA~1\SYMANT~1\VPTray.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\stsystra.exe

C:\Program Files\Dell\MediaDirect\PCMService.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\ehome\ehtray.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program Files\Dell\QuickSet\quickset.exe

C:\Program Files\Creative\Mixer\CTSVolFE.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\WINDOWS\system32\WLTRAY.exe

C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\pb32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

C:\Program Files\internet explorer\iexplore.exe

C:\Program Files\internet explorer\iexplore.exe

C:\Documents and Settings\Owner\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.5.0_06\bin\ssv.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - &Google

BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll

uRun: [Google Update] "c:\documents and settings\owner\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [{1A0CDBB6-8286-65FD-D304-086D0A0579FD}] "c:\documents and settings\owner\application data\otupgi\ehga.exe"

mRun: [vptray] c:\progra~1\symant~1\VPTray.exe

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [sigmatelSysTrayApp] stsystra.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe"

mRun: [MSKDetectorExe] c:\program files\mcafee\spamkiller\MSKDetct.exe /uninstall

mRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

mRun: [iSUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup

mRun: [igfxtray] c:\windows\system32\igfxtray.exe

mRun: [igfxpers] c:\windows\system32\igfxpers.exe

mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe

mRun: [ehTray] c:\windows\ehome\ehtray.exe

mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE

mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe

mRun: [CTSVolFE.exe] "c:\program files\creative\mixer\CTSVolFE.exe" /r

mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"

mRun: [broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe

mRun: [pbuilder] c:\documents and settings\owner\application data\microsoft\internet explorer\pb32.exe

dRun: [24adf822-76f7-4481-b30b-ff1b40f8687f_46] rundll32.exe "c:\documents and settings\localservice\application data\24adf822-76f7-4481-b30b-ff1b40f8687f_46.avi", start

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\servic~1.lnk - c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe

IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBC} - c:\program files\java\jre1.5.0_06\bin\ssv.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll

Trusted Zone: live.com\onecare

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/3/9/8/398422c0-8d3e-40e1-a617-af65a72a0465/LegitCheckControl.cab

DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} - hxxps://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab

DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab

DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6087.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Notify: igfxcui - igfxdev.dll

Notify: NavLogon - c:\windows\system32\NavLogon.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

Hosts: 89.149.193.137 www.google.com

Hosts: 89.149.193.137 us.search.yahoo.com

Hosts: 89.149.193.137 uk.search.yahoo.com

Hosts: 89.149.193.137 search.yahoo.com

Hosts: 89.149.193.137 www.google.com.br

Note: multiple HOSTS entries found. Please refer to Attach.txt

============= SERVICES / DRIVERS ===============

R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2004-2-9 301200]

R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2004-12-10 255600]

R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2004-12-10 243312]

R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]

R2 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2004-2-9 37008]

R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2004-12-30 1107784]

R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20100813.009\naveng.sys [2010-8-13 85424]

R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20100813.009\navex15.sys [2010-8-13 1362608]

S0 Lbd;Lbd;c:\windows\system32\drivers\lbd.sys --> c:\windows\system32\drivers\Lbd.sys [?]

S3 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\ccPwdSvc.exe [2004-12-10 87664]

S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2004-12-30 153416]

=============== Created Last 30 ================

2010-08-14 02:22:05 0 ----a-w- c:\documents and settings\owner\defogger_reenable

2010-08-13 21:43:44 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-13 21:43:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-08-11 03:00:48 0 d--h--w- c:\windows\PIF

2010-08-08 02:59:53 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-08-06 22:24:36 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe

2010-08-05 06:14:01 42112 ----a-w- c:\windows\system32\drivers\IMAPI.SYS

2010-08-05 04:56:40 0 d-----w- c:\windows\system32\MpEngineStore

2010-08-04 02:51:09 77312 ----a-w- c:\windows\MBR.exe

2010-08-04 02:51:08 256512 ----a-w- c:\windows\PEV.exe

2010-08-04 02:51:08 161792 ----a-w- c:\windows\SWREG.exe

2010-08-04 02:51:07 98816 ----a-w- c:\windows\sed.exe

2010-07-19 19:21:39 0 d-----w- c:\program files\riva

2010-07-19 19:21:28 0 d-----w- c:\program files\Microsoft

==================== Find3M ====================

2010-08-08 00:01:07 215552 ----a-w- c:\windows\system32\dllcache\wordpad.exe

2010-08-08 00:00:44 64000 ----a-w- c:\windows\system32\dllcache\wmplayer.exe

2010-08-08 00:00:34 243712 ----a-w- c:\windows\system32\dllcache\mpvis.dll

2010-08-08 00:00:30 991232 ----a-w- c:\windows\system32\dllcache\migrate.exe

2010-08-07 23:55:39 1315328 ----a-w- c:\windows\system32\dllcache\msoe.dll

2010-07-27 06:30:35 8462336 ------w- c:\windows\system32\dllcache\shell32.dll

2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll

2010-06-30 12:31:35 149504 ------w- c:\windows\system32\dllcache\schannel.dll

2010-06-24 22:51:58 11077120 ------w- c:\windows\system32\dllcache\ieframe.dll

2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\wininet.dll

2010-06-24 12:22:03 916480 ------w- c:\windows\system32\dllcache\wininet.dll

2010-06-24 12:22:03 12800 ------w- c:\windows\system32\dllcache\xpshims.dll

2010-06-24 12:22:02 1210368 ------w- c:\windows\system32\dllcache\urlmon.dll

2010-06-24 12:22:01 611840 ----a-w- c:\windows\system32\dllcache\mstime.dll

2010-06-24 12:22:01 5951488 ------w- c:\windows\system32\dllcache\mshtml.dll

2010-06-24 12:22:01 206848 ----a-w- c:\windows\system32\dllcache\occache.dll

2010-06-24 12:21:59 599040 ----a-w- c:\windows\system32\dllcache\msfeeds.dll

2010-06-24 12:21:59 55296 ----a-w- c:\windows\system32\dllcache\msfeedsbs.dll

2010-06-24 12:21:59 25600 ------w- c:\windows\system32\dllcache\jsproxy.dll

2010-06-24 12:21:58 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll

2010-06-24 12:21:58 1986560 ------w- c:\windows\system32\dllcache\iertutil.dll

2010-06-24 12:21:58 184320 ----a-w- c:\windows\system32\dllcache\iepeers.dll

2010-06-24 12:21:56 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll

2010-06-24 12:21:55 387584 ------w- c:\windows\system32\dllcache\iedkcs32.dll

2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys

2010-06-23 13:44:04 1851904 ------w- c:\windows\system32\dllcache\win32k.sys

2010-06-23 12:08:09 173056 ------w- c:\windows\system32\dllcache\ie4uinit.exe

2010-06-21 15:27:11 354304 ----a-w- c:\windows\system32\drivers\srv.sys

2010-06-21 15:27:11 354304 ------w- c:\windows\system32\dllcache\srv.sys

2010-06-18 13:36:12 3558912 ----a-w- c:\windows\system32\dllcache\moviemk.exe

2010-06-17 14:03:00 80384 ----a-w- c:\windows\system32\iccvid.dll

2010-06-14 07:41:45 1172480 ----a-w- c:\windows\system32\msxml3.dll

2010-06-14 07:41:45 1172480 ------w- c:\windows\system32\dllcache\msxml3.dll

2010-01-20 03:22:15 32768 --sha-w- c:\windows\system32\config\systemprofile\application data\microsoft\internet explorer\userdata\index.dat

2010-03-01 01:02:47 16384 --sha-w- c:\windows\system32\config\systemprofile\ietldcache\index.dat

2008-08-16 19:42:45 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008081620080817\index.dat

============= FINISH: 21:35:37.20 ===============

Thanks again,

Michael

Attach.zip

Link to post
Share on other sites

Hello ,

And :D My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

  • The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  • Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  • The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

I see some signs of a nasty virus that easily spreads. For that reason, please keep this computer as much isolated as possible!!!

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe and follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Query_RC.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC_successful.gif

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Link to post
Share on other sites

Hello Elise, thanks for your assistance.

I have pasted the ComboFix log below. While running ComboFix, the following error window appeared after the completion of Stage_2:

PEV.cfxxe has encountered a problem and needs to close. We are sorry for the inconvenience.

If you were in the middle of something, the information you were working on might be lost.

For more information about this error, click here.

I clicked the "more information" button to get the technical details, but was not able to save the information. It would not allow me to select and copy the text, and I could not find the log file that it described ("8ff8_appcompat.txt") on my hard drive. After closing the PEV Error Window, ComboFix resumed, and appeared to complete normally.

ComboFix.txt:

ComboFix 10-08-12.03 - Owner 08/14/2010 11:12:11.4.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.120 [GMT -5:00]

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Owner\Application Data\Otupgi\ehga.exe

c:\program files\Internet Explorer\complete.dat

c:\program files\Internet Explorer\dmlconf.dat

.

