|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
Thread Tools |
05-10-2008, 01:10 AM
|
#1 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 6
OS: Vista
|
Pop ups,new web pages - trojandropper
When I open Internet Explorer I get 'Antispywaremaster' website opening asking me to download, and other sites open up new windows too. I have seen Trojandropper mentioned.
I went through the 5 steps and have the DSS text below and attached. Deckard's System Scanner v20071014.68 Run by Emma on 2008-05-10 08:27:58 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- Last 5 Restore Point(s) -- 11: 2008-05-07 20  55 UTC - RP129 - Installed Java(TM) 6 Update 510: 2008-05-06 19:28:35 UTC - RP128 - Windows Update 9: 2008-05-02 19:41:01 UTC - RP127 - Windows Update 8: 2008-04-25 18:46:54 UTC - RP126 - Windows Update 7: 2008-04-22 19:42:29 UTC - RP125 - Windows Update -- First Restore Point -- 1: 2008-03-30 14:05:34 UTC - RP119 - Windows Update Backed up registry hives. Performed disk cleanup. Total Physical Memory: 1014 MiB (1024 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-05-10 08:31:22 Platform: Windows Vista (6.00.6000) MSIE: Internet Explorer (7.00.6000.16386) Boot mode: Normal Running processes: C:\Windows\System32\dwm.exe C:\Windows\System32\taskeng.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\Program Files\BigFix\bigfix.exe C:\Program Files\SiteAdvisor\6253\SiteAdv.exe C:\Program Files\TomTom HOME 2\HOMERunner.exe C:\Program Files\McAfee.com\Agent\mcagent.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe C:\Windows\ehome\ehtray.exe C:\Windows\ehome\ehmsas.exe C:\Windows\System32\rundll32.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe C:\Windows\System32\rundll32.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Windows\System32\taskeng.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\explorer.exe C:\Users\Emma\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VEMZRWI3\dss[1].exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://bt.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.h...=PTB&M=MT6833B R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.h...=PTB&M=MT6833B R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.h...=PTB&M=MT6833B O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar2.dll O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\google\BAE.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar2.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [BigFix] c:\program files\Bigfix\bigfix.exe /atstartup O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [AntiSpywareMaster] C:\Program Files\AntiSpywareMaster\asm.exe O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Emma\AppData\Local\Temp\khfGwVNh.dll,#1 O4 - HKCU\..\Run: [Host Process] C:\Users\Emma\svchost.exe O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Emma\AppData\Local\Temp\awTJbXpP.dll,c O4 - HKCU\..\Run: [44dc4bbc] rundll32.exe "C:\Users\Emma\AppData\Local\Temp\agsmfxtw.dll",b O4 - HKCU\..\Run: [BM47ef7820] Rundll32.exe "C:\Users\Emma\AppData\Local\Temp\tnqhmukc.dll",s O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE') O4 - Global Startup: hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1210403819466 O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\microsoft shared\Information Retrieval\msitss.dll O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\McProxy\McProxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\Mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MpfSrv.exe O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\msksrver.exe O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe O23 - Service: BT Auto Backup Service (VaultClientSRV) - Unknown owner - C:\Program Files\BT Auto Backup\VaultClientSRV.exe -- End of file - 9875 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 AFS - c:\windows\system32\drivers\afs.sys <Not Verified; Oak Technology Inc.; AFS> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour> R2 STacSV (SigmaTel Audio Service) - c:\program files\sigmatel\c-major audio\wdm\stacsv.exe <Not Verified; SigmaTel, Inc.; C-Major Audio> -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-05-09 15:45:44 336 --a------ C:\Windows\Tasks\Quick_Clean.job 2008-03-12 21:11:09 334 --a------ C:\Windows\Tasks\McQcTask.job 2008-03-12 21:11:09 342 --a------ C:\Windows\Tasks\McDefragTask.job -- Files created between 2008-04-10 and 2008-05-10 ----------------------------- 2008-05-10 08:13:07 0 d-------- C:\Program Files\SpywareBlaster 2008-05-09 21:45:51 0 d-------- C:\Program Files\Panda Security 2008-05-08 20:20:00 143360 --a------ C:\Windows\system32\dunzip32.dll <Not Verified; Inner Media, Inc.; DynaZIP-32 Multi-Threading UnZIP DLL> 2008-05-07 21:59:01 0 d-------- C:\Users\Emma\Limewire 2008-05-07 21:24:53 0 d-------- C:\Windows\system32\bkEur05 2008-05-07 21:12:43 0 d--hs---- C:\Users\Emma\! 