Jump to content
AP_Hall

TROJAN.DOWNLOADER and TROJAN.FakeAlert

Recommended Posts

Thanks in advance for any help. A whole spat of malware has gone around my office as a result of fake linkedin email invites. I've successfully removed malware from several machines, but one is proving difficult. malwarebytes finds trojan.downloader and trojan.fakealert and says that it deletes it, but upon reboot both are still there. The first is located in C:\Windows\tasks\{random letters and number} the the latter in the registry at HKEY_CURRENT_USER\SOFTWARE\XML. I've tried two different installations of Norton Endpoint Security as well as TDSSKiller after Malwarebytes. Below is log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:49:27 PM, on 10/5/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.17055)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\agrsmsvc.exe

C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe

C:\Program Files\LogMeIn\x86\RaMaint.exe

C:\Program Files\LogMeIn\x86\LogMeIn.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\TOSHIBA\IVP\ISM\pinger.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe

c:\TOSHIBA\IVP\swupdate\swupdtmr.exe

C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

C:\WINDOWS\system32\TODDSrv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe

C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe

C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe

C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe

C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\WINDOWS\system32\TPSMain.exe

C:\WINDOWS\system32\TPSBattM.exe

C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe

C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\ltmoh\Ltmoh.exe

C:\DOCUME~1\LENEFF~1.LEF\LOCALS~1\Temp\Ckr.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://told.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe

O1 - Hosts: 212.117.178.25 www.google.com

O1 - Hosts: 212.117.163.43 search.yahoo.com

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe

O4 - HKLM\..\Run: [TFncKy] TFncKy.exe

O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe

O4 - HKLM\..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe

O4 - HKLM\..\Run: [smoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"

O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

O4 - HKLM\..\Run: [TPSMain] TPSMain.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe

O4 - HKCU\..\Run: [KOO9RV9K4Z] C:\DOCUME~1\LENEFF~1.LEF\LOCALS~1\Temp\Ckr.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1257483818281

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1257483810062

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe

O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe

O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe

O23 - Service: pinger - Unknown owner - C:\TOSHIBA\IVP\ISM\pinger.exe

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE

O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe

O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe

--

End of file - 9465 bytes

Thanks,

A

Share this post


Link to post
Share on other sites

Hello ,

And :( My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

  • The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  • Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  • The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

  • Please download OTL from one of the following mirrors:

    [*]Save it to your desktop.

    [*]Double click on the otlDesktopIcon.png icon on your desktop.

    [*]Click the "Scan All Users" checkbox.

    [*]Push the Quick Scan button.

    [*]Two reports will open, copy and paste them in a reply here:

    • OTListIt.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

Please download Rootkit Unhooker and save it to your Desktop

  • Double-click on RKUnhookerLE to run it
  • Click the Report tab, then click Scan
  • Check Drivers, Stealth and uncheck the rest
  • Click OK
  • Wait until it's finished and then go to File > Save Report
  • Save the report to your Desktop

Copy the entire contents of the report and paste it in a reply here.

Note - you may get this warning it is ok, just ignore: "Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

  • A detailed description of your problems
  • A new OTL log (don't forget extra.txt)
  • RKU log

Thanks and again sorry for the delay.

Share this post


Link to post
Share on other sites

Elise, thanks for the help. Since I last posted and before I saw your post I started having a "Microsoft Security Essentials" Popup that was preventing me from doing much of anything on this machine. I booted up in safemode and was able to remove that symptom (for now anyway) using malwarebytes.

As you instructed...

Here is the OTL.txt log:

OTL logfile created on: 10/6/2010 4:58:29 PM - Run 1

OTL by OldTimer - Version 3.2.14.1 Folder = E:\

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.11)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 70.00% Memory free

4.00 Gb Paging File | 3.00 Gb Available in Paging File | 88.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 140.77 Gb Total Space | 113.90 Gb Free Space | 80.91% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

Drive E: | 3.81 Gb Total Space | 3.54 Gb Free Space | 92.76% Space Free | Partition Type: FAT32

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: LEFFRON

Current User Name: Len Effron

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/10/06 15:42:06 | 000,576,512 | ---- | M] (OldTimer Tools) -- E:\OTL.exe

PRC - [2010/10/04 13:24:12 | 000,197,120 | ---- | M] (Simon Tatham) -- C:\Documents and Settings\Len Effron.LEFFRON\Local Settings\Temp\Ckr.exe

PRC - [2010/09/29 11:42:19 | 000,116,104 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\ramaint.exe

PRC - [2010/09/23 16:44:32 | 000,374,152 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe

PRC - [2008/08/11 13:41:00 | 000,063,048 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

PRC - [2008/08/11 13:41:00 | 000,063,040 | ---- | M] (LogMeIn, Inc.) -- C:\Program Files\LogMeIn\x86\LogMeIn.exe

PRC - [2008/07/27 10:28:22 | 002,238,904 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

PRC - [2008/07/27 09:40:04 | 001,660,288 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe

PRC - [2008/07/27 09:40:02 | 002,479,488 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

PRC - [2008/04/13 17:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2008/03/04 12:12:04 | 000,360,448 | ---- | M] (TOSHIBA) -- C:\Program Files\TOSHIBA\TOSHIBA Applet\THotkey.exe

PRC - [2008/02/01 01:25:38 | 000,115,560 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe

PRC - [2008/02/01 01:25:16 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

PRC - [2007/12/18 19:25:10 | 000,475,136 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe

PRC - [2007/11/21 18:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TODDSrv.exe

PRC - [2007/10/23 17:27:16 | 000,066,928 | ---- | M] () -- c:\TOSHIBA\IVP\swupdate\swupdtmr.exe

PRC - [2007/10/08 15:27:02 | 000,794,624 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

PRC - [2007/10/08 15:18:04 | 000,995,328 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe

PRC - [2007/10/08 15:13:36 | 001,101,824 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe

PRC - [2007/10/08 15:09:26 | 000,659,456 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe

PRC - [2007/10/08 15:06:44 | 001,183,744 | ---- | M] (Intel Corporation ) -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

PRC - [2007/10/08 15:01:54 | 000,483,328 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

PRC - [2007/10/08 14:02:46 | 000,262,144 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSMain.exe

PRC - [2007/10/08 14:02:46 | 000,032,768 | ---- | M] (TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSBattM.exe

PRC - [2007/10/03 16:45:02 | 000,358,936 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe

PRC - [2007/10/03 16:44:58 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

PRC - [2007/04/13 19:16:16 | 000,311,296 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\DDWMon.exe

PRC - [2007/04/10 08:45:20 | 000,035,840 | ---- | M] (TOSHIBA Corp.) -- C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

PRC - [2007/04/09 19:07:02 | 000,159,744 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

PRC - [2007/01/25 19:47:50 | 000,136,816 | ---- | M] () -- C:\TOSHIBA\IVP\ISM\pinger.exe

PRC - [2007/01/09 15:23:04 | 000,191,552 | ---- | M] (Agere Systems) -- C:\Program Files\ltmoh\ltmoh.exe

PRC - [2006/10/05 13:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\WINDOWS\system32\agrsmsvc.exe

PRC - [2006/03/16 14:58:00 | 000,974,848 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

PRC - [2005/01/17 17:38:00 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

========== Modules (SafeList) ==========

MOD - [2010/10/06 15:42:06 | 000,576,512 | ---- | M] (OldTimer Tools) -- E:\OTL.exe

MOD - [2010/10/04 14:39:40 | 000,047,616 | -H-- | M] () -- C:\WINDOWS\system32\drivutou.dll

MOD - [2008/04/13 17:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)

SRV - [2010/09/29 11:42:19 | 000,116,104 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\RaMaint.exe -- (LMIMaint)

SRV - [2010/09/23 16:44:32 | 000,374,152 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe -- (LMIGuardianSvc)

SRV - [2008/08/11 13:41:00 | 000,063,040 | ---- | M] (LogMeIn, Inc.) [Auto | Running] -- C:\Program Files\LogMeIn\x86\LogMeIn.exe -- (LogMeIn)

SRV - [2008/07/27 10:28:22 | 002,238,904 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus)

SRV - [2008/07/27 09:40:02 | 002,479,488 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService)

SRV - [2008/06/30 04:46:26 | 000,296,328 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE -- (SNAC)

SRV - [2008/02/01 01:25:16 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (CLTNetCnService)

SRV - [2008/02/01 01:25:16 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)

SRV - [2008/02/01 01:25:16 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)

SRV - [2007/11/21 18:23:32 | 000,129,632 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\WINDOWS\system32\TODDSrv.exe -- (TODDSrv)

SRV - [2007/10/23 17:27:16 | 000,066,928 | ---- | M] () [Auto | Running] -- c:\TOSHIBA\IVP\swupdate\swupdtmr.exe -- (Swupdtmr)