((((((((((((((((((((((((( Files Created from 2010-07-14 to 2010-08-14 )))))))))))))))))))))))))))))))

.

2010-08-13 21:43 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-13 21:43 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-08-11 03:00 . 2010-08-11 03:00 -------- d--h--w- c:\windows\PIF

2010-08-08 02:59 . 2010-08-13 21:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-08-06 22:24 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe

2010-08-06 04:11 . 2010-08-06 04:12 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe

2010-08-05 06:14 . 2010-08-05 06:14 42112 ----a-w- c:\windows\system32\drivers\IMAPI.SYS

2010-08-05 04:56 . 2010-08-05 06:22 -------- d-----w- c:\windows\system32\MpEngineStore

2010-08-05 04:31 . 2010-08-05 04:31 -------- d-----w- c:\program files\Windows Live Safety Center

2010-07-31 23:45 . 2010-07-31 23:45 71416 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-07-31 23:13 . 2010-07-31 23:13 -------- d-----w- c:\documents and settings\Administrator\Application Data\IObit

2010-07-31 09:33 . 2010-07-31 20:21 -------- d-----w- c:\program files\Google

2010-07-31 07:17 . 2010-07-31 07:17 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Identities

2010-07-19 19:21 . 2010-08-06 22:38 -------- d-----w- c:\program files\riva

2010-07-19 19:21 . 2010-08-08 02:27 -------- d-----w- c:\program files\Microsoft

2010-07-17 02:40 . 2010-07-17 02:40 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE

2010-07-16 23:31 . 2010-08-08 01:12 199168 ----a-w- c:\documents and settings\Owner\Application Data\Microsoft\Internet Explorer\pb32.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-14 16:40 . 2007-03-16 03:50 -------- d-----w- c:\program files\Symantec AntiVirus

2010-08-14 01:04 . 2007-04-14 08:34 -------- d-----w- c:\documents and settings\Owner\Application Data\Otupgi

2010-08-13 21:59 . 2008-05-11 02:32 -------- d-----w- c:\documents and settings\Owner\Application Data\Uxpe

2010-08-08 01:12 . 2007-08-30 02:08 1216512 ----a-w- c:\documents and settings\Owner\Application Data\Wal-Mart\Wal-Mart Digital Photo Manager\Extensions\OrderPrints\OrderPrintsExtension.dll

2010-08-08 01:12 . 2007-08-30 02:10 1572864 ----a-w- c:\documents and settings\Owner\Application Data\Wal-Mart\Wal-Mart Digital Photo Manager\Extensions\CreateStudio\createStudioExtension.dll

2010-08-08 00:13 . 2005-08-23 23:56 90112 ----a-w- c:\documents and settings\All Users\Application Data\MCAD0.tmp\Uninst.dll

2010-08-08 00:12 . 2005-07-02 02:35 114688 ----a-w- c:\documents and settings\All Users\Application Data\MCAD0.tmp\mcuninst.dll

2010-08-08 00:12 . 2006-01-23 23:55 131072 ----a-w- c:\documents and settings\All Users\Application Data\MCAD0.tmp\McAppIns.exe

2010-08-08 00:10 . 2006-11-13 16:28 68608 ----a-w- c:\documents and settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch4\HTML\fix\DellSupportLauncher.exe

2010-08-08 00:09 . 2006-11-13 16:28 68608 ----a-w- c:\documents and settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch3\HTML\fix\DellSupportLauncher.exe

2010-08-08 00:08 . 2006-11-13 16:28 64512 ----a-w- c:\documents and settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\HTML\item_templ\coach\RunGdp.exe

2010-08-08 00:05 . 2006-11-18 18:28 64512 ----a-w- c:\documents and settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\HTML\item_templ\coach\RunGdp.exe

2010-08-08 00:04 . 2006-11-18 18:28 72704 ----a-w- c:\documents and settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\HTML\fix\DellSupportODBK.exe

2010-08-08 00:04 . 2006-11-18 18:28 68608 ----a-w- c:\documents and settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\HTML\fix\DellSupportLauncher.exe

2010-08-08 00:04 . 2006-11-25 21:10 72704 ----a-w- c:\documents and settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\CIP\DellSupportODBK.exe

2010-08-06 22:55 . 2006-11-13 16:19 -------- d-----w- c:\program files\QuickTime

2010-08-06 22:55 . 2006-11-13 16:17 -------- d-----w- c:\program files\Microsoft Plus! Photo Story 2 LE

2010-08-06 22:55 . 2006-11-13 16:16 -------- d-----w- c:\program files\Modem Helper

2010-08-06 22:55 . 2005-08-17 02:54 -------- d-----w- c:\program files\GemMaster

2010-08-06 22:55 . 2005-08-17 02:51 -------- d-----w- c:\program files\EnglishOtto

2010-08-06 22:53 . 2006-11-13 16:21 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee.com Personal Firewall

2010-08-05 13:13 . 2007-04-30 19:28 -------- d-----w- c:\documents and settings\Owner\Application Data\Ymvy

2010-08-05 04:12 . 2007-05-12 00:35 -------- d-----w- c:\documents and settings\Owner\Application Data\Gulu

2010-08-05 04:05 . 2006-11-13 16:16 -------- d-----w- c:\program files\Digital Line Detect

2010-08-05 00:24 . 2008-03-12 19:57 -------- d-----w- c:\documents and settings\Owner\Application Data\Woab

2010-08-04 14:51 . 2008-08-14 08:13 -------- d-----w- c:\documents and settings\Owner\Application Data\Ersi

2010-07-30 23:53 . 2008-11-07 14:05 -------- d-----w- c:\documents and settings\Owner\Application Data\Goez

2010-07-28 14:06 . 2009-08-24 16:02 -------- d-----w- c:\documents and settings\Owner\Application Data\Xenyum

2010-07-09 01:38 . 2010-07-09 01:38 -------- d-----w- c:\documents and settings\NetworkService\Application Data\AdobeUM

2010-06-30 12:31 . 2005-08-16 10:18 149504 ----a-w- c:\windows\system32\schannel.dll

2010-06-24 12:22 . 2005-08-16 10:18 916480 ----a-w- c:\windows\system32\wininet.dll

2010-06-23 13:44 . 2005-08-16 10:18 1851904 ----a-w- c:\windows\system32\win32k.sys

2010-06-21 15:27 . 2005-08-16 10:18 354304 ----a-w- c:\windows\system32\drivers\srv.sys

2010-06-17 14:03 . 2005-08-16 10:18 80384 ----a-w- c:\windows\system32\iccvid.dll

2010-06-14 14:31 . 2005-08-16 10:40 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe

2010-06-14 07:41 . 2005-08-16 10:18 1172480 ----a-w- c:\windows\system32\msxml3.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Google Update"="c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-28 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2004-12-30 120640]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-09 761947]

"SigmatelSysTrayApp"="stsystra.exe" [2006-03-25 282624]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-08-07 98304]

"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2010-08-07 184320]

"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 1121280]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2010-08-08 81920]

"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2010-08-08 221184]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]

"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]

"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2010-08-07 1032192]

"CTSVolFE.exe"="c:\program files\Creative\Mixer\CTSVolFE.exe" [2010-08-07 57344]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-12-10 67184]

"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]

"pbuilder"="c:\documents and settings\Owner\Application Data\Microsoft\Internet Explorer\pb32.exe" [2010-08-08 199168]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-11-13 24576]

Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-5-3 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=

"c:\\Program Files\\Common Files\\Symantec Shared\\ccEvtMgr.exe"=

"c:\\Program Files\\Common Files\\Symantec Shared\\ccSetMgr.exe"=

"c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=

"c:\\Program Files\\Symantec AntiVirus\\DefWatch.exe"=

"c:\\WINDOWS\\ehome\\ehrecvr.exe"=

"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]

S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [12/30/2004 2:19 PM 153416]

.

Contents of the 'Scheduled Tasks' folder

2010-08-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3600811620-705998895-4280596475-1006Core.job

- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-28 03:03]

2010-08-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3600811620-705998895-4280596475-1006UA.job

- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-28 03:03]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000

Trusted Zone: live.com\onecare

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-{1A0CDBB6-8286-65FD-D304-086D0A0579FD} - c:\documents and settings\Owner\Application Data\Otupgi\ehga.exe

SafeBoot-9Y7B7

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-08-14 11:44

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(884)

c:\windows\System32\BCMLogon.dll

.

Completion time: 2010-08-14 11:52:41

ComboFix-quarantined-files.txt 2010-08-14 16:52

Pre-Run: 51,042,201,600 bytes free

Post-Run: 51,204,108,288 bytes free

- - End Of File - - 03EEE6630913C35D397AA2D4BDD42B45

Link to post
Share on other sites

Please let me know how things are running now and run the following scan.