2008-04-24 19:42:24 0 d-------- C:\Program Files\iTunes 2008-04-24 19:32:55 0 d-------- C:\Program Files\Apple Software Update -- Find3M Report --------------------------------------------------------------- 2008-05-09 15:46:00 0 d-------- C:\Program Files\McAfee 2008-05-09 15:44:06 12 --a------ C:\Windows\bthservsdp.dat 2008-05-08 21:49:44 0 d-------- C:\Users\Emma\AppData\Roaming\SiteAdvisor 2008-05-08 20:26:34 0 d-------- C:\Program Files\Common Files\McAfee 2008-05-08 19:17:17 0 d-------- C:\Users\Emma\AppData\Roaming\LimeWire 2008-05-07 21:14:16 0 d-------- C:\Program Files\Java 2008-04-24 19:42:36 0 d-------- C:\Program Files\iPod 2008-04-24 19:39:36 0 d-------- C:\Program Files\QuickTime 2008-04-17 22:05:33 0 d-------- C:\Program Files\Windows Mail 2008-03-12 21:52:10 0 d-------- C:\Users\Emma\AppData\Roaming\Template 2008-03-12 21:52:06 0 --a------ C:\Users\Emma\AppData\Roaming\wklnhst.dat -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{377C180E-6F0E-4D4C-980F-F45BD3D40CF4}] 26/11/2007 10:46 324936 --a------ c:\PROGRA~1\mcafee\msk\mcapbho.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [24/07/2007 14:26] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [29/09/2006 21:39] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [12/12/2006 03:02] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [12/12/2006 03:03] "Persistence"="C:\Windows\system32\igfxpers.exe" [12/12/2006 03:02] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [17/11/2006 06:58] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [06/03/2007 13:31] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [17/01/2007 07:34] "BigFix"="c:\program files\Bigfix\bigfix.exe" [17/11/2006 01:04] "OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [29/11/2005 19:19] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [18/10/2006 17:14] "TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" [15/08/2007 17:59] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 23:16] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [03/08/2007 23:33] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [28/03/2008 23:37] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [30/03/2008 10:36] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22/02/2008 04:25] "AntiSpywareMaster"="C:\Program Files\AntiSpywareMaster\asm.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [29/11/2005 19:19] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [02/11/2006 13:35] "MSServer"="C:\Users\Emma\AppData\Local\Temp\khfGwVNh.dll,#1" [] "Host Process"="C:\Users\Emma\svchost.exe" [] "cmds"="C:\Users\Emma\AppData\Local\Temp\awTJbXpP.dll,c" [] "44dc4bbc"="C:\Users\Emma\AppData\Local\Temp\agsmfxtw.dll,b" [] "BM47ef7820"="C:\Users\Emma\AppData\Local\Temp\tnqhmukc.dll,s" [] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [06/04/2003 01 58][HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}] @="IEEE 1394 Bus host controllers" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}] @="SBP2 IEEE 1394 Devices" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}] @="SecurityDevices" [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum bthsvcs BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8854107f-9a05-11dc-bb65-00e0b8c51fc1}] AutoRun\command- F:\InstallTomTomHOME.exe [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] C:\Windows\system32\unregmp2.exe /ShowWMP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}] %SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI -- End of Deckard's System Scanner: finished at 2008-05-10 08:33:35 ------------ |
|
     |
|
05-12-2008, 12:01 PM
|
#2 (permalink) |
|
Analyst, Security Team
Join Date: Feb 2005
Location: Eire
Posts: 1,829
OS: XPSP2, Vista
|
Re: Pop ups,new web pages - trojandropper
Hi hodge5975
Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. We also suggest that you Subscribe to this thread to be notified of fixes as soon as they are posted by our Team. You can do this simply by clicking the "Thread Tools" button located in the original thread line and selecting "Subscribe to this Thread". IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. =============================================== Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please take note of instructions for Vista users you will not need to install the recovery console Please ensure you read this guide carefully Save the log from ComboFix when you've accomplished that ================= DSS used an emulation of HJT, I need you to download the proper programe Please download HijackThis to your desktop - this program will help us determine if there are any spyware/malware on your computer. Alternate link Make sure you close down EVERY open window and close ALL browser windows. The only thing that should be open is the HijackThis program. Double-click on the file you just downloaded. Click on the "Install" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis Upon install, HijackThis should open for you. Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe
================= In your next post, please include fresh logs from:
__________________
 Member of UNITE If I have helped you in anyway, please DONATE to TSF Go raibh maith agat Last edited by alba : 05-12-2008 at 12:05 PM. |
|
|
|
|
05-12-2008, 01:12 PM
|
#3 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 6
OS: Vista
|
Re: Pop ups,new web pages - trojandropper
Hi,
I have Windows Vista, so do I need to do the step of using my Windows CD to boot up in the Vista Recovery Environment? And when in that environment how do I access the Combofix program to run it that I have on my desktop? Thanks. |
|
|
|
|
05-12-2008, 01:38 PM
|
#4 (permalink) |
|
Analyst, Security Team
Join Date: Feb 2005
Location: Eire
Posts: 1,829
OS: XPSP2, Vista
|
Re: Pop ups,new web pages - trojandropper
Hi hodge5975
No you would only need that if your pc crashed and failed to start, it is similar in idea to XP recovery console but is more user friendly and already on the Vista disk ======================================= 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. ======================================== Double click on ComboFix.exe & follow the prompts. Note: Do not mouseclick combofix's window while it's running. That may cause it to stall |
|
|
|
|
05-13-2008, 12:16 PM
|
#5 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 6
OS: Vista
|
Re: Pop ups,new web pages - trojandropper
Hi,
I have run everything you specified and it now looks like everything has been fixed. I have not had any websites automatically open or any more pop ups when in internet explorer as I had before the fix. My Combofix and HijackThis logs are pasted below; ComboFix 08-05-11.1 - Emma 2008-05-13 19:43:27.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.297 [GMT 1:00] Running from: C:\Users\Emma\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Windows\system32\pac.txt D:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-04-13 to 2008-05-13 ))))))))))))))))))))))))))))))) . No new files created in this timespan . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-10 07:13 --------- d-----w C:\Program Files\SpywareBlaster 2008-05-09 20:46 --------- d-----w C:\Program Files\Panda Security 2008-05-09 14:46 --------- d-----w C:\Program Files\McAfee 2008-05-08 20:49 --------- d-----w C:\Users\Emma\AppData\Roaming\SiteAdvisor 2008-05-08 19:26 --------- d-----w C:\Program Files\Common Files\McAfee 2008-05-07 20:14 --------- d-----w C:\Program Files\Java 2008-04-24 18:42 --------- d-----w C:\Program Files\iTunes 2008-04-24 18:42 --------- d-----w C:\Program Files\iPod 2008-04-24 18:39 --------- d-----w C:\Program Files\QuickTime 2008-04-24 18:32 --------- d-----w C:\Program Files\Apple Software Update 2008-04-17 21:05 --------- d-----w C:\ProgramData\Microsoft Help 2008-04-17 21:05 --------- d-----w C:\Program Files\Windows Mail 2008-03-12 20:52 0 ----a-w C:\Users\Emma\AppData\Roaming\wklnhst.dat 2008-02-29 04:16 2,027,008 ----a-w C:\Windows\System32\win32k.sys 2008-02-21 04:43 826,368 ----a-w C:\Windows\System32\wininet.dll 2008-02-21 04:43 56,320 ----a-w C:\Windows\System32\iesetup.dll 2008-02-21 04:43 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2008-02-21 04:43 296,448 ----a-w C:\Windows\System32\gdi32.dll 2008-02-21 04:43 26,624 ----a-w C:\Windows\System32\ieUnatt.exe 2008-02-14 20:50 194,560 ----a-w C:\Windows\System32\WebClnt.dll 2008-02-14 20:47 595,456 ----a-w C:\Windows\System32\schedsvc.dll 2008-02-14 20:47 39,424 ----a-w C:\Windows\System32\lodctr.exe 2008-02-14 20:47 32,256 ----a-w C:\Windows\System32\unlodctr.exe 2008-02-14 20:47 23,552 ----a-w C:\Windows\System32\nshhttp.dll 2008-02-14 20:47 17,408 ----a-w C:\Windows\System32\prflbmsg.dll 2008-02-14 20:47 115,200 ----a-w C:\Windows\System32\loadperf.dll 2008-02-14 20:42 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe 2008-02-14 20:42 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe 2008-02-14 20:41 24,064 ----a-w C:\Windows\System32\netcfg.exe 2008-02-14 20:41 22,016 ----a-w C:\Windows\System32\netiougc.exe 2008-02-14 20:41 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll 2008-02-14 20:40 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll 2008-02-14 20:40 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll 2008-02-14 20:40 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll 2008-02-14 20:40 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll 2008-02-14 20:40 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll 2008-02-14 20:40 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll 2008-02-14 20:40 1,686,528 ----a-w C:\Windows\System32\gameux.dll 2007-08-29 17:23 174 --sha-w C:\Program Files\desktop.ini 2008-01-20 16:44 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-01-20 16:44 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-01-20 16:44 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ------- Sigcheck ------- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2005-11-29 19:19 57344] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 13:35 125440] "MSServer"="C:\Users\Emma\AppData\Local\Temp\khfGwVNh.dll" [ ] "Host Process"="C:\Users\Emma\svchost.exe" [ ] "cmds"="C:\Users\Emma\AppData\Local\Temp\awTJbXpP.dll" [2008-05-07 21:17 281088] "44dc4bbc"="C:\Users\Emma\AppData\Local\Temp\yafjwbnu.dll" [2008-05-12 21:08 93696] "BM47ef7820"="C:\Users\Emma\AppData\Local\Temp\davxjukf.dll" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-07-24 14:26 1006264] "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-09-29 21:39 151552] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2006-12-12 03:02 98304] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2006-12-12 03:03 106496] "Persistence"="C:\Windows\system32\igfxpers.exe" [2006-12-12 03:02 81920] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-17 06:58 815104] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-03-06 13:31 240640] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-01-17 07:34 634880] "BigFix"="c:\program files\Bigfix\bigfix.exe" [2006-11-17 01:04 2348584] "OM_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2005-11-29 19:19 40960] "SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2006-10-18 17:14 35928] "TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" [2007-08-15 17:59 374688] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 23:33 582992] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "AntiSpywareMaster"="C:\Program Files\AntiSpywareMaster\asm.exe" [ ] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 01 58 28672][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL "LoadAppInit_DLLs"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.clmp3enc"= C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-42124295-637047048-247919113-1000] "EnableNotificationsRef"=dword:00000002 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-42124295-637047048-247919113-500] "EnableNotificationsRef"=dword:00000002 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{EB11A2F2-3669-4DC9-A3EF-DF51510E8D8A}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{11743E25-D469-44E0-BC6A-C2FA93ACB9C4}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{7A42C88E-C6FA-4338-813A-F92065443DE0}"= UDP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent "{30EADC9C-1C4D-4071-9299-F6ABBAA81ECC}"= TCP:C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:McAfee Network Agent "{EB8B1639-462D-4ACF-8826-4C5B08651C75}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{6160161A-2690-45EB-9CB7-998A9F2EFA13}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{8E489C5D-C236-4CC6-B75A-0A4478607A87}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{9F84CC5F-6EF1-4AA4-8367-6211F0A337C7}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes "{08253D84-DF84-438E-903C-A1D67244D967}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes "{B629DE1D-9D72-41E4-B609-4787659B4064}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire "{71504505-4038-42D6-B407-E88E43CA9CB7}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "DoNotAllowExceptions"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| R0 AFS;AFS;C:\Windows\system32\drivers\AFS.sys [2007-08-17 16:03] R2 VaultClientSRV;BT Auto Backup Service;C:\Program Files\BT Auto Backup\VaultClientSRV.exe [2007-07-04 22:01] R3 igfx;igfx;C:\Windows\system32\DRIVERS\igdkmd32.sys [2006-12-12 03:49] R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 08:30] S3 NETw2v32;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista;C:\Windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 08:30] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8854107f-9a05-11dc-bb65-00e0b8c51fc1}] \shell\AutoRun\command - F:\InstallTomTomHOME.exe *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder "2008-03-12 20:11:09 C:\Windows\Tasks\McDefragTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe' "2008-03-12 20:11:09 C:\Windows\Tasks\McQcTask.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe "2008-05-09 14:45:44 C:\Windows\Tasks\Quick_Clean.job" - c:\PROGRA~1\mcafee\mqc\QcConsol.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-13 19:47:32 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run AntiSpywareMaster = C:\Program Files\AntiSpywareMaster\asm.exe?ws\Temporary Internet Files\Content.IE5\ACI3JWUI\install_asm_en[1].exe?