SRV - [2007/10/08 15:27:02 | 000,794,624 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\EvtEng.exe -- (EvtEng) Intel®

SRV - [2007/10/08 15:06:44 | 001,183,744 | ---- | M] (Intel Corporation ) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe -- (S24EventMonitor) Intel®

SRV - [2007/10/08 15:01:54 | 000,483,328 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe -- (RegSrvc) Intel®

SRV - [2007/10/03 16:45:02 | 000,358,936 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel®

SRV - [2007/08/11 20:05:27 | 003,093,872 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)

SRV - [2007/04/10 08:45:20 | 000,035,840 | ---- | M] (TOSHIBA Corp.) [Auto | Running] -- C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe -- (TAPPSRV)

SRV - [2007/01/25 19:47:50 | 000,136,816 | ---- | M] () [Auto | Running] -- C:\TOSHIBA\IVP\ISM\pinger.exe -- (pinger)

SRV - [2006/10/05 13:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\WINDOWS\system32\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2005/01/17 17:38:00 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe -- (CFSvcs)

========== Driver Services (SafeList) ==========

DRV - [2010/10/05 12:48:11 | 000,123,952 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)

DRV - [2010/10/05 01:00:00 | 001,371,184 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20101005.002\NAVEX15.SYS -- (NAVEX15)

DRV - [2010/10/05 01:00:00 | 000,086,064 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20101005.002\NAVENG.SYS -- (NAVENG)

DRV - [2010/09/29 11:41:59 | 000,083,360 | ---- | M] (LogMeIn, Inc.) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\LMIRfsClientNP.dll -- (LMIRfsClientNP)

DRV - [2010/09/16 13:54:52 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)

DRV - [2010/09/16 13:54:52 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)

DRV - [2008/08/14 11:01:06 | 000,231,424 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)

DRV - [2008/08/11 13:41:00 | 000,047,640 | ---- | M] (LogMeIn, Inc.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\LMIRfsDriver.sys -- (LMIRfsDriver)

DRV - [2008/08/11 13:41:00 | 000,012,856 | ---- | M] (LogMeIn, Inc.) [Kernel | Auto | Running] -- C:\Program Files\LogMeIn\x86\rainfo.sys -- (LMIInfo)

DRV - [2008/06/16 16:53:14 | 000,420,400 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)

DRV - [2008/04/13 09:36:05 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)

DRV - [2008/03/21 19:14:24 | 000,317,616 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\srtspl.sys -- (SRTSPL)

DRV - [2008/03/21 19:14:24 | 000,279,088 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\srtsp.sys -- (SRTSP)

DRV - [2008/03/21 19:14:24 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srtspx.sys -- (SRTSPX)

DRV - [2008/01/30 12:28:36 | 004,725,760 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2008/01/03 23:10:16 | 000,105,856 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)

DRV - [2007/10/30 20:55:38 | 000,191,536 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)

DRV - [2007/10/30 20:55:34 | 000,027,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)

DRV - [2007/10/25 11:08:18 | 000,046,976 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTSTOR.sys -- (RTSTOR)

DRV - [2007/09/30 00:03:12 | 000,308,248 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\iaStor.sys -- (iaStor)

DRV - [2007/09/26 07:01:32 | 002,236,032 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32) Intel®

DRV - [2007/08/27 12:10:36 | 000,012,288 | ---- | M] (Intel Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)

DRV - [2007/05/25 12:27:04 | 005,761,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)

DRV - [2007/04/04 08:56:48 | 000,005,888 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\FwLnk.sys -- (FwLnk)

DRV - [2007/03/26 13:22:18 | 000,105,856 | ---- | M] (TOSHIBA Corporation) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\tdudf.sys -- (tdudf)

DRV - [2007/02/22 16:10:30 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tdcmdpst.sys -- (tdcmdpst)

DRV - [2007/02/19 13:15:32 | 000,134,016 | ---- | M] (TOSHIBA Corporation) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\trudf.sys -- (trudf)

DRV - [2006/11/28 16:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2003/01/29 15:35:00 | 000,012,032 | ---- | M] (TOSHIBA Corporation.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Netdevio.sys -- (Netdevio)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart

IE - HKU\S-1-5-21-351492761-1639727820-46188916-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKU\S-1-5-21-351492761-1639727820-46188916-1008\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKU\S-1-5-21-351492761-1639727820-46188916-1008\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/webhp?hl=en

IE - HKU\S-1-5-21-351492761-1639727820-46188916-1008\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{178A25C8-BC35-4D3F-948B-06783B30A67E}: C:\Documents and Settings\Len Effron.LEFFRON\Local Settings\Application Data\{178A25C8-BC35-4D3F-948B-06783B30A67E} [2010/10/04 14:42:46 | 000,000,000 | ---D | M]

O1 HOSTS File: ([2010/10/05 22:49:26 | 000,000,804 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: 212.117.178.25 www.google.com

O1 - Hosts: 212.117.163.43 search.yahoo.com

O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)

O4 - HKLM..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe ()

O4 - HKLM..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)

O4 - HKLM..\Run: [intelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)

O4 - HKLM..\Run: [intelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)

O4 - HKLM..\Run: [LogMeIn GUI] C:\Program Files\LogMeIn\x86\LogMeInSystray.exe (LogMeIn, Inc.)

O4 - HKLM..\Run: [NDSTray.exe] .fseventsd [2010/10/06 08:43:48 | 000,000,000 | -H-D | M]

O4 - HKLM..\Run: [smoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe (TOSHIBA Corporation)

O4 - HKLM..\Run: [TFncKy] .fseventsd [2010/10/06 08:43:48 | 000,000,000 | -H-D | M]

O4 - HKLM..\Run: [THotkey] C:\Program Files\TOSHIBA\TOSHIBA Applet\THotkey.exe (TOSHIBA)

O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)

O4 - HKU\S-1-5-21-351492761-1639727820-46188916-1008..\Run: [KOO9RV9K4Z] C:\Documents and Settings\Len Effron.LEFFRON\Local Settings\Temp\Ckr.exe (Simon Tatham)

O4 - HKU\S-1-5-21-351492761-1639727820-46188916-1008..\Run: [LtMoh] C:\Program Files\ltmoh\ltmoh.exe (Agere Systems)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: consentpromptbehavioradmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: enableinstallerdetection = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: enablesecureuiapaths = 0

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-351492761-1639727820-46188916-1008\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll (Sun Microsystems, Inc.)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/microsoftupdat...b?1257483818281 (WUWebControl Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1257483810062 (MUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_03)

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_03)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_03)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 206.13.29.12 206.13.30.12 4.2.2.2

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)

O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)

O20 - Winlogon\Notify\NavLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found

O24 - Desktop BackupWallPaper: C:\WINDOWS\Bliss.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008/03/06 18:49:11 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{1d48a0c5-d0ec-11df-aa37-001e33485c0f}\Shell\AutoRun\command - "" = F:\WDSetup.exe -- File not found

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O36 - AppCertDlls: cacldial - (C:\WINDOWS\system32\drivutou.dll) - C:\WINDOWS\system32\drivutou.dll ()

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/10/06 10:20:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\InterVideo

[2010/10/05 22:49:14 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro

[2010/10/05 22:47:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Google

[2010/10/05 13:07:55 | 000,000,000 | ---D | C] -- C:\WIN2DATA

[2010/10/05 12:59:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\WINDOWS

[2010/10/05 12:47:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Symantec

[2010/10/04 19:16:01 | 000,010,344 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\symlcbrd.sys

[2010/10/04 15:30:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Genieo

[2010/10/04 15:30:32 | 000,192,512 | ---- | C] (Simon Tatham) -- C:\WINDOWS\Cdojuc.exe

[2010/10/04 15:30:21 | 000,192,512 | ---- | C] (Simon Tatham) -- C:\WINDOWS\Cdojub.exe

[2010/10/04 15:30:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Update

[2010/10/04 15:29:58 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Documents\Server

[2010/10/04 14:52:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia

[2010/10/04 14:52:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe

[2010/10/04 14:42:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Local Settings\Application Data\{178A25C8-BC35-4D3F-948B-06783B30A67E}

[2010/10/04 14:39:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun

[2010/10/04 14:17:43 | 000,123,952 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS

[2010/10/04 14:17:43 | 000,060,800 | ---- | C] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL

[2010/10/04 14:05:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt

[2010/10/04 14:05:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Malwarebytes

[2010/10/04 14:05:12 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/10/04 14:05:11 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/10/04 14:05:11 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010/10/04 14:05:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2010/10/04 13:40:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Leadertech

[2010/10/04 13:40:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Xerox

[2010/10/04 13:24:01 | 000,192,512 | ---- | C] (Simon Tatham) -- C:\WINDOWS\Cdojua.exe