OTL

-----

Please download OTL from one of the following mirrors:

[*]Save it to your desktop.

[*]Double click on the otlDesktopIcon.png icon on your desktop.

[*]Click the "Scan All Users" checkbox.

[*]Push the runscanbutton.png button.

[*]Two reports will open, copy and paste them in a reply here:

  • OTListIt.txt <-- Will be opened
  • Extra.txt <-- Will be minimized

Link to post
Share on other sites

Elise,

I spent about 5-10 minutes doing some google searches and clicking on the search results and had no re-directs. So far so good! Here are the logs you requested:

OTL logfile:

OTL logfile created on: 8/14/2010 12:56:09 PM - Run 1

OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Owner\Desktop

Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.00 Mb Total Physical Memory | 185.00 Mb Available Physical Memory | 37.00% Memory free

1.00 Gb Paging File | 1.00 Gb Available in Paging File | 67.00% Paging File free

Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 67.83 Gb Total Space | 47.70 Gb Free Space | 70.32% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: D5YJ23C1

Current User Name: Owner

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/08/14 12:54:16 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe

PRC - [2010/08/07 21:15:19 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

PRC - [2010/08/07 18:50:56 | 009,150,464 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe

PRC - [2010/08/07 18:40:17 | 000,024,576 | ---- | M] (BVRP Software) -- C:\Program Files\Digital Line Detect\DLG.exe

PRC - [2010/08/07 18:35:00 | 001,032,192 | ---- | M] (Dell Inc) -- C:\Program Files\Dell\QuickSet\quickset.exe

PRC - [2010/08/07 18:34:45 | 000,380,928 | ---- | M] (Dell Inc.) -- C:\Program Files\Dell\QuickSet\NicConfigSvc.exe

PRC - [2010/08/07 18:33:34 | 000,184,320 | ---- | M] (CyberLink Corp.) -- C:\Program Files\Dell\MediaDirect\PCMService.exe

PRC - [2010/08/07 18:28:48 | 000,057,344 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Mixer\CTSVolFE.exe

PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2006/03/25 00:30:44 | 000,282,624 | ---- | M] (SigmaTel, Inc.) -- C:\WINDOWS\stsystra.exe

PRC - [2005/09/08 06:20:00 | 000,122,940 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\DLA\DLACTRLW.EXE

PRC - [2005/05/03 23:07:32 | 000,081,920 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe

PRC - [2004/12/30 14:19:40 | 000,120,640 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\VPTray.exe

PRC - [2004/12/30 14:19:32 | 001,107,784 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe

PRC - [2004/12/30 14:19:26 | 000,030,528 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec AntiVirus\DefWatch.exe

PRC - [2004/12/10 18:02:34 | 000,243,312 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

PRC - [2004/12/10 18:02:28 | 000,255,600 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

PRC - [2004/12/10 18:02:26 | 000,067,184 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe

========== Modules (SafeList) ==========

MOD - [2010/08/14 12:54:16 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe

MOD - [2008/04/13 19:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)

SRV - [2010/08/07 18:50:56 | 009,150,464 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe -- (MSSQL$MICROSOFTSMLBIZ)

SRV - [2010/08/07 18:34:45 | 000,380,928 | ---- | M] (Dell Inc.) [Auto | Running] -- C:\Program Files\Dell\QuickSet\NicConfigSvc.exe -- (NICCONFIGSVC)

SRV - [2005/05/03 22:42:56 | 000,323,584 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE -- (SQLAgent$MICROSOFTSMLBIZ)

SRV - [2004/12/30 14:19:36 | 000,153,416 | ---- | M] (symantec) [On_Demand | Stopped] -- C:\Program Files\Symantec AntiVirus\SavRoam.exe -- (SavRoam)

SRV - [2004/12/30 14:19:32 | 001,107,784 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec AntiVirus\Rtvscan.exe -- (Symantec AntiVirus)

SRV - [2004/12/30 14:19:26 | 000,030,528 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec AntiVirus\DefWatch.exe -- (DefWatch)

SRV - [2004/12/23 19:19:40 | 000,202,448 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe -- (SNDSrvc)

SRV - [2004/12/10 18:02:34 | 000,243,312 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe -- (ccSetMgr)

SRV - [2004/12/10 18:02:32 | 000,087,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe -- (ccPwdSvc)

SRV - [2004/12/10 18:02:28 | 000,255,600 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe -- (ccEvtMgr)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)

DRV - File not found [File_System | Boot | Stopped] -- C:\WINDOWS\System32\DRIVERS\Lbd.sys -- (Lbd)

DRV - File not found [Kernel | On_Demand | Running] -- C:\DOCUME~1\Owner\LOCALS~1\Temp\catchme.sys -- (catchme)

DRV - [2010/08/13 03:00:00 | 001,362,608 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100813.009\NAVEX15.SYS -- (NAVEX15)

DRV - [2010/08/13 03:00:00 | 000,085,424 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100813.009\NAVENG.SYS -- (NAVENG)

DRV - [2010/01/22 14:19:07 | 000,000,000 | ---- | M] () [Kernel | Unknown | Stopped] -- C:\WINDOWS\system32\drivers\??????????.sys [WARNING: C:\WINDOWS\system32\drivers\??????????.sys] -- (??????????)

DRV - [2008/04/13 13:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)

DRV - [2008/04/13 13:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)

DRV - [2008/04/13 11:36:05 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)

DRV - [2006/11/13 11:18:52 | 000,008,552 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\asctrm.sys -- (ASCTRM)

DRV - [2006/08/25 08:23:08 | 000,044,544 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)

DRV - [2006/03/25 00:34:30 | 001,156,648 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)

DRV - [2006/03/08 19:35:10 | 000,191,872 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)

DRV - [2006/01/10 13:07:58 | 000,004,864 | ---- | M] (GTek Technologies Ltd.) [Kernel | On_Demand | Stopped] -- C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys -- (DSproct)

DRV - [2005/12/01 08:40:56 | 000,936,960 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSX_DPV.sys -- (HSF_DPV)

DRV - [2005/12/01 08:40:12 | 000,192,512 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSXHWAZL.sys -- (HSXHWAZL)

DRV - [2005/12/01 08:40:08 | 000,669,696 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSX_CNXT.sys -- (winachsf)

DRV - [2005/11/02 20:24:34 | 000,424,320 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)

DRV - [2005/09/12 04:30:00 | 000,089,264 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS -- (DRVMCDB)

DRV - [2005/09/08 06:20:00 | 000,094,332 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS -- (DLAUDFAM)

DRV - [2005/09/08 06:20:00 | 000,087,036 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS -- (DLAUDF_M)

DRV - [2005/09/08 06:20:00 | 000,086,524 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS -- (DLAIFS_M)

DRV - [2005/09/08 06:20:00 | 000,025,628 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLABOIOM.SYS -- (DLABOIOM)

DRV - [2005/09/08 06:20:00 | 000,014,684 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS -- (DLAOPIOM)

DRV - [2005/09/08 06:20:00 | 000,006,364 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLAPoolM.SYS -- (DLAPoolM)

DRV - [2005/09/08 06:20:00 | 000,002,496 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\DLA\DLADResN.SYS -- (DLADResN)

DRV - [2005/08/25 13:16:52 | 000,005,628 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM)

DRV - [2005/08/25 13:16:16 | 000,022,684 | ---- | M] (Sonic Solutions) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_N.SYS -- (DLARTL_N)

DRV - [2005/08/12 18:50:46 | 000,016,128 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS -- (APPDRV)

DRV - [2005/08/12 06:20:00 | 000,040,544 | ---- | M] (Sonic Solutions) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DRVNDDM.SYS -- (DRVNDDM)

DRV - [2005/07/14 11:58:14 | 000,028,544 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)

DRV - [2005/07/14 10:28:38 | 000,307,968 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)

DRV - [2005/07/12 12:00:30 | 000,051,328 | ---- | M] (REDC) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)

DRV - [2004/12/23 19:19:18 | 000,264,240 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)

DRV - [2004/12/23 19:19:16 | 000,016,784 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)

DRV - [2004/08/03 23:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)

DRV - [2004/03/04 23:46:46 | 000,082,832 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Symantec\SYMEVENT.SYS -- (SymEvent)

DRV - [2004/02/09 15:43:56 | 000,301,200 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Symantec AntiVirus\savrt.sys -- (SAVRT)

DRV - [2004/02/09 15:43:56 | 000,037,008 | R--- | M] (Symantec Corporation) [Kernel | Auto | Running] -- C:\Program Files\Symantec AntiVirus\Savrtpel.sys -- (SAVRTPEL)

DRV - [2001/08/17 15:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)

DRV - [2001/08/17 15:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)

DRV - [2001/08/17 15:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)

DRV - [2001/08/17 15:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)

DRV - [2001/08/17 15:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)

DRV - [2001/08/17 14:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)

DRV - [2001/08/17 14:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)

DRV - [2001/08/17 14:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)

DRV - [2001/08/17 14:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)

DRV - [2001/08/17 14:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)

DRV - [2001/08/17 14:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)

DRV - [2001/08/17 14:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)

DRV - [2001/08/17 14:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)

DRV - [2001/08/17 14:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)

DRV - [2001/08/17 14:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=3061113

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=3061113

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=3061113

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=3061113

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3600811620-705998895-4280596475-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/

IE - HKU\S-1-5-21-3600811620-705998895-4280596475-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2010/08/14 11:44:05 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)

O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (&Google) - {AA58ED58-01DD-4D91-8333-CF10577473F7} - Reg Error: Value error. File not found

O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)

O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)

O4 - HKLM..\Run: [CTSVolFE.exe] C:\Program Files\Creative\Mixer\CTSVolFE.exe (Creative Technology Ltd)

O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe (Dell Inc)

O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)

O4 - HKLM..\Run: [iSUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)

O4 - HKLM..\Run: [iSUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)

O4 - HKLM..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe (McAfee, Inc.)

O4 - HKLM..\Run: [pbuilder] C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\pb32.exe ()

O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.)

O4 - HKLM..\Run: [sigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)

O4 - HKLM..\Run: [vptray] C:\Program Files\Symantec AntiVirus\VPTray.exe (Symantec Corporation)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe (BVRP Software)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe (Microsoft Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-3600811620-705998895-4280596475-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-3600811620-705998895-4280596475-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-21-3600811620-705998895-4280596475-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0

O7 - HKU\S-1-5-21-3600811620-705998895-4280596475-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-3600811620-705998895-4280596475-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\NPJPI150_06.dll (Sun Microsystems, Inc.)

O15 - HKU\S-1-5-21-3600811620-705998895-4280596475-1006\..Trusted Domains: live.com ([onecare] http in Trusted sites)

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa...director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/3/9...heckControl.cab (Windows Genuine Advantage Validation Tool)

O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} https://www-secure.symantec.com/techsupp/as...abs/tgctlsr.cab (Symantec Script Runner Class)

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/m...01/mcinsctl.cab (Reg Error: Value error.)

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} http://cdn.scan.onecare.live.com/resource/...lscbase6087.cab (Windows Live Safety Center Base Module)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_06)

O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_06)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_06)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa...ash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Value error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)

O20 - Winlogon\Notify\NavLogon: DllName - C:\WINDOWS\system32\NavLogon.dll - C:\WINDOWS\system32\NavLogon.dll (Symantec Corporation)

O24 - Desktop WallPaper: C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2005/08/16 05:43:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKU\.DEFAULT\...exe [@ = secfile] -- "C:\WINDOWS\TEMP\AUTMGR32.EXE" /START "%1" %* File not found

O37 - HKU\S-1-5-18\...exe [@ = secfile] -- "C:\WINDOWS\TEMP\AUTMGR32.EXE" /START "%1" %* File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/08/14 12:53:58 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe

[2010/08/14 12:00:53 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2010/08/14 11:08:07 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010/08/13 16:43:44 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/08/13 16:43:42 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/08/13 16:42:32 | 006,153,352 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup-1.46.exe

[2010/08/10 22:00:48 | 000,000,000 | -H-D | C] -- C:\WINDOWS\PIF

[2010/08/07 21:59:53 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010/08/06 17:24:36 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\helpsvc.exe

[2010/08/04 23:56:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\MpEngineStore

[2010/08/04 23:31:08 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live Safety Center

[2010/08/03 21:51:09 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2010/08/03 21:51:08 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2010/08/03 21:51:07 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2010/08/03 21:51:06 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2010/07/31 04:33:30 | 000,000,000 | ---D | C] -- C:\Program Files\Google

[2010/07/31 02:17:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Identities

[2010/07/31 02:17:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Identities

[2010/07/19 14:21:39 | 000,000,000 | ---D | C] -- C:\Program Files\riva

[2010/07/19 14:21:28 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/08/14 12:54:16 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe

[2010/08/14 12:54:01 | 000,000,978 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3600811620-705998895-4280596475-1006UA.job

[2010/08/14 11:52:43 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010/08/14 11:44:26 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini

[2010/08/14 11:44:05 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2010/08/14 11:05:02 | 003,816,958 | R--- | M] () -- C:\Documents and Settings\Owner\Desktop\ComboFix.exe

[2010/08/14 10:57:17 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/08/14 10:56:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/08/14 01:33:00 | 006,029,312 | -H-- | M] () -- C:\Documents and Settings\Owner\NTUSER.DAT

[2010/08/14 01:32:36 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Owner\ntuser.ini

[2010/08/14 01:31:56 | 004,299,712 | -H-- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\IconCache.db

[2010/08/14 00:57:08 | 000,004,535 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Attach.zip

[2010/08/13 21:42:34 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\xpt338bk.exe

[2010/08/13 21:34:11 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\dds.com

[2010/08/13 21:22:05 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Owner\defogger_reenable

[2010/08/13 21:13:18 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Defogger.exe

[2010/08/13 18:54:05 | 000,000,926 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3600811620-705998895-4280596475-1006Core.job

[2010/08/13 16:43:47 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/08/13 16:42:32 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup-1.46.exe

[2010/08/13 16:33:35 | 000,274,968 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010/08/13 16:14:53 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2010/08/13 16:13:18 | 000,531,112 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010/08/13 16:13:18 | 000,461,286 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010/08/13 16:13:18 | 000,080,308 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010/08/13 16:02:08 | 000,002,284 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Google Chrome.lnk

[2010/08/13 16:02:08 | 000,002,262 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

[2010/08/07 20:14:33 | 000,369,664 | ---- | M] () -- C:\Documents and Settings\Owner\My Documents\SHEEP.EXE

[2010/08/07 19:00:44 | 000,064,000 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wmplayer.exe

[2010/08/07 19:00:34 | 000,243,712 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mpvis.dll

[2010/08/07 19:00:30 | 000,991,232 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\migrate.exe

[2010/08/04 23:12:06 | 000,000,036 | ---- | M] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\housecall.guid.cache

[2010/07/27 01:30:35 | 008,462,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\shell32.dll

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\Documents and Settings\All Users\Application Data\*.tmp files -> C:\Documents and Settings\All Users\Application Data\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/14 11:05:02 | 003,816,958 | R--- | C] () -- C:\Documents and Settings\Owner\Desktop\ComboFix.exe

[2010/08/14 00:57:08 | 000,004,535 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Attach.zip

[2010/08/13 21:42:27 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\xpt338bk.exe

[2010/08/13 21:34:06 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\dds.com

[2010/08/13 21:22:05 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Owner\defogger_reenable

[2010/08/13 21:13:03 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Defogger.exe

[2010/08/13 16:43:47 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/08/04 23:12:06 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Owner\Local Settings\Application Data\housecall.guid.cache

[2010/08/03 21:51:09 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010/08/03 21:51:08 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010/08/03 21:51:08 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010/08/03 21:51:07 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010/08/03 21:51:07 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2007/03/15 22:58:40 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI

[2006/12/07 18:56:54 | 000,014,754 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini

[2006/12/07 18:56:40 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS

[2006/11/18 13:45:35 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini

[2006/11/13 11:38:02 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2006/11/13 11:27:32 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2006/11/13 11:22:40 | 000,000,261 | ---- | C] () -- C:\WINDOWS\wininit.ini

[2006/11/13 10:49:04 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll

[2006/11/13 10:48:48 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll

[2006/11/13 10:48:44 | 000,757,760 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll

[2006/11/13 10:48:30 | 000,000,392 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI

[2005/11/10 09:56:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini

[2005/08/16 05:37:24 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini

[2005/08/05 15:01:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2003/01/07 16:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== Files - Unicode (All) ==========

[2010/01/22 14:19:07 | 000,000,000 | ---- | M] ()(C:\WINDOWS\System32\drivers\??????????.sys) -- C:\WINDOWS\System32\drivers\??????????.sys

[2010/01/22 14:19:07 | 000,000,000 | ---- | C] ()(C:\WINDOWS\System32\drivers\??????????.sys) -- C:\WINDOWS\System32\drivers\??????????.sys

< End of report >

Extras.txt:

OTL Extras logfile created on: 8/14/2010 12:56:09 PM - Run 1

OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Owner\Desktop

Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

502.00 Mb Total Physical Memory | 185.00 Mb Available Physical Memory | 37.00% Memory free

1.00 Gb Paging File | 1.00 Gb Available in Paging File | 67.00% Paging File free

Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 67.83 Gb Total Space | 47.70 Gb Free Space | 70.32% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: D5YJ23C1

Current User Name: Owner

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

[HKEY_USERS\.DEFAULT\SOFTWARE\Classes\<extension>]

.exe [@ = secfile] -- C:\WINDOWS\TEMP\AUTMGR32.EXE File not found

[HKEY_USERS\S-1-5-18\SOFTWARE\Classes\<extension>]

.exe [@ = secfile] -- C:\WINDOWS\TEMP\AUTMGR32.EXE File not found

[HKEY_USERS\S-1-5-21-3600811620-705998895-4280596475-1006\SOFTWARE\Classes\<extension>]

.html [@ = htmlfile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"FirewallDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

"UpdatesDisableNotify" = 0

"AntiVirusDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008

"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- File not found

"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- File not found

"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL -- File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" = C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe:*:Enabled:Google Chrome -- (Google Inc.)