[2010/10/04 13:09:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Downloads

[2010/10/04 13:07:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Local Settings\Application Data\Recovery Toolbox for Outlook

[2010/10/04 12:51:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Local Settings\Application Data\Symantec

[2010/10/04 12:49:02 | 000,000,000 | ---D | C] -- C:\Program Files\Symantec

[2010/10/04 12:21:18 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\My Videos

[2010/10/04 12:21:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\New Folder

[2010/10/04 12:21:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\9924cxanoga

[2010/10/04 12:16:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Adobe

[2010/10/04 12:06:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Local Settings\Application Data\LogMeIn

[2010/10/04 12:05:54 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Microsoft

[2010/10/04 12:05:54 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\SendTo

[2010/10/04 12:05:54 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Recent

[2010/10/04 12:05:54 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data

[2010/10/04 12:05:54 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Start Menu

[2010/10/04 12:05:54 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\My Pictures

[2010/10/04 12:05:54 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\My Music

[2010/10/04 12:05:54 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents

[2010/10/04 12:05:54 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Favorites

[2010/10/04 12:05:54 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Cookies

[2010/10/04 12:05:54 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Templates

[2010/10/04 12:05:54 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\PrintHood

[2010/10/04 12:05:54 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\NetHood

[2010/10/04 12:05:54 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Local Settings

[2010/10/04 12:05:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\WinBatch

[2010/10/04 12:05:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\toshiba

[2010/10/04 12:05:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Sun

[2010/10/04 12:05:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Local Settings\Application Data\Seven Zip

[2010/10/04 12:05:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Local Settings\Application Data\Microsoft Help

[2010/10/04 12:05:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Local Settings\Application Data\Microsoft

[2010/10/04 12:05:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Macromedia

[2010/10/04 12:05:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Intel

[2010/10/04 12:05:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\InstallShield

[2010/10/04 12:05:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Identities

[2010/10/04 12:05:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Local Settings\Application Data\Google

[2010/10/04 12:05:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Google

[2010/10/04 12:05:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Desktop

[2010/10/04 12:05:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Local Settings\Application Data\ApplicationHistory

[2010/10/04 12:05:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Len Effron.LEFFRON\Local Settings\Application Data\Adobe

[2010/10/01 12:47:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google

[2008/03/06 19:30:44 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\DLLVGA.dll

[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/10/06 16:58:07 | 000,000,306 | -H-- | M] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job

[2010/10/06 16:57:37 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/10/06 16:57:08 | 000,000,314 | -HS- | M] () -- C:\WINDOWS\tasks\Npdeey.job

[2010/10/06 16:57:08 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010/10/06 16:57:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/10/06 16:56:16 | 002,097,152 | -H-- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\NTUSER.DAT

[2010/10/06 16:56:16 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\ntuser.ini

[2010/10/06 16:56:15 | 001,656,336 | -H-- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\Local Settings\Application Data\IconCache.db

[2010/10/06 15:41:46 | 000,002,521 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\Desktop\Outlook.lnk

[2010/10/06 15:38:02 | 000,002,521 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\Desktop\Copy of Outlook.lnk

[2010/10/06 15:24:19 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At48.job

[2010/10/06 15:24:17 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At47.job

[2010/10/06 15:24:15 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At46.job

[2010/10/06 15:24:13 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At45.job

[2010/10/06 15:24:11 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At44.job

[2010/10/06 15:24:09 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At43.job

[2010/10/06 15:24:07 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At42.job

[2010/10/06 15:24:05 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At41.job

[2010/10/06 15:24:03 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At40.job

[2010/10/06 15:24:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At39.job

[2010/10/06 15:23:59 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At38.job

[2010/10/06 15:23:57 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At37.job

[2010/10/06 15:23:55 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At36.job

[2010/10/06 15:23:53 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At35.job

[2010/10/06 15:23:51 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At34.job

[2010/10/06 15:23:49 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At33.job

[2010/10/06 15:23:47 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At32.job

[2010/10/06 15:23:45 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At31.job

[2010/10/06 15:23:43 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At30.job

[2010/10/06 15:23:41 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At29.job

[2010/10/06 15:23:39 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At28.job

[2010/10/06 15:23:37 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At27.job

[2010/10/06 15:23:35 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At26.job

[2010/10/06 15:23:33 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At25.job

[2010/10/06 15:23:29 | 000,002,256 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\444.bat

[2010/10/06 15:23:29 | 000,000,171 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\asdsada.bat

[2010/10/06 15:20:03 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At14.job

[2010/10/06 14:30:00 | 000,000,424 | ---- | M] () -- C:\WINDOWS\tasks\Updater.job

[2010/10/06 14:20:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At16.job

[2010/10/06 14:17:07 | 000,000,533 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\Desktop\Win2Data.lnk

[2010/10/06 13:52:30 | 000,002,497 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\Desktop\Microsoft Office Word 2003.lnk

[2010/10/06 13:38:19 | 000,076,288 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\TOLD Letterhead Template.doc

[2010/10/06 13:38:19 | 000,076,288 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\Desktop\TOLD Letterhead Template.doc

[2010/10/06 13:32:53 | 000,069,232 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

[2010/10/06 13:20:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At13.job

[2010/10/06 13:17:21 | 000,000,650 | ---- | M] () -- C:\WINDOWS\win.ini

[2010/10/06 12:20:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At15.job

[2010/10/06 12:18:11 | 000,000,075 | ---- | M] () -- C:\WINDOWS\WIN2SEC.INI

[2010/10/06 11:20:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At11.job

[2010/10/06 10:20:38 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At12.job

[2010/10/06 10:15:02 | 000,000,803 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk

[2010/10/05 22:49:26 | 000,000,804 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2010/10/05 22:49:14 | 000,001,745 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\HijackThis.lnk

[2010/10/05 21:20:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At22.job

[2010/10/05 20:20:02 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At21.job

[2010/10/05 19:20:06 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At20.job

[2010/10/05 17:19:53 | 000,264,616 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2010/10/05 15:50:02 | 000,475,028 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010/10/05 15:50:02 | 000,405,878 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010/10/05 15:50:02 | 000,064,262 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010/10/05 15:49:41 | 000,000,500 | ---- | M] () -- C:\WINDOWS\ODBC.INI

[2010/10/05 12:48:11 | 000,123,952 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS

[2010/10/05 12:48:11 | 000,060,800 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL

[2010/10/05 12:48:11 | 000,010,563 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT

[2010/10/05 12:48:11 | 000,000,805 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF

[2010/10/05 11:57:12 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Yzebezo.dat

[2010/10/05 08:29:13 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Txicejupecejo.bin

[2010/10/04 19:48:30 | 000,000,000 | ---- | M] () -- C:\WINDOWS\VPC32.INI

[2010/10/04 19:16:01 | 000,010,344 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\symlcbrd.sys

[2010/10/04 17:27:21 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At19.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At9.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At8.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At7.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At6.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At5.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At4.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At3.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At24.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At23.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At2.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At18.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At17.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At10.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\At1.job

[2010/10/04 15:30:45 | 000,000,151 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\srsf.bat

[2010/10/04 15:30:18 | 000,192,512 | ---- | M] (Simon Tatham) -- C:\WINDOWS\Cdojuc.exe

[2010/10/04 15:30:14 | 000,192,512 | ---- | M] (Simon Tatham) -- C:\WINDOWS\Cdojub.exe

[2010/10/04 14:39:40 | 000,047,616 | -H-- | M] () -- C:\WINDOWS\System32\drivutou.dll

[2010/10/04 13:23:57 | 000,192,512 | ---- | M] (Simon Tatham) -- C:\WINDOWS\Cdojua.exe

[2010/10/04 13:23:53 | 000,067,072 | RHS- | M] () -- C:\WINDOWS\System32\msxmlrx.dll

[2010/10/04 12:06:04 | 000,000,790 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

[2010/10/04 12:06:00 | 000,000,793 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\Desktop\Windows Media Player.lnk

[2010/10/04 12:04:27 | 000,000,008 | RHS- | M] () -- C:\Documents and Settings\All Users\ntuser.pol

[2010/09/29 11:48:51 | 000,271,360 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Personal Folders(1).pst

[2010/09/29 11:44:27 | 000,000,558 | ---- | M] () -- C:\WINDOWS\ricdb.ini

[2010/09/29 11:41:59 | 000,087,424 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\System32\LMIinit.dll

[2010/09/29 11:41:59 | 000,083,360 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\System32\LMIRfsClientNP.dll

[2010/09/29 11:41:59 | 000,029,568 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\System32\LMIport.dll

[2010/09/20 14:09:44 | 000,001,740 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk

[2010/07/23 13:54:25 | 000,000,614 | ---- | M] () -- C:\WINDOWS\Metropolis.ini

[2010/07/14 14:47:47 | 000,003,200 | ---- | M] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Lee Web.htm

[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/10/06 16:58:03 | 000,000,306 | -H-- | C] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job

[2010/10/06 15:36:55 | 000,002,521 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\Desktop\Copy of Outlook.lnk

[2010/10/06 15:24:19 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At48.job

[2010/10/06 15:24:17 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At47.job

[2010/10/06 15:24:15 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At46.job

[2010/10/06 15:24:13 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At45.job

[2010/10/06 15:24:11 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At44.job

[2010/10/06 15:24:09 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At43.job

[2010/10/06 15:24:07 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At42.job

[2010/10/06 15:24:05 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At41.job

[2010/10/06 15:24:03 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At40.job

[2010/10/06 15:24:01 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At39.job

[2010/10/06 15:23:59 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At38.job

[2010/10/06 15:23:57 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At37.job

[2010/10/06 15:23:55 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At36.job

[2010/10/06 15:23:53 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At35.job

[2010/10/06 15:23:51 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At34.job

[2010/10/06 15:23:49 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At33.job

[2010/10/06 15:23:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At32.job

[2010/10/06 15:23:45 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At31.job

[2010/10/06 15:23:43 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At30.job

[2010/10/06 15:23:41 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At29.job

[2010/10/06 15:23:39 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At28.job

[2010/10/06 15:23:37 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At27.job

[2010/10/06 15:23:35 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At26.job

[2010/10/06 15:23:33 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At25.job

[2010/10/06 15:23:29 | 000,002,256 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\444.bat

[2010/10/06 15:23:29 | 000,000,171 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\asdsada.bat

[2010/10/06 14:17:07 | 000,000,533 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\Desktop\Win2Data.lnk

[2010/10/06 13:46:01 | 000,002,521 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\Desktop\Outlook.lnk

[2010/10/06 13:45:40 | 000,002,497 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\Desktop\Microsoft Office Word 2003.lnk

[2010/10/05 22:49:14 | 000,001,745 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\HijackThis.lnk

[2010/10/05 13:08:14 | 000,203,216 | ---- | C] () -- C:\WINDOWS\System\WIDGETS.DLL

[2010/10/05 13:08:14 | 000,199,232 | ---- | C] () -- C:\WINDOWS\System\XTABLE.DLL

[2010/10/05 13:08:14 | 000,000,176 | ---- | C] () -- C:\WINDOWS\System\VSSVER.SCC

[2010/10/05 12:48:02 | 000,010,563 | ---- | C] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT

[2010/10/05 12:48:02 | 000,000,805 | ---- | C] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF

[2010/10/04 19:48:30 | 000,000,000 | ---- | C] () -- C:\WINDOWS\VPC32.INI

[2010/10/04 15:30:48 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At24.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At23.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At9.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At8.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At7.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At6.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At5.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At4.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At22.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At21.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At20.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At19.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At18.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At17.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At16.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At15.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At14.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At13.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At12.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At11.job

[2010/10/04 15:30:47 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At10.job

[2010/10/04 15:30:46 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At3.job

[2010/10/04 15:30:46 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At2.job

[2010/10/04 15:30:46 | 000,000,406 | ---- | C] () -- C:\WINDOWS\tasks\At1.job

[2010/10/04 15:30:45 | 000,000,151 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\srsf.bat

[2010/10/04 15:30:28 | 000,000,424 | ---- | C] () -- C:\WINDOWS\tasks\Updater.job

[2010/10/04 14:42:51 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Yzebezo.dat

[2010/10/04 14:42:51 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Txicejupecejo.bin

[2010/10/04 14:39:40 | 000,047,616 | -H-- | C] () -- C:\WINDOWS\System32\drivutou.dll

[2010/10/04 13:23:53 | 000,067,072 | RHS- | C] () -- C:\WINDOWS\System32\msxmlrx.dll

[2010/10/04 13:23:53 | 000,000,314 | -HS- | C] () -- C:\WINDOWS\tasks\Npdeey.job

[2010/10/04 12:23:02 | 000,000,803 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk

[2010/10/04 12:21:47 | 002,107,715 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Peter Wyckoff 10-15k 4-22-10.pdf

[2010/10/04 12:21:47 | 001,338,331 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\tracy topham Apr 16 09.pdf

[2010/10/04 12:21:47 | 000,581,641 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Peter Wyckoff Carson 4-30-10.pdf

[2010/10/04 12:21:47 | 000,271,360 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Personal Folders(1).pst

[2010/10/04 12:21:47 | 000,174,293 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Outlook.NK2

[2010/10/04 12:21:47 | 000,145,198 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Topham LOI 8-18-090001.mdi

[2010/10/04 12:21:47 | 000,139,182 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Topham LOI 8-18-09.mdi

[2010/10/04 12:21:47 | 000,086,050 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\topham brochure 10-1-09.pdf

[2010/10/04 12:21:47 | 000,075,633 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Tom Bray 1-4-10.pdf

[2010/10/04 12:21:47 | 000,037,701 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\sylvia mcaller-bob kelley 6-16-10.pdf

[2010/10/04 12:21:47 | 000,005,227 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\traceylarner 4000-7000.htm

[2010/10/04 12:21:19 | 778,126,336 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\outlook.ost

[2010/10/04 12:21:19 | 001,434,982 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\OfficialAIRBroch043024PM6278.pdf

[2010/10/04 12:21:19 | 000,271,360 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\new.pst

[2010/10/04 12:21:19 | 000,146,658 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Megdal 480 V 6-4-10.pdf

[2010/10/04 12:21:19 | 000,110,230 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\megdal bahama 6-24-10.pdf

[2010/10/04 12:21:19 | 000,086,050 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\OfficialAIRBroch022308PM6278.pdf

[2010/10/04 12:21:19 | 000,075,633 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\OfficialAIRBroch043331PM6278.pdf

[2010/10/04 12:21:19 | 000,058,696 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Metroscan Report.tif

[2010/10/04 12:21:19 | 000,015,992 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Metroscan Report0001.tif

[2010/10/04 12:21:19 | 000,008,656 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Metroscan Report0001.mdi

[2010/10/04 12:21:19 | 000,008,492 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Metroscan Report.mdi

[2010/10/04 12:21:19 | 000,003,200 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Lee Web.htm

[2010/10/04 12:21:18 | 007,570,944 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\ica32web.msi

[2010/10/04 12:21:18 | 000,639,809 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\hillandbrand 8000-30000 lse 5-6-10.pdf

[2010/10/04 12:21:18 | 000,441,678 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Doug Richardson 1000-2500 7-30-09.pdf

[2010/10/04 12:21:18 | 000,271,360 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\Archive 2008.pst

[2010/10/04 12:21:18 | 000,222,669 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\hilanbrand 8000-30000 for sale 5-6-10.pdf

[2010/10/04 12:21:18 | 000,167,143 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\AIRBrochLite024636PM6278.pdf

[2010/10/04 12:21:18 | 000,091,216 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\00051903.mdi

[2010/10/04 12:21:18 | 000,084,951 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\7935 alabama 11-2-09.pdf

[2010/10/04 12:21:18 | 000,000,749 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\available industrial bldgs 20000-40000 sq ft.htm

[2010/10/04 12:06:00 | 000,000,793 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\Desktop\Windows Media Player.lnk

[2010/10/04 12:05:54 | 002,097,152 | -H-- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\NTUSER.DAT

[2010/10/04 12:05:54 | 000,106,496 | -H-- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\ntuser.dat.LOG

[2010/10/04 12:05:54 | 000,000,790 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

[2010/10/04 12:05:54 | 000,000,278 | -HS- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\ntuser.ini

[2010/10/04 12:05:54 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

[2010/09/29 11:44:26 | 000,000,558 | ---- | C] () -- C:\WINDOWS\ricdb.ini

[2010/08/03 11:53:35 | 000,076,288 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\My Documents\TOLD Letterhead Template.doc

[2010/08/03 11:53:35 | 000,076,288 | ---- | C] () -- C:\Documents and Settings\Len Effron.LEFFRON\Desktop\TOLD Letterhead Template.doc

[2009/11/05 18:23:15 | 000,000,075 | ---- | C] () -- C:\WINDOWS\WIN2SEC.INI

[2009/11/05 18:18:52 | 000,000,614 | ---- | C] () -- C:\WINDOWS\Metropolis.ini

[2009/11/05 18:14:37 | 000,000,500 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2009/11/05 17:09:03 | 000,000,013 | RHS- | C] () -- C:\WINDOWS\System32\drivers\fbd.sys

[2009/11/05 17:09:01 | 000,000,003 | RHS- | C] () -- C:\WINDOWS\System32\drivers\taishop.sys