"C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe" = C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe:*:Disabled:ccEvtMgr -- (Symantec Corporation)

"C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe" = C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe:*:Disabled:ccSetMgr -- (Symantec Corporation)

"C:\Program Files\Dell\MediaDirect\PCMService.exe" = C:\Program Files\Dell\MediaDirect\PCMService.exe:*:Disabled:CyberLink PowerCinema Resident Program -- (CyberLink Corp.)

"C:\Program Files\Symantec AntiVirus\DefWatch.exe" = C:\Program Files\Symantec AntiVirus\DefWatch.exe:*:Disabled:DefWatch -- (Symantec Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{075473F5-846A-448B-BCB3-104AA1760205}" = Roxio RecordNow Data

"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE

"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Roxio DLA

"{26E1BFB0-E87E-4696-9F89-B467F01F81E5}" = Broadcom Management Programs

"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager

"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6

"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3846E811-639D-4DE1-844B-30491C0A6C0C}" = Dell Support 3.2

"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = URL Assistant

"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting

"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool

"{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}" = AOLIcon

"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works

"{6D5FCA42-1486-4E32-AFE8-1B7E2AA59D33}" = Digital Content Portal

"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer

"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore

"{7A3F0566-5E05-4919-9C98-456F6B5CF831}" = Get High Speed Internet!

"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper

"{848AC794-8B81-440A-81AE-6474337DB527}" = Symantec AntiVirus

"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver

"{91CA0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003

"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)

"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders

"{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup

"{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A683A2C0-821C-486F-858C-FA634DB5E864}" = EducateU

"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Roxio RecordNow Audio

"{AEF8A6C5-2355-4295-ABAD-DD86BCF0FB95}" = Hoyle Casino 2007

"{B0DF58A2-40DF-4465-AA56-38623EC9938C}" = Documentation & Support Launcher

"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Roxio RecordNow Copy

"{B2AE44CB-2AAB-4C08-A54B-D264BD604DA8}" = Citrix Presentation Server Client

"{B6884A07-0305-47AE-9969-8F26FADC17DE}" = Games, Music, & Photos Launcher

"{BA68600E-96D9-4E92-80F2-26B9681B5A63}" = Microsoft Office Outlook 2003 with Business Contact Manager Update

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{C1771DDC-BEA1-4375-B2A2-B46F43ACB476}" = Wal-Mart Digital Photo Manager

"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D2988E9B-C73F-422C-AD4B-A66EBE257120}" = MCU

"{E09B48B5-E141-427A-AB0C-D3605127224A}" = Microsoft SQL Server Desktop Engine (MICROSOFTSMLBIZ)

"{E42BD75A-FC23-4E3F-9F91-2658334C644F}" = Internet Service Offers Launcher

"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect

"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)

"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01

"12133444-BF36-4d4e-B7FB-A3424C645DE4" = GemMaster Mystic

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 11.5

"B3EE3001-DC24-4cd1-8743-5692C716659F" = Otto

"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card

"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3" = Conexant HDA D110 MDC V.92 Modem

"CTMBDemo_Audigy" = Sound Blaster Audigy ADVANCED MB Demo

"EmeraldQFE2" = Windows Media Player 10 Hotfix [see EmeraldQFE2 for more information]

"ESPNMotion" = ESPNMotion

"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs

"ie7" = Windows Internet Explorer 7

"ie8" = Windows Internet Explorer 8

"LiveUpdate" = LiveUpdate 2.0 (Symantec Corporation)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"MIXERLITE" = Mixer

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs

"QuickTime" = QuickTime

"RealPlayer 6.0" = RealPlayer Basic

"SearchAssist" = SearchAssist

"StreetPlugin" = Learn2 Player (Uninstall Only)

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"UnityWebPlayer" = Unity Web Player

"ViewpointMediaPlayer" = Viewpoint Media Player

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"Windows XP Service Pack" = Windows XP Service Pack 3

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-3600811620-705998895-4280596475-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 8/6/2010 10:11:21 PM | Computer Name = D5YJ23C1 | Source = Symantec AntiVirus | ID = 16711685

Description = Threat Found!Threat: W32.Ramnit!html in File: C:\Documents and Settings\All

Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch4\HTML\offline\privacy_policy.htm

by: Auto-Protect scan. Action: Clean succeeded : Access allowed. Action Description:

The file was repaired successfully.

Error - 8/6/2010 10:29:31 PM | Computer Name = D5YJ23C1 | Source = Symantec AntiVirus | ID = 16711685

Description = Threat Found!Threat: W32.Ramnit!html in File: C:\Documents and Settings\NetworkService\Local

Settings\Temporary Internet Files\Content.IE5\XRAVA4X8\jump2[2].htm by: Auto-Protect

scan. Action: Clean succeeded : Access allowed. Action Description: The file

was repaired successfully.

Error - 8/13/2010 4:49:55 PM | Computer Name = D5YJ23C1 | Source = Symantec AntiVirus | ID = 16711685

Description = Threat Found!Threat: W32.Ramnit in File: C:\Program Files\Microsoft

SQL Server\80\Tools\Binn\sqlmangrSrv.exe by: Auto-Protect scan. Action: Quarantine

succeeded : Access denied. Action Description: The file was quarantined successfully.

Error - 8/13/2010 5:34:48 PM | Computer Name = D5YJ23C1 | Source = Symantec AntiVirus | ID = 16711685

Description = Threat Found!Threat: W32.Ramnit in File: C:\Program Files\Microsoft

SQL Server\80\Tools\Binn\sqlmangrSrv.exe by: Auto-Protect scan. Action: Quarantine

succeeded : Access denied. Action Description: The file was quarantined successfully.

Error - 8/13/2010 6:02:38 PM | Computer Name = D5YJ23C1 | Source = Symantec AntiVirus | ID = 16711685

Description = Threat Found!Threat: W32.Ramnit in File: C:\Program Files\Microsoft

SQL Server\80\Tools\Binn\sqlmangrSrv.exe by: Auto-Protect scan. Action: Quarantine

succeeded : Access denied. Action Description: The file was quarantined successfully.

Error - 8/13/2010 9:05:27 PM | Computer Name = D5YJ23C1 | Source = Symantec AntiVirus | ID = 16711685

Description = Threat Found!Threat: W32.Ramnit!inf in File: C:\d682e65b7fe7a639477c55e1929436\i386\filterpipelineprintproc.dll

by: Manual scan. Action: Clean failed : Quarantine failed. Action Description:

The file was left unchanged. Threat Found!Threat: W32.Ramnit!inf in File: C:\d682e65b7fe7a639477c55e1929436\i386\mxdwdrv.dll

by: Manual scan. Action: Clean failed : Quarantine failed. Action Description:

The file was left unchanged. Threat Found!Threat: W32.Ramnit!inf in File: C:\d682e65b7fe7a639477c55e1929436\i386\xpssvcs.dll

by: Manual scan. Action: Clean failed : Quarantine failed. Action Description:

The file was left unchanged. Threat Found!Threat: Trojan.Gen in File: C:\Documents

and Settings\Owner\Application Data\Otupgi\ehga.exe by: Manual scan. Action: Quarantine

succeeded. Action Description: The file was quarantined successfully.

Error - 8/13/2010 9:37:57 PM | Computer Name = D5YJ23C1 | Source = Symantec AntiVirus | ID = 16711685

Description = Threat Found!Threat: Trojan.Gen in File: C:\Documents and Settings\Owner\Local

Settings\temp\tmp7c30f87e.exe by: Manual scan. Action: Quarantine succeeded.

Action Description: The file was quarantined successfully. Threat Found!Threat: W32.Ramnit!inf

in File: C:\Program Files\Microsoft SQL Server\80\Tools\Binn\w95scm.DLL by: Manual

scan. Action: Clean failed : Quarantine failed. Action Description: The file

was left unchanged.

Error - 8/13/2010 10:26:43 PM | Computer Name = D5YJ23C1 | Source = Symantec AntiVirus | ID = 16711685

Description = Threat Found!Threat: W32.Ramnit in File: C:\Program Files\Microsoft

SQL Server\80\Tools\Binn\sqlmangrSrv.exe by: Auto-Protect scan. Action: Quarantine

succeeded : Access denied. Action Description: The file was quarantined successfully.

Error - 8/14/2010 11:57:41 AM | Computer Name = D5YJ23C1 | Source = Symantec AntiVirus | ID = 16711685

Description = Threat Found!Threat: W32.Ramnit in File: C:\Program Files\Microsoft

SQL Server\80\Tools\Binn\sqlmangrSrv.exe by: Auto-Protect scan. Action: Quarantine

succeeded : Access denied. Action Description: The file was quarantined successfully.

Error - 8/14/2010 12:12:33 PM | Computer Name = D5YJ23C1 | Source = Application Error | ID = 1000

Description = Faulting application pev.cfxxe, version 0.0.0.0, faulting module pev.cfxxe,

version 0.0.0.0, fault address 0x00082899.

[ System Events ]

Error - 8/7/2010 10:54:11 PM | Computer Name = D5YJ23C1 | Source = Service Control Manager | ID = 7026

Description = The following boot-start or system-start driver(s) failed to load:

Lbd

Error - 8/7/2010 11:17:57 PM | Computer Name = D5YJ23C1 | Source = Service Control Manager | ID = 7026

Description = The following boot-start or system-start driver(s) failed to load:

Lbd

Error - 8/8/2010 12:37:50 PM | Computer Name = D5YJ23C1 | Source = Dhcp | ID = 1000

Description = Your computer has lost the lease to its IP address 192.168.0.100 on

the Network Card with network address 0016CFA058B2.

Error - 8/10/2010 10:47:58 PM | Computer Name = D5YJ23C1 | Source = Dhcp | ID = 1000

Description = Your computer has lost the lease to its IP address 192.168.0.100 on

the Network Card with network address 0016CFA058B2.

Error - 8/13/2010 4:49:08 PM | Computer Name = D5YJ23C1 | Source = Service Control Manager | ID = 7026

Description = The following boot-start or system-start driver(s) failed to load:

Lbd

Error - 8/13/2010 5:34:29 PM | Computer Name = D5YJ23C1 | Source = Service Control Manager | ID = 7026

Description = The following boot-start or system-start driver(s) failed to load:

Lbd

Error - 8/13/2010 6:02:19 PM | Computer Name = D5YJ23C1 | Source = Service Control Manager | ID = 7026

Description = The following boot-start or system-start driver(s) failed to load:

Lbd

Error - 8/13/2010 10:25:48 PM | Computer Name = D5YJ23C1 | Source = Service Control Manager | ID = 7026

Description = The following boot-start or system-start driver(s) failed to load:

Lbd

Error - 8/14/2010 11:56:37 AM | Computer Name = D5YJ23C1 | Source = Service Control Manager | ID = 7026

Description = The following boot-start or system-start driver(s) failed to load:

Lbd

Error - 8/14/2010 12:11:54 PM | Computer Name = D5YJ23C1 | Source = Service Control Manager | ID = 7034

Description = The Dell Wireless WLAN Tray Service service terminated unexpectedly.

It has done this 1 time(s).

< End of report >

Link to post
Share on other sites

That is looking quite good indeed. :D

A few leftovers to clean up here.

OTL FIX

------------

We need to run an OTL Fix

  1. Please reopen otlDesktopIcon.png on your desktop.
  2. Copy and Paste the following code into the customFix.png textbox. Do not include the word "Code"
    :otl
    O4 - HKLM..\Run: [pbuilder] C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\pb32.exe ()
    O37 - HKU\.DEFAULT\...exe [@ = secfile] -- "C:\WINDOWS\TEMP\AUTMGR32.EXE" /START "%1" %* File not found
    O37 - HKU\S-1-5-18\...exe [@ = secfile] -- "C:\WINDOWS\TEMP\AUTMGR32.EXE" /START "%1" %* File not found

    :commands
    [emptytemp]


  3. Push runFixbutton.png
  4. OTL may ask to reboot the machine. Please do so if asked.
  5. Click btnOK.png.
  6. A report will open. Copy and Paste that report in your next reply.

UPDATE JAVA

------------------

Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "JDK 6 Update 21 (JDK or JRE)".
  • Click the "Download JRE" button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u21-windows-i586.exe to install the newest version.
  • If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  • When the Java Setup - Welcome window opens, click the Install > button.
  • If offered to install a Toolbar, just uncheck the box before continuing unless you want it.

-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.

-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.

Finally, launch MBAM, update it and tun a full scan. Post me the resulting log.

Link to post
Share on other sites

Here are the requested logs:

OTL Report:

All processes killed

========== OTL ==========

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\pbuilder deleted successfully.

File move failed. C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\pb32.exe scheduled to be moved on reboot.

Registry key HKEY_USERS\.DEFAULT\Software\Classes\.exe\ deleted successfully.

Registry key HKEY_USERS\.DEFAULT\Software\Classes\secfile\ deleted successfully.

HKEY_LOCAL_MACHINE\Software\Classes\.exe\\|exefile /E : value set successfully!

Registry key HKEY_USERS\S-1-5-18\Software\Classes\.exe\ not found.

Registry key HKEY_USERS\S-1-5-18\Software\Classes\secfile\ not found.

HKEY_LOCAL_MACHINE\Software\Classes\.exe\\|exefile /E : value set successfully!

========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: LocalService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 472207 bytes

->Flash cache emptied: 6707 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

->Java cache emptied: 589 bytes

->Flash cache emptied: 25441 bytes

User: Owner

->Temp folder emptied: 99840 bytes

->Temporary Internet Files folder emptied: 2185341 bytes

->Java cache emptied: 26523317 bytes

->Google Chrome cache emptied: 0 bytes

->Flash cache emptied: 843 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 19569 bytes

%systemroot%\System32 .tmp files removed: 2577 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 255 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 28.00 mb

OTL by OldTimer - Version 3.2.9.1 log created on 08142010_162958

Files\Folders moved on Reboot...

File\Folder C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\pb32.exe not found!

File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF18C3.tmp not found!

File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF18CE.tmp not found!

File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF19A8.tmp not found!

File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF19B3.tmp not found!

File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF1B2F.tmp not found!

File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF1BE2.tmp not found!

File\Folder C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\NY30THIN\index[1].htm not found!

File\Folder C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\NY30THIN\index[2].htm not found!

File\Folder C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\9EUGZ33T\iframe[1].htm not found!

Registry entries deleted on Reboot...

MBAM Report:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4431

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

8/14/2010 9:52:23 PM

mbam-log-2010-08-14 (21-52-23).txt

Scan type: Full scan (C:\|)

Objects scanned: 182002

Time elapsed: 38 minute(s), 56 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Link to post
Share on other sites

Hello again,

Do you have any problems left at this point?

Lets do one last scan to check for leftovers.

ESET ONLINE SCANNER

----------------------------

I'd like us to scan your machine with ESET OnlineScan

  1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  2. Click the esetOnline.png button.
  3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

    1. Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
    2. Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.

    3. Check esetAcceptTerms.png
    4. Click the esetStart.png button.
    5. Accept any security warnings from your browser.
    6. Check esetScanArchives.png
    7. Push the Start button.
    8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    9. When the scan completes, push esetListThreats.png
    10. Push esetExport.png, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
      Note - when ESET doesn't find any threats, no report will be created.
    11. Push the esetBack.png button.
    12. Push esetFinish.png

Link to post
Share on other sites

Elise,

At this point I am seeing no problems while browsing or otherwise. However, it looks like ESET found a few things. Also, whenever I reboot my machine I get the following message from Symantec AntiVirus Notification:

Scan type: Auto-Protect Scan

Event: Threat Found!

Threat: W32.Ramnit

File: C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangrSrv.exe

Location: Quarantine

Computer: D5YJ23C1

User: Owner

Action taken: Quarantine succeeded : Access denied

Date found: Sunday, August 15, 2010 9:18:07 AM

It looks like it is the same type of threat that ESET found. Each time I reboot I get the exact same notification, always the same file and path.

ESET results:

C:\d682e65b7fe7a639477c55e1929436\i386\filterpipelineprintproc.dll Win32/Ramnit.A virus error while cleaning

C:\d682e65b7fe7a639477c55e1929436\i386\mxdwdrv.dll Win32/Ramnit.A virus error while cleaning

C:\d682e65b7fe7a639477c55e1929436\i386\xpssvcs.dll Win32/Ramnit.A virus error while cleaning

C:\Program Files\Microsoft SQL Server\80\Tools\Binn\w95scm.DLL Win32/Ramnit.A virus error while cleaning

C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP1\A0000085.exe a variant of Win32/Kryptik.FQK trojan cleaned by deleting - quarantined

Operating memory Win32/Ramnit.A virus

Thanks again,

Michael

Link to post
Share on other sites

It looks like both scans found the same four items, but neither program was able to clean or quarantine them.