[2009/11/05 15:59:36 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2009/11/05 15:54:35 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll

[2009/11/05 15:54:35 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll

[2009/11/05 15:54:35 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll

[2009/11/05 15:54:35 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll

[2009/11/05 15:54:35 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll

[2009/11/05 15:54:35 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll

[2009/11/05 15:50:05 | 000,010,150 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini

[2009/11/05 15:50:04 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini

[2009/11/05 15:50:04 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll

[2009/11/05 15:50:04 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini

[2009/11/05 15:47:09 | 000,910,464 | ---- | C] () -- C:\WINDOWS\System32\igmedkrn.dll

[2009/11/05 15:47:09 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4833.dll

[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll

[2008/03/12 22:17:40 | 000,000,067 | ---- | C] () -- C:\WINDOWS\swupdate.INI

[2008/03/06 20:23:21 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NDSTray.INI

[2008/03/06 19:30:44 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\TCtrlIO.dll

[2008/03/06 18:46:53 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini

[2008/03/06 18:17:32 | 000,000,345 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI

[2003/01/07 16:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

========== LOP Check ==========

[2010/10/01 15:03:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\InterVideo

[2008/03/06 19:33:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\toshiba

[2008/03/06 19:22:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\WinBatch

[2010/09/29 11:58:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9

[2010/02/22 16:33:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\LogMeIn

[2010/10/04 15:30:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Update

[2008/03/06 20:14:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}

[2008/03/06 19:33:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\toshiba

[2008/03/06 19:22:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\WinBatch

[2008/03/06 19:33:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\laafluid\Application Data\toshiba

[2008/03/06 19:22:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\laafluid\Application Data\WinBatch

[2010/03/29 11:27:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\leffron\Application Data\ICAClient

[2010/03/17 13:39:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\leffron\Application Data\InterVideo

[2008/03/06 19:33:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\leffron\Application Data\toshiba

[2008/03/06 19:22:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\leffron\Application Data\WinBatch

[2008/03/06 19:33:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Len Effron\Application Data\toshiba

[2008/03/06 19:22:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Len Effron\Application Data\WinBatch

[2010/10/04 15:30:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Genieo

[2010/10/06 10:20:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\InterVideo

[2010/10/04 13:40:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Leadertech

[2008/03/06 19:33:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\toshiba

[2008/03/06 19:22:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\WinBatch

[2010/10/04 13:40:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Len Effron.LEFFRON\Application Data\Xerox

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At1.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At10.job

[2010/10/06 11:20:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At11.job

[2010/10/06 10:20:38 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At12.job

[2010/10/06 13:20:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At13.job

[2010/10/06 15:20:03 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At14.job

[2010/10/06 12:20:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At15.job

[2010/10/06 14:20:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At16.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At17.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At18.job

[2010/10/04 17:27:21 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At19.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At2.job

[2010/10/05 19:20:06 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At20.job

[2010/10/05 20:20:02 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At21.job

[2010/10/05 21:20:00 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At22.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At23.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At24.job

[2010/10/06 15:23:33 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At25.job

[2010/10/06 15:23:35 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At26.job

[2010/10/06 15:23:37 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At27.job

[2010/10/06 15:23:39 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At28.job

[2010/10/06 15:23:41 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At29.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At3.job

[2010/10/06 15:23:43 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At30.job

[2010/10/06 15:23:45 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At31.job

[2010/10/06 15:23:47 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At32.job

[2010/10/06 15:23:49 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At33.job

[2010/10/06 15:23:51 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At34.job

[2010/10/06 15:23:53 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At35.job

[2010/10/06 15:23:55 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At36.job

[2010/10/06 15:23:57 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At37.job

[2010/10/06 15:23:59 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At38.job

[2010/10/06 15:24:01 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At39.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At4.job

[2010/10/06 15:24:03 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At40.job

[2010/10/06 15:24:05 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At41.job

[2010/10/06 15:24:07 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At42.job

[2010/10/06 15:24:09 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At43.job

[2010/10/06 15:24:11 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At44.job

[2010/10/06 15:24:13 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At45.job

[2010/10/06 15:24:15 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At46.job

[2010/10/06 15:24:17 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At47.job

[2010/10/06 15:24:19 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At48.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At5.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At6.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At7.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At8.job

[2010/10/04 15:30:48 | 000,000,406 | ---- | M] () -- C:\WINDOWS\Tasks\At9.job

[2010/10/06 16:57:08 | 000,000,314 | -HS- | M] () -- C:\WINDOWS\Tasks\Npdeey.job

[2010/10/06 14:30:00 | 000,000,424 | ---- | M] () -- C:\WINDOWS\Tasks\Updater.job

[2010/10/06 16:58:07 | 000,000,306 | -H-- | M] () -- C:\WINDOWS\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job

========== Purity Check ==========

< End of report >

The Extras.txt log:

OTL Extras logfile created on: 10/6/2010 4:58:29 PM - Run 1

OTL by OldTimer - Version 3.2.14.1 Folder = E:\

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.11)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 70.00% Memory free

4.00 Gb Paging File | 3.00 Gb Available in Paging File | 88.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 140.77 Gb Total Space | 113.90 Gb Free Space | 80.91% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

Drive E: | 3.81 Gb Total Space | 3.54 Gb Free Space | 92.76% Space Free | Partition Type: FAT32

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: LEFFRON

Current User Name: Len Effron

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

"1900:TCP" = 1900:TCP:LocalSubNet:Enabled:UDP 1900

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\TOSHIBA\ivp\NetInt\Netint.exe" = C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrade Engine -- (TOSHIBA Corporation)

"C:\TOSHIBA\Ivp\ISM\pinger.exe" = C:\TOSHIBA\IVP\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger -- ()

"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- File not found

"C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe" = C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe:*:Enabled:SMC Service -- (Symantec Corporation)

"C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE" = C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE:*:Enabled:SNAC Service -- (Symantec Corporation)

"C:\Program Files\Common Files\Symantec Shared\ccApp.exe" = C:\Program Files\Common Files\Symantec Shared\ccApp.exe:*:Enabled:Symantec Email -- (Symantec Corporation)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{008D69EB-70FF-46AB-9C75-924620DF191A}" = TOSHIBA Speech System SR Engine(U.S.) Version1.0

"{07F58BB0-50D4-4477-B491-A97B2AD059B6}" = TOSHIBA Hotkey Utility

"{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7}" = mLogView

"{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist

"{206FD69B-F9FE-4164-81BD-D52552BC9C23}" = GearDrvs

"{23FB368F-1399-4EAC-817C-4B83ECBE3D83}" = mProSafe

"{2C38F661-26B7-445D-B87D-B53FE2D3BD42}" = TOSHIBA PC Diagnostic Tool

"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java 6 Update 3

"{34F93E31-E1A0-421C-8E86-BCF7C4193A91}" = LogMeIn

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{3E9D596A-61D4-4239-BD19-2DB984D2A16F}" = mIWA

"{3FBF6F99-8EC6-41B4-8527-0A32241B5496}" = TOSHIBA Speech System TTS Engine(U.S.) Version1.0

"{400830CA-F056-4BBE-80A3-9DF9CA4FB889}" = TOSHIBA Direct Disc Writer

"{425A2BC2-AA64-4107-9C29-484245BBEA05}" = TOSHIBA Software Upgrades

"{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator

"{61B84435-7A82-4F5C-87EC-1071EC28D72D}" = TOSHIBA Utilities

"{63A6E9A9-A190-46D4-9430-2DB28654AFD8}" = Norton 360

"{64212898-097F-4F3F-AECA-6D34A7EF82DF}" = TOSHIBA Zooming Utility

"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites

"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com

"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0

"{829CD169-E692-48E8-9BDE-A3E8D8B65538}" = mSCfg

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}" = mPfMgr

"{8C6BB412-D3A8-4AAE-A01B-35B681789D68}" = mHelp

"{8F7AC250-4D7D-431D-AC4E-94FB78EA3F8B}" = TOSHIBA Power Saver

"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system

"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager

"{90B0D222-8C21-4B35-9262-53B042F18AF9}" = mPfWiz

"{90CA0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Small Business Edition 2003

"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD for TOSHIBA

"{94658027-9F16-4509-BBD7-A59FE57C3023}" = mZConfig

"{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer

"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR

"{A6690C0E-B96E-4F0F-A8EB-D5B332454AC6}" = TOSHIBA Controls

"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.4

"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0

"{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}" = TOSHIBA Recovery Disc Creator

"{BB0500E8-A6D5-4D66-A4F9-1457530E5B6F}" = Symantec Endpoint Protection

"{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree

"{C02A6D5F-0FE1-46DE-B483-2BD33A226BCF}" = TOSHIBA TouchPad ON/Off Utility

"{C49067A8-8212-4A82-A4D9-1519701644F0}" = Citrix Presentation Server Client - Web Only

"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)

"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader

"{E81667C6-2856-46D6-ABEA-6A2F42166779}" = mCore

"{EE033C1F-443E-41EC-A0E2-559B539A4E4D}" = TOSHIBA Speech System Applications

"{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}" = mMHouse

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F6090A17-0967-4A8A-B3C3-422A1B514D49}" = mDrWiFi

"{F6C405D2-C50D-4D10-B89E-73A233A14D74}" = Toshiba Registration

"{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4}" = mWlsSafe

"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com

"HDMI" = Intel® Graphics Media Accelerator Driver

"HijackThis" = HijackThis 2.0.2

"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs

"ie7" = Windows Internet Explorer 7

"InstallShield_{2C38F661-26B7-445D-B87D-B53FE2D3BD42}" = TOSHIBA PC Diagnostic Tool

"InstallShield_{A6690C0E-B96E-4F0F-A8EB-D5B332454AC6}" = TOSHIBA Controls

"LiveUpdate" = LiveUpdate 3.3 (Symantec Corporation)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs

"Picasa2" = Picasa 2

"ProInst" = Intel® PROSet/Wireless Software

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"TOSHIBA Software Modem" = TOSHIBA Software Modem

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"Windows XP Service Pack" = Windows XP Service Pack 3

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 10/5/2010 4:41:14 PM | Computer Name = LEFFRON | Source = Symantec AntiVirus | ID = 16711726

Description = Security Risk Found!Bloodhound.MalPE in File: c:\System Volume Information\_restore{D9115431-1519-462C-84C0-924E6029E431}\RP1\A0011090.dll

by: Manual scan. Action: Clean succeeded. Action Description: The file was repaired

successfully.

Error - 10/5/2010 4:41:20 PM | Computer Name = LEFFRON | Source = Symantec AntiVirus | ID = 16711731

Description = Security Risk Found!Bloodhound.MalPE in File: c:\System Volume Information\_restore{D9115431-1519-462C-84C0-924E6029E431}\RP1\A0011090.dll

by: Manual scan. Action: Quarantine succeeded. Action Description: The file was

quarantined successfully.

Error - 10/5/2010 4:41:24 PM | Computer Name = LEFFRON | Source = Symantec AntiVirus | ID = 16711726

Description = Security Risk Found!Bloodhound.MalPE in File: c:\System Volume Information\_restore{D9115431-1519-462C-84C0-924E6029E431}\RP1\A0011091.dll

by: Manual scan. Action: Clean succeeded. Action Description: The file was repaired

successfully.

Error - 10/5/2010 4:41:25 PM | Computer Name = LEFFRON | Source = Symantec AntiVirus | ID = 16711731

Description = Security Risk Found!Bloodhound.MalPE in File: c:\System Volume Information\_restore{D9115431-1519-462C-84C0-924E6029E431}\RP1\A0011091.dll

by: Manual scan. Action: Quarantine succeeded. Action Description: The file was

quarantined successfully.

Error - 10/5/2010 4:44:39 PM | Computer Name = LEFFRON | Source = Application Error | ID = 1000

Description = Faulting application , version 0.0.0.0, faulting module unknown, version

0.0.0.0, fault address 0x7c923845.

Error - 10/5/2010 5:15:31 PM | Computer Name = LEFFRON | Source = Application Error | ID = 1000

Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting

module ntdll.dll, version 5.1.2600.5755, fault address 0x00023845.

Error - 10/5/2010 6:47:14 PM | Computer Name = LEFFRON | Source = Microsoft Office 11 | ID = 2001

Description =

Error - 10/5/2010 6:58:17 PM | Computer Name = LEFFRON | Source = Application Error | ID = 1000

Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting

module ntdll.dll, version 5.1.2600.5755, fault address 0x00023845.

Error - 10/5/2010 7:00:40 PM | Computer Name = LEFFRON | Source = Application Error | ID = 1001

Description = Fault bucket 1271752061.

Error - 10/5/2010 8:54:11 PM | Computer Name = LEFFRON | Source = Application Error | ID = 1000

Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting

module ntdll.dll, version 5.1.2600.5755, fault address 0x00023845.

< End of report >

Rootkit Unhooker Log:

RkU Version: 3.8.388.590, Type LE (SR2)

==============================================

OS Name: Windows XP

Version 5.1.2600 (Service Pack 3)

Number of processors #2

==============================================

>Drivers

==============================================

0xB885F000 C:\WINDOWS\system32\DRIVERS\igxpmp32.sys 5763072 bytes (Intel Corporation, Intel Graphics Miniport Driver)

0xA3ABD000 C:\WINDOWS\system32\drivers\RtkHDAud.sys 4894720 bytes (Realtek Semiconductor Corp., Realtek® High Definition Audio Function Driver)

0xBF1F2000 C:\WINDOWS\System32\igxpdx32.DLL 2732032 bytes (Intel Corporation, DirectDraw® Driver for Intel® Graphics Technology)

0xB85C3000 C:\WINDOWS\system32\DRIVERS\NETw4x32.sys 2236416 bytes (Intel Corporation, Intel

Share this post


Link to post
Share on other sites

It is actually a good thing when a rootkit scanner doesn't detect anything. :)

However, I see some other active malware, so lets get rid of that fast!

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe and follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Query_RC.gif

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC_successful.gif

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Share this post


Link to post
Share on other sites

Alright Elise, here's the ComboFix Log:

ComboFix 10-10-07.01 - Len Effron 10/07/2010 16:17:08.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1374 [GMT -7:00]

Running from: c:\documents and settings\Len Effron.LEFFRON\Desktop\ComboFix.exe

AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Len Effron.LEFFRON\Local Settings\Application Data\{178A25C8-BC35-4D3F-948B-06783B30A67E}

c:\documents and settings\Len Effron.LEFFRON\Local Settings\Application Data\{178A25C8-BC35-4D3F-948B-06783B30A67E}\chrome.manifest

c:\documents and settings\Len Effron.LEFFRON\Local Settings\Application Data\{178A25C8-BC35-4D3F-948B-06783B30A67E}\chrome\content\_cfg.js

c:\documents and settings\Len Effron.LEFFRON\Local Settings\Application Data\{178A25C8-BC35-4D3F-948B-06783B30A67E}\chrome\content\overlay.xul

c:\documents and settings\Len Effron.LEFFRON\Local Settings\Application Data\{178A25C8-BC35-4D3F-948B-06783B30A67E}\install.rdf

c:\windows\system32\drivutou.dll

c:\windows\Tasks\At1.job

c:\windows\Tasks\At10.job

c:\windows\Tasks\At11.job

c:\windows\Tasks\At12.job

c:\windows\Tasks\At13.job

c:\windows\Tasks\At14.job

c:\windows\Tasks\At15.job

c:\windows\Tasks\At16.job

c:\windows\Tasks\At17.job

c:\windows\Tasks\At18.job

c:\windows\Tasks\At19.job

c:\windows\Tasks\At2.job

c:\windows\Tasks\At20.job

c:\windows\Tasks\At21.job

c:\windows\Tasks\At22.job

c:\windows\Tasks\At23.job

c:\windows\Tasks\At24.job

c:\windows\Tasks\At25.job

c:\windows\Tasks\At26.job

c:\windows\Tasks\At27.job

c:\windows\Tasks\At28.job

c:\windows\Tasks\At29.job

c:\windows\Tasks\At3.job

c:\windows\Tasks\At30.job

c:\windows\Tasks\At31.job

c:\windows\Tasks\At32.job

c:\windows\Tasks\At33.job

c:\windows\Tasks\At34.job

c:\windows\Tasks\At35.job

c:\windows\Tasks\At36.job

c:\windows\Tasks\At37.job

c:\windows\Tasks\At38.job

c:\windows\Tasks\At39.job

c:\windows\Tasks\At4.job

c:\windows\Tasks\At40.job

c:\windows\Tasks\At41.job

c:\windows\Tasks\At42.job

c:\windows\Tasks\At43.job

c:\windows\Tasks\At44.job

c:\windows\Tasks\At45.job

c:\windows\Tasks\At46.job

c:\windows\Tasks\At47.job

c:\windows\Tasks\At48.job

c:\windows\Tasks\At49.job

c:\windows\Tasks\At5.job

c:\windows\Tasks\At50.job

c:\windows\Tasks\At51.job

c:\windows\Tasks\At52.job

c:\windows\Tasks\At53.job

c:\windows\Tasks\At54.job

c:\windows\Tasks\At55.job

c:\windows\Tasks\At56.job

c:\windows\Tasks\At57.job

c:\windows\Tasks\At58.job

c:\windows\Tasks\At59.job

c:\windows\Tasks\At6.job

c:\windows\Tasks\At60.job

c:\windows\Tasks\At61.job

c:\windows\Tasks\At62.job

c:\windows\Tasks\At63.job

c:\windows\Tasks\At64.job

c:\windows\Tasks\At65.job

c:\windows\Tasks\At66.job

c:\windows\Tasks\At67.job

c:\windows\Tasks\At68.job

c:\windows\Tasks\At69.job

c:\windows\Tasks\At7.job

c:\windows\Tasks\At70.job

c:\windows\Tasks\At71.job

c:\windows\Tasks\At72.job

c:\windows\Tasks\At8.job

c:\windows\Tasks\At9.job

.