New ESET Results:

C:\d682e65b7fe7a639477c55e1929436\i386\filterpipelineprintproc.dll Win32/Ramnit.A virus error while cleaning

C:\d682e65b7fe7a639477c55e1929436\i386\mxdwdrv.dll Win32/Ramnit.A virus error while cleaning

C:\d682e65b7fe7a639477c55e1929436\i386\xpssvcs.dll Win32/Ramnit.A virus error while cleaning

C:\Program Files\Microsoft SQL Server\80\Tools\Binn\w95scm.DLL Win32/Ramnit.A virus error while cleaning

Operating memory Win32/Ramnit.A virus

Symantec AV Results:

Date,Filename,Threat,Threat Type,Action Taken,Computer,User,Original Location,Status,Current Location,Primary Action,Secondary Action,Scan Type,Action Description

8/16/2010 12:40:30 AM,w95scm.DLL,W32.Ramnit!inf,File,Left alone,D5YJ23C1,Owner,C:\Program Files\Microsoft SQL Server\80\Tools\Binn\,Infected,C:\Program Files\Microsoft SQL Server\80\Tools\Binn\,Clean virus from file,Quarantine infected file,Manual scan,The file was left unchanged.

8/15/2010 11:30:19 PM,xpssvcs.dll,W32.Ramnit!inf,File,Left alone,D5YJ23C1,Owner,C:\d682e65b7fe7a639477c55e1929436\i386\,Infected,C:\d682e65b7fe7a639477c55e1929436\i386\,Clean virus from file,Quarantine infected file,Manual scan,The file was left unchanged.

8/15/2010 11:30:16 PM,mxdwdrv.dll,W32.Ramnit!inf,File,Left alone,D5YJ23C1,Owner,C:\d682e65b7fe7a639477c55e1929436\i386\,Infected,C:\d682e65b7fe7a639477c55e1929436\i386\,Clean virus from file,Quarantine infected file,Manual scan,The file was left unchanged.

8/15/2010 11:30:13 PM,filterpipelineprintproc.dll,W32.Ramnit!inf,File,Left alone,D5YJ23C1,Owner,C:\d682e65b7fe7a639477c55e1929436\i386\,Infected,C:\d682e65b7fe7a639477c55e1929436\i386\,Clean virus from file,Quarantine infected file,Manual scan,The file was left unchanged.

Thanks,

Michael

Link to post
Share on other sites

Hi, thats not the first time I see files from that folder associated with this infection. Lets see if we can script them away. If that won't work, we will need to do it from outside Windows.

CF-SCRIPT

-------------

We need to execute a CF-script.

  • Close any open browsers.
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:

File::
C:\d682e65b7fe7a639477c55e1929436\i386\filterpipelineprintproc.dll
C:\d682e65b7fe7a639477c55e1929436\i386\mxdwdrv.dll
C:\d682e65b7fe7a639477c55e1929436\i386\xpssvcs.dll
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\w95scm.DLL

Save this as CFScript.txt, in the same location as ComboFix.exe

CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Link to post
Share on other sites

ComboFix.txt:

ComboFix 10-08-12.03 - Owner 08/16/2010 9:14.5.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.197 [GMT -5:00]

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt

AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FILE ::

"c:\d682e65b7fe7a639477c55e1929436\i386\filterpipelineprintproc.dll"

"c:\d682e65b7fe7a639477c55e1929436\i386\mxdwdrv.dll"

"c:\d682e65b7fe7a639477c55e1929436\i386\xpssvcs.dll"

"c:\program files\Microsoft SQL Server\80\Tools\Binn\w95scm.DLL"

.

((((((((((((((((((((((((( Files Created from 2010-07-16 to 2010-08-16 )))))))))))))))))))))))))))))))

.

2010-08-15 14:41 . 2010-08-15 14:41 -------- d-----w- c:\program files\ESET

2010-08-15 01:33 . 2010-08-15 01:33 -------- d-----w- c:\program files\Common Files\Java

2010-08-15 01:32 . 2010-08-15 01:32 503808 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-45c3b175-n\msvcp71.dll

2010-08-15 01:32 . 2010-08-15 01:32 499712 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-45c3b175-n\jmc.dll

2010-08-15 01:32 . 2010-08-15 01:32 348160 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-45c3b175-n\msvcr71.dll

2010-08-15 01:32 . 2010-08-15 01:32 61440 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-1093eea2-n\decora-sse.dll

2010-08-15 01:32 . 2010-08-15 01:32 12800 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-1093eea2-n\decora-d3d.dll

2010-08-15 01:31 . 2010-08-15 01:30 423656 ----a-w- c:\windows\system32\deployJava1.dll

2010-08-15 01:30 . 2010-08-15 01:30 -------- d-----w- c:\program files\Java

2010-08-15 01:29 . 2010-08-15 01:29 79488 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_21\gtapi.dll

2010-08-15 01:29 . 2010-08-15 01:29 152576 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_21\lzma.dll

2010-08-14 21:29 . 2010-08-14 21:29 -------- d-----w- C:\_OTL

2010-08-13 21:43 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-13 21:43 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-08-11 03:00 . 2010-08-11 03:00 -------- d--h--w- c:\windows\PIF

2010-08-08 02:59 . 2010-08-13 21:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-08-06 22:24 . 2010-06-14 14:31 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe

2010-08-06 04:11 . 2010-08-06 04:12 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe

2010-08-05 06:14 . 2010-08-05 06:14 42112 ----a-w- c:\windows\system32\drivers\IMAPI.SYS

2010-08-05 04:56 . 2010-08-05 06:22 -------- d-----w- c:\windows\system32\MpEngineStore

2010-08-05 04:31 . 2010-08-05 04:31 -------- d-----w- c:\program files\Windows Live Safety Center

2010-07-31 23:45 . 2010-07-31 23:45 71416 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-07-31 23:13 . 2010-07-31 23:13 -------- d-----w- c:\documents and settings\Administrator\Application Data\IObit

2010-07-31 09:33 . 2010-07-31 20:21 -------- d-----w- c:\program files\Google

2010-07-31 07:17 . 2010-07-31 07:17 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Identities

2010-07-19 19:21 . 2010-08-06 22:38 -------- d-----w- c:\program files\riva

2010-07-19 19:21 . 2010-08-08 02:27 -------- d-----w- c:\program files\Microsoft

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-16 14:18 . 2007-03-16 03:50 -------- d-----w- c:\program files\Symantec AntiVirus

2010-08-14 01:04 . 2007-04-14 08:34 -------- d-----w- c:\documents and settings\Owner\Application Data\Otupgi

2010-08-13 21:59 . 2008-05-11 02:32 -------- d-----w- c:\documents and settings\Owner\Application Data\Uxpe

2010-08-08 01:12 . 2007-08-30 02:08 1216512 ----a-w- c:\documents and settings\Owner\Application Data\Wal-Mart\Wal-Mart Digital Photo Manager\Extensions\OrderPrints\OrderPrintsExtension.dll

2010-08-08 01:12 . 2007-08-30 02:10 1572864 ----a-w- c:\documents and settings\Owner\Application Data\Wal-Mart\Wal-Mart Digital Photo Manager\Extensions\CreateStudio\createStudioExtension.dll

2010-08-08 00:13 . 2005-08-23 23:56 90112 ----a-w- c:\documents and settings\All Users\Application Data\MCAD0.tmp\Uninst.dll

2010-08-08 00:12 . 2005-07-02 02:35 114688 ----a-w- c:\documents and settings\All Users\Application Data\MCAD0.tmp\mcuninst.dll

2010-08-08 00:12 . 2006-01-23 23:55 131072 ----a-w- c:\documents and settings\All Users\Application Data\MCAD0.tmp\McAppIns.exe

2010-08-08 00:10 . 2006-11-13 16:28 68608 ----a-w- c:\documents and settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch4\HTML\fix\DellSupportLauncher.exe

2010-08-08 00:09 . 2006-11-13 16:28 68608 ----a-w- c:\documents and settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch3\HTML\fix\DellSupportLauncher.exe

2010-08-08 00:08 . 2006-11-13 16:28 64512 ----a-w- c:\documents and settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch2\HTML\item_templ\coach\RunGdp.exe

2010-08-08 00:05 . 2006-11-18 18:28 64512 ----a-w- c:\documents and settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\HTML\item_templ\coach\RunGdp.exe

2010-08-08 00:04 . 2006-11-18 18:28 72704 ----a-w- c:\documents and settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\HTML\fix\DellSupportODBK.exe

2010-08-08 00:04 . 2006-11-18 18:28 68608 ----a-w- c:\documents and settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\HTML\fix\DellSupportLauncher.exe

2010-08-08 00:04 . 2006-11-25 21:10 72704 ----a-w- c:\documents and settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\CIP\DellSupportODBK.exe