((((((((((((((((((((((((( Files Created from 2010-09-07 to 2010-10-07 )))))))))))))))))))))))))))))))

.

2010-10-06 22:23 . 2010-10-07 21:43 2256 ----a-w- c:\documents and settings\Len Effron.LEFFRON\Application Data\444.bat

2010-10-06 22:23 . 2010-10-07 21:43 171 ----a-w- c:\documents and settings\Len Effron.LEFFRON\Application Data\asdsada.bat

2010-10-06 17:20 . 2010-10-06 17:20 -------- d-----w- c:\documents and settings\Len Effron.LEFFRON\Application Data\InterVideo

2010-10-06 05:49 . 2010-10-06 05:49 -------- d-----w- c:\program files\Trend Micro

2010-10-05 20:08 . 1997-12-06 00:13 263728 ----a-w- c:\windows\system\XBS110.DLL

2010-10-05 20:08 . 1997-12-06 00:13 199232 ----a-w- c:\windows\system\XTABLE.DLL

2010-10-05 20:08 . 1997-12-06 00:13 203216 ----a-w- c:\windows\system\WIDGETS.DLL

2010-10-05 20:08 . 1997-12-06 00:13 398416 ----a-w- c:\windows\system\VBRUN300.DLL

2010-10-05 20:08 . 1997-12-06 00:13 188896 ----a-w- c:\windows\system\PDX110.DLL

2010-10-05 20:08 . 1997-10-20 12:00 48128 ----a-w- c:\windows\system\RAPI.DLL

2010-10-05 20:08 . 1997-12-06 00:13 710752 ----a-w- c:\windows\system\MSAJT110.DLL

2010-10-05 20:08 . 1997-12-06 00:13 33280 ----a-w- c:\windows\system\MSAES110.DLL

2010-10-05 20:08 . 1997-12-06 00:13 27632 ----a-w- c:\windows\system\CTL3DV2.DLL

2010-10-05 20:07 . 2010-10-06 20:17 -------- d-----w- C:\WIN2DATA

2010-10-05 19:59 . 2010-10-05 19:59 -------- d-----w- c:\documents and settings\Len Effron.LEFFRON\WINDOWS

2010-10-05 19:59 . 2010-10-05 19:59 -------- d-----w- c:\documents and settings\LENEFF~1~LEF\LOCALS~1

2010-10-05 19:59 . 2010-10-05 19:59 -------- d-----w- c:\documents and settings\LENEFF~1~LEF

2010-10-05 19:47 . 2010-10-05 19:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec

2010-10-05 02:16 . 2010-10-05 02:16 10344 ----a-w- c:\windows\system32\drivers\symlcbrd.sys

2010-10-04 22:30 . 2010-10-04 22:30 38252 ----a-w- c:\documents and settings\Len Effron.LEFFRON\Application Data\Genieo\Application\Partner\uninstall\myHomey\partner_uninstall.exe

2010-10-04 22:30 . 2010-10-04 22:30 -------- d-----w- c:\documents and settings\Len Effron.LEFFRON\Application Data\Genieo

2010-10-04 22:30 . 2010-10-04 22:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Update

2010-10-04 21:42 . 2010-10-05 18:57 120 ----a-w- c:\windows\Yzebezo.dat

2010-10-04 21:42 . 2010-10-05 15:29 0 ----a-w- c:\windows\Txicejupecejo.bin

2010-10-04 21:39 . 2010-10-04 21:39 -------- d-----w- c:\windows\Sun

2010-10-04 21:17 . 2010-10-05 19:48 60800 ----a-w- c:\windows\system32\S32EVNT1.DLL

2010-10-04 21:17 . 2010-10-05 19:48 123952 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2010-10-04 21:05 . 2010-10-04 21:05 -------- d-----w- c:\documents and settings\Len Effron.LEFFRON\Application Data\Malwarebytes

2010-10-04 21:05 . 2010-04-29 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-10-04 21:05 . 2010-10-04 21:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-10-04 21:05 . 2010-10-04 21:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-10-04 21:05 . 2010-04-29 22:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-10-04 20:40 . 2010-10-04 20:40 -------- d-----w- c:\documents and settings\Len Effron.LEFFRON\Application Data\Leadertech

2010-10-04 20:40 . 2010-10-04 20:40 -------- d-----w- c:\documents and settings\Len Effron.LEFFRON\Application Data\Xerox

2010-10-04 20:23 . 2010-10-04 20:23 67072 --sha-r- c:\windows\system32\msxmlrx.dll

2010-10-04 20:07 . 2010-10-04 20:07 -------- d-----w- c:\documents and settings\Len Effron.LEFFRON\Local Settings\Application Data\Recovery Toolbox for Outlook

2010-10-04 19:51 . 2010-10-04 21:18 -------- d-----w- c:\documents and settings\Len Effron.LEFFRON\Local Settings\Application Data\Symantec

2010-10-04 19:49 . 2010-10-05 19:48 -------- d-----w- c:\program files\Symantec

2010-10-04 19:12 . 2010-10-06 20:32 69232 ----a-w- c:\documents and settings\Len Effron.LEFFRON\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-10-04 19:06 . 2010-10-04 19:06 -------- d-----w- c:\documents and settings\Len Effron.LEFFRON\Local Settings\Application Data\LogMeIn

2010-10-01 22:03 . 2010-10-01 22:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\InterVideo

2010-10-01 19:47 . 2010-10-01 19:47 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Temp

2010-10-01 19:47 . 2010-10-01 19:47 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google

2010-09-30 18:04 . 2009-10-10 07:07 38208 ----a-w- c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2010-09-29 19:47 . 2010-09-29 19:47 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\LogMeIn

2010-09-19 10:46 . 2010-09-19 10:46 318832 ----a-w- c:\documents and settings\Len Effron.LEFFRON\Application Data\Genieo\Application\Updater\genieo_temp\homey_setup.exe

2010-09-19 10:46 . 2010-09-19 10:46 455552 ----a-w- c:\documents and settings\Len Effron.LEFFRON\Application Data\Genieo\Application\Updater\genieo_temp\InstallMyHomey.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-10-07 16:49 . 2010-02-22 23:32 -------- d-----w- c:\program files\LogMeIn

2010-10-06 05:47 . 2008-03-07 03:00 -------- d-----w- c:\program files\Google

2010-10-06 05:35 . 2009-11-06 01:25 -------- d-----w- c:\program files\Common Files\TAIS

2010-10-06 05:32 . 2009-11-06 01:18 -------- d-----w- c:\program files\Metropolis

2010-10-06 05:22 . 2008-03-06 17:45 57600 ----a-w- c:\windows\system32\drivers\redbook.sys

2010-10-05 19:49 . 2008-03-07 02:54 -------- d-----w- c:\program files\Common Files\Symantec Shared

2010-10-05 19:48 . 2010-10-05 19:48 805 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF

2010-10-05 19:48 . 2010-10-05 19:48 10563 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT

2010-09-29 19:05 . 2010-05-12 20:21 -------- d-----w- c:\program files\Kaseya

2010-09-29 18:58 . 2010-05-20 21:52 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9

2010-09-29 18:41 . 2010-02-22 23:32 83360 ----a-w- c:\windows\system32\LMIRfsClientNP.dll

2010-09-29 18:41 . 2010-02-22 23:32 29568 ----a-w- c:\windows\system32\LMIport.dll

2010-09-29 18:41 . 2010-02-22 23:32 87424 ----a-w- c:\windows\system32\LMIinit.dll

2009-11-06 00:09 . 2009-11-06 00:09 13 --sh--r- c:\windows\system32\drivers\fbd.sys

2009-11-06 00:09 . 2009-11-06 00:09 3 --sh--r- c:\windows\system32\drivers\taishop.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2007-01-09 191552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2008-03-04 360448]

"TFncKy"="TFncKy.exe" [bU]

"NDSTray.exe"="NDSTray.exe" [bU]

"DDWMon"="c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2007-04-14 311296]

"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2007-04-10 159744]

"RTHDCPL"="RTHDCPL.EXE" [2008-01-29 16859648]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-05 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-05 162328]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-05 137752]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-08-14 1343488]

"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-10-08 995328]

"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-10-08 1101824]

"TPSMain"="TPSMain.exe" [2007-10-08 262144]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]

"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-08-11 63048]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-02-01 115560]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"consentpromptbehavioradmin"= 0 (0x0)

"enableinstallerdetection"= 0 (0x0)

"enablesecureuiapaths"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au]

"NoAutoUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2010-09-29 18:41 87424 ----a-w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=

"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"=

"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"=

"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\LogMeIn\x86\LMIGuardianSvc.exe [10/1/2010 12:33 PM 374152]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [8/11/2008 1:41 PM 12856]

R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [3/26/2007 1:22 PM 105856]

R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [2/19/2007 1:15 PM 134016]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [10/5/2010 12:59 PM 102448]

R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [3/6/2008 7:30 PM 5888]

.