2010-08-06 22:55 . 2006-11-13 16:19 -------- d-----w- c:\program files\QuickTime

2010-08-06 22:55 . 2006-11-13 16:17 -------- d-----w- c:\program files\Microsoft Plus! Photo Story 2 LE

2010-08-06 22:55 . 2006-11-13 16:16 -------- d-----w- c:\program files\Modem Helper

2010-08-06 22:55 . 2005-08-17 02:54 -------- d-----w- c:\program files\GemMaster

2010-08-06 22:55 . 2005-08-17 02:51 -------- d-----w- c:\program files\EnglishOtto

2010-08-06 22:53 . 2006-11-13 16:21 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee.com Personal Firewall

2010-08-05 13:13 . 2007-04-30 19:28 -------- d-----w- c:\documents and settings\Owner\Application Data\Ymvy

2010-08-05 04:12 . 2007-05-12 00:35 -------- d-----w- c:\documents and settings\Owner\Application Data\Gulu

2010-08-05 04:05 . 2006-11-13 16:16 -------- d-----w- c:\program files\Digital Line Detect

2010-08-05 00:24 . 2008-03-12 19:57 -------- d-----w- c:\documents and settings\Owner\Application Data\Woab

2010-08-04 14:51 . 2008-08-14 08:13 -------- d-----w- c:\documents and settings\Owner\Application Data\Ersi

2010-07-30 23:53 . 2008-11-07 14:05 -------- d-----w- c:\documents and settings\Owner\Application Data\Goez

2010-07-28 14:06 . 2009-08-24 16:02 -------- d-----w- c:\documents and settings\Owner\Application Data\Xenyum

2010-07-09 01:38 . 2010-07-09 01:38 -------- d-----w- c:\documents and settings\NetworkService\Application Data\AdobeUM

2010-06-30 12:31 . 2005-08-16 10:18 149504 ----a-w- c:\windows\system32\schannel.dll

2010-06-24 12:22 . 2005-08-16 10:18 916480 ----a-w- c:\windows\system32\wininet.dll

2010-06-23 13:44 . 2005-08-16 10:18 1851904 ----a-w- c:\windows\system32\win32k.sys

2010-06-21 15:27 . 2005-08-16 10:18 354304 ----a-w- c:\windows\system32\drivers\srv.sys

2010-06-17 14:03 . 2005-08-16 10:18 80384 ----a-w- c:\windows\system32\iccvid.dll

2010-06-14 14:31 . 2005-08-16 10:40 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe

2010-06-14 07:41 . 2005-08-16 10:18 1172480 ----a-w- c:\windows\system32\msxml3.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Google Update"="c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-28 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2004-12-30 120640]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-09 761947]

"SigmatelSysTrayApp"="stsystra.exe" [2006-03-25 282624]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-08-07 98304]

"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2010-08-07 184320]

"MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2006-11-07 1121280]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2010-08-08 81920]

"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2010-08-08 221184]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]

"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]

"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2010-08-07 1032192]

"CTSVolFE.exe"="c:\program files\Creative\Mixer\CTSVolFE.exe" [2010-08-07 57344]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2004-12-10 67184]

"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-11-13 24576]

Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2005-5-3 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe"=

"c:\\Program Files\\Common Files\\Symantec Shared\\ccEvtMgr.exe"=

"c:\\Program Files\\Common Files\\Symantec Shared\\ccSetMgr.exe"=

"c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=

"c:\\Program Files\\Symantec AntiVirus\\DefWatch.exe"=

"c:\\WINDOWS\\ehome\\ehrecvr.exe"=

"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]

S3 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [12/30/2004 2:19 PM 153416]

.

Contents of the 'Scheduled Tasks' folder

2010-08-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3600811620-705998895-4280596475-1006Core.job

- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-28 03:03]

2010-08-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3600811620-705998895-4280596475-1006UA.job

- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-05-28 03:03]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000

Trusted Zone: live.com\onecare

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-08-16 09:27

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(884)

c:\windows\System32\BCMLogon.dll

- - - - - - - > 'explorer.exe'(5320)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2010-08-16 09:34:16

ComboFix-quarantined-files.txt 2010-08-16 14:34

ComboFix2.txt 2010-08-14 16:52

Pre-Run: 50,915,422,208 bytes free

Post-Run: 50,907,754,496 bytes free

- - End Of File - - FF6C76ABA1C674BCDDDA96448ECD823A

Link to post
Share on other sites

I don't think that disk will help, so lets try it with a small linux live USB stick.

Download http://unetbootin.sourceforge.net/unetboot...dows-latest.exe to the desktop of your clean computer

  • Insert your USB drive
  • Press Start > My Computer > right click your USB drive > choose Format > Quick format
  • Double click the unetbootin-xpud-windows-387.exe that you just downloaded
  • Press Run then OK
  • It will install a little bootable OS on your USB
  • After it has completed do not choose to reboot the clean computer simply close the installer
  • Remove the USB and insert it in the sick computer
  • Boot the Sick computer
  • Press F12 and choose to boot from the USB
  • Follow the prompts
  • A Welcome to xPUD screen will appear
  • Press File
  • Expand mnt
  • sda1,2...usually corresponds to your HDD
  • sdb1 is likely your USB
  • Click on the folder that represents your HDD (sda1?). Navigate to the mnt/sda1/d682e65b7fe7a639477c55e1929436/i386 folder and delete the files (right click > Delete). Do this also for the other file.

Reboot normally and verify they are gone.

If so, please rerun a new ESET online scan.

Link to post
Share on other sites

Elise,

I have tried creating the bootable USB twice, but when I try to boot from it on my infected PC I get the following message:

Invalid or damaged Bootable partition

Any suggestions? Thanks. FYI- the file that downloads from the link that you provided is "unetbootin-xpud-windows-387.exe" if that helps.

Michael

Link to post
Share on other sites

I had been following the exact steps you had provided to create the USB (reformating, etc) on a clean PC. The USB would work to boot the clean PC which I created it on (I tried it just to be sure it installed okay). But I got the "Invalid or damaged Bootable partition" when I tried it to boot the sick PC. I attempted it again using a different clean PC and got the same results.

I finally got it to work by creating the USB using my sick PC - I hope that does not cause any issues, but it was the only way I got it to work.

I then followed the rest of the instructions and verified the files were deleted after I rebooted.

ESET Results:

C:\Qoobox\Quarantine\[4]-Submit_2010-08-16_09.13.29.zip Win32/Ramnit.A virus deleted - quarantined

Since it appeared that ESET was able to take care of this new infected file successfully, I ran ESET one more time and got a clean scan (no report). :)

Link to post
Share on other sites

Well done. :)

If you have no problems left, it means you are all cleaned up! However, since this was anasty virus, I recommend to run an ESET scan on all computer you used the USB device on, just to make sure it didn't spread.

ALL CLEAN

--------------

Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it clean :(

Please do the following to remove the remaining programs from your PC:

  • Delete the tools used during the disinfection:
    • Click start > run and type combofix /uninstall, press enter. This will remove Combofix from your computer.
    • Delete DDS, GMER (this is a random named file) and OTL.

Please read these advices, in order to prevent reinfecting your PC:

  1. Install and update the following programs regularly:
    • an outbound firewall
      A comprehensive tutorial and a list of possible firewalls can be found here.
    • an AntiVirus Software
      It is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats.
    • an Anti-Spyware program
      Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
      SUPERAntiSpyware is another good scanner with high detection and removal rates.
      Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.
    • Spyware Blaster
      A tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating.
    • MVPs hosts file
      A tutorial for MVPs hosts file can be found here. If you would like automatic updates you might want to take a look at HostMan host file manager. For more information on thehosts file, and what it can do for you,please consult the Tutorial on the Hosts file

[*]Keep Windows (and your other Microsoft software) up to date!

I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.

Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!

[*]Keep your other software up to date as well

Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.

[*]Stay up to date!

The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing.

Some more links you might find of interest:

Please reply to this topic if you have read the above information. If your computer is working fine, this topic will be closed afterwards.

Link to post
Share on other sites

Elise, thanks so much for your help. I only have one question remaining. Ever since I deleted the infected file, "c:\program files\Microsoft SQL Server\80\Tools\Binn\w95scm.DLL" I get the following error when I boot up the computer:

sqlmangr.exe - Unable to Locate Component

This application has failed to start because W95SCM.dll was not found. Re-installing the application may fix this problem.

So my question is, do I need this file/application? And if yes, can you recommend a safe place to download a new version?

Aside from that, everything is fine. And I have read all of the information that you provided in your last post.

Thanks again,

Michael

Link to post
Share on other sites

Hi, this is the program it belongs to: Microsoft SQL Server Desktop Engine (MICROSOFTSMLBIZ)

You can uninstall it using Add/Remove programs. One of the files was infected, which means it would be best to uninstall/reinstall the application if you need it.

Whether you need it or not is hard to say, it depends on what you use the computer for. However, it is no critical component of windows or something like that. :)

More information and download link here

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.