Contents of the 'Scheduled Tasks' folder

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/webhp?hl=en

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html

.

- - - - ORPHANS REMOVED - - - -

Notify-NavLogon - (no file)

SafeBoot-klmdb.sys

SafeBoot-Symantec Antvirus

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(916)

c:\windows\system32\LMIinit.dll

- - - - - - - > 'explorer.exe'(1664)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

c:\windows\system32\TPwrCfg.DLL

c:\windows\system32\TPwrReg.dll

c:\windows\system32\TPSTrace.DLL

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe

c:\program files\Intel\Wireless\Bin\S24EvMon.exe

c:\program files\Common Files\Symantec Shared\ccSvcHst.exe

c:\windows\system32\rundll32.exe

c:\windows\system32\agrsmsvc.exe

c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe

c:\program files\Intel\Wireless\Bin\EvtEng.exe

c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

c:\program files\LogMeIn\x86\RaMaint.exe

c:\program files\LogMeIn\x86\LogMeIn.exe

c:\program files\TOSHIBA\ConfigFree\NDSTray.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe

c:\windows\RTHDCPL.EXE

c:\toshiba\IVP\ISM\pinger.exe

c:\windows\system32\igfxsrvc.exe

c:\program files\Intel\Wireless\Bin\RegSrvc.exe

c:\windows\system32\TPSMain.exe

c:\windows\system32\TPSBattM.exe

c:\toshiba\IVP\swupdate\swupdtmr.exe

c:\program files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

c:\program files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

c:\windows\system32\TODDSrv.exe

c:\program files\Symantec\Symantec Endpoint Protection\SmcGui.exe

c:\windows\system32\wscntfy.exe

c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe

.

**************************************************************************

.

Completion time: 2010-10-07 16:25:25 - machine was rebooted

ComboFix-quarantined-files.txt 2010-10-07 23:25

Pre-Run: 123,099,316,224 bytes free

Post-Run: 123,209,805,824 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 6CF0DF478EF391BF8F6394D793C6F736

Share this post


Link to post
Share on other sites

Hello again,

Please let me know how things are running now. Any problems left?

UPDATE JAVA

------------------

Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "JDK 6 Update 21 (JDK or JRE)".
  • Click the "Download JRE" button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.

Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u21-windows-i586.exe to install the newest version.
  • If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  • When the Java Setup - Welcome window opens, click the Install > button.
  • If offered to install a Toolbar, just uncheck the box before continuing unless you want it.

-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.

-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.

MALWAREBYTES ANTIMALWARE

-------------------------------------------

Please launch MBAM and update the program before performing a scan.

  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

  • Make sure the "Perform Full Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Share this post


Link to post
Share on other sites

So far so good; I updated and ran a full scan in Malware Bytes and found nothing. I will update java as well. I figure a day of usage should suss out whether it's fully cleaned up, but it looks like combofix did the trick.

Thanks very much for your help Elise!

-A

Share this post


Link to post
Share on other sites

That sounds good! :)

Lets run one last scan to check for leftovers. Please let me know if you discover any other problem.

ESET ONLINE SCANNER

----------------------------

I'd like us to scan your machine with ESET OnlineScan

  1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  2. Click the esetOnline.png button.
  3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

    1. Click on esetSmartInstall.png to download the ESET Smart Installer. Save it to your desktop.
    2. Double click on the esetSmartInstallDesktopIcon.png icon on your desktop.

    3. Check esetAcceptTerms.png
    4. Click the esetStart.png button.
    5. Accept any security warnings from your browser.
    6. Check esetScanArchives.png
    7. Push the Start button.
    8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    9. When the scan completes, push esetListThreats.png
    10. Push esetExport.png, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
      Note - when ESET doesn't find any threats, no report will be created.
    11. Push the esetBack.png button.
    12. Push esetFinish.png

Share this post


Link to post
Share on other sites

Elise,

I have another user whose computer had some malware. I thought I'd been able to clean it off with malwarebytes earlier this week, but he's started to get some warnings from symantec antivirus about Backdoor.Tidserv.L. Any chance I can get your help with this as well or do I need to start a new thread?

Also, I'll be running ESET as per your instructions on the first problem machine shortly and will post the results as soon as I have them.

Thanks again for you help,

A

Share this post


Link to post
Share on other sites

Hi, I'll wait for the ESET results.

As for the other computer; you'll have to make a separate thread for that. You can send me the link afterwards if you wish. :o

However, keep in mind to inform your company's IT department you are working on this to make sure they are okay with it.

Share this post


Link to post
Share on other sites

The ESET Log:

C:\Documents and Settings\All Users\Documents\Server\hlp.dat Win32/Bamital.EB trojan cleaned by deleting - quarantined

C:\Documents and Settings\Len Effron.LEFFRON\Application Data\444.bat Win32/Adware.FakeAntiSpy.G application cleaned by deleting - quarantined

C:\Qoobox\Quarantine\C\WINDOWS\system32\drivutou.dll.vir a variant of Win32/PSW.Papras.BO trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{D9115431-1519-462C-84C0-924E6029E431}\RP3\A0011231.dll a variant of Win32/Cimag.CK trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{D9115431-1519-462C-84C0-924E6029E431}\RP5\A0013768.dll a variant of Win32/PSW.Papras.BO trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{D9115431-1519-462C-84C0-924E6029E431}\RP6\A0013980.bat Win32/Adware.FakeAntiSpy.G application cleaned by deleting - quarantined

Share this post


Link to post
Share on other sites

Hi, I replied to your other topic as well. As for this one, you're all good! :o

ALL CLEAN

--------------

Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it clean :o

Please do the following to remove the remaining programs from your PC:

  • Delete the tools used during the disinfection:
    • Click start > run and type combofix /uninstall, press enter. This will remove Combofix from your computer.
    • Delete Rootkit Unhooker and OTL.

Please read these advices, in order to prevent reinfecting your PC:

  1. Install and update the following programs regularly:
    • an outbound firewall. If you are connected to the internet through a router, you are already behind a hardware firewall and as such you do not need an extra software firewall.
      A comprehensive tutorial and a list of possible firewalls can be found here.
    • an AntiVirus Software
      It is imperative that you update your AntiVirus Software on regular basis.If you do not update your AntiVirus Software then it will not be able to catch the latest threats.
    • an Anti-Spyware program
      Malware Byte's Anti Malware is an excellent Anti-Spyware scanner. It's scan times are usually under ten minutes, and has excellent detection and removal rates.
      SUPERAntiSpyware is another good scanner with high detection and removal rates.
      Both programs are free for non commercial home use but provide a resident and do not nag if you purchase the paid versions.
    • Spyware Blaster
      A tutorial for Spywareblaster can be found here. If you wish, the commercial version provides automatic updating.
    • MVPs hosts file
      A tutorial for MVPs hosts file can be found here. If you would like automatic updates you might want to take a look at HostMan host file manager. For more information on thehosts file, and what it can do for you,please consult the Tutorial on the Hosts file

[*]Keep Windows (and your other Microsoft software) up to date!

I cannot stress how important this is enough. Often holes are found in Internet Explorer or Windows itself that require patching. Sometimes these holes will allow an attacker unrestricted access to your computer.

Therefore, please, visit the Microsoft Update Website and follow the on screen instructions to setup Microsoft Update. Also follow the instructions to update your system. Please REBOOT and repeat this process until there are no more updates to install!!

[*]Keep your other software up to date as well

Software does not need to be made by Microsoft to be insecure. You can use the Secunia Online Software occasionally to help you check for out of date software on yourmachine.

[*]Stay up to date!

The MOST IMPORTANT part of any security setup is keeping the software up to date. Malware writers release new variants every single day. If your software updates don't keep up, then the malware will always be one step ahead. Not a good thing.

Some more links you might find of interest:

Please reply to this topic if you have read the above information. If your computer is working fine, this topic will be closed afterwards.

Share this post


Link to post
Share on other sites

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.