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-13 19:49:44 ComboFix-quarantined-files.txt 2008-05-13 18:49:04 The system cannot find message text for message number 0x2379 in the message file for Application. The system cannot find message text for message number 0x2379 in the message file for Application. 162 --- E O F --- 2008-05-06 19:29:52 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20 51, on 13/05/2008Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16643) Boot mode: Normal Running processes: c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\Program Files\BigFix\bigfix.exe C:\Program Files\SiteAdvisor\6253\SiteAdv.exe C:\Program Files\TomTom HOME 2\HOMERunner.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe C:\Users\Emma\Desktop\HiJackThis.exe c:\PROGRA~1\mcafee\msc\mcuimgr.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://bt.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.h...=PTB&M=MT6833B R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - c:\PROGRA~1\mcafee\msk\mcapbho.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\google\BAE.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [BigFix] c:\program files\Bigfix\bigfix.exe /atstartup O4 - HKLM\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\FirstStart.exe O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [AntiSpywareMaster] C:\Program Files\AntiSpywareMaster\asm.exe O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Host Process] C:\Users\Emma\svchost.exe O4 - Global Startup: hpoddt01.exe.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1210403819466 O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe O23 - Service: BT Auto Backup Service (VaultClientSRV) - Unknown owner - C:\Program Files\BT Auto Backup\VaultClientSRV.exe -- End of file - 7951 bytes Does it look to you from this that I should be fully fixed? Many thanks for your help. |
|
|
|
|
05-13-2008, 02:53 PM
|
#6 (permalink) |
|
Analyst, Security Team
Join Date: Feb 2005
Location: Eire
Posts: 1,829
OS: XPSP2, Vista
|
Re: Pop ups,new web pages - trojandropper
Hi hodge5975
We are nearly there  Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. =============================================== 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. =============================================== Open notepad and carefully copy/paste all the text in the code box below into it: Code:
File:: C:\Users\Emma\svchost.exe C:\Users\Emma\AppData\Local\Temp\awTJbXpP.dll C:\Users\Emma\AppData\Local\Temp\yafjwbnu.dll Folder:: C:\Program Files\AntiSpywareMaster Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSServer"=- "Host Process"=- "cmds"=- "44dc4bbc"=- "BM47ef7820"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AntiSpywareMaster"=-  Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ================================================ Establish an internet connection & perform an online scan with Internet Explorer at one of the following links
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. ================= Please Run a scan with HiJackThis and save the log ================= In your next post, please include fresh logs from:
|
|
|
|
|
05-14-2008, 02:15 PM
|
#7 (permalink) |
|
Registered User
Join Date: May 2008
Posts: 6
OS: Vista
|
Re: Pop ups,new web pages - trojandropper
Hi, I have run the 3 new logs and pasted below. Everything seems to be running normally at the moment. ComboFix 08-05-11.1 - Emma 2008-05-14 18:30:36.2 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.286 [GMT 1:00] Running from: C:\Users\Emma\Desktop\ComboFix.exe Command switches used :: C:\Users\Emma\Desktop\CFScript.txt FILE :: C:\Users\Emma\AppData\Local\Temp\awTJbXpP.dll C:\Users\Emma\AppData\Local\Temp\yafjwbnu.dll C:\Users\Emma\svchost.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Users\Emma\AppData\Local\Temp\awTJbXpP.dll . ((((((((((((((((((((((((( Files Created from 2008-04-14 to 2008-05-14 ))))))))))))))))))))))))))))))) . No new files created in this timespan . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-14 17:29 --------- d-----w C:\ProgramData\Microsoft Help 2008-05-13 20:19 --------- d-----w C:\Users\Emma\AppData\Roaming\McAfee 2008-05-13 20:18 --------- d-----w C:\ProgramData\McAfee 2008-05-10 07:13 --------- d-----w C:\Program Files\SpywareBlaster 2008-05-09 20:46 --------- d-----w C:\Program Files\Panda Security 2008-05-09 14:46 --------- d-----w C:\Program Files\McAfee 2008-05-08 20:49 --------- d-----w C:\Users\Emma\AppData\Roaming\SiteAdvisor 2008-05-08 19:26 --------- d-----w C:\Program Files\Common Files\McAfee 2008-05-07 20:14 --------- d-----w C:\Program Files\Java 2008-04-24 18:42 --------- d-----w C:\Program Files\iTunes 2008-04-24 18:42 --------- d-----w C:\Program Files\iPod 2008-04-24 18:39 --------- d-----w C:\Program Files\QuickTime 2008-04-24 18:32 --------- d-----w C:\Program Files\Apple Software Update 2008-04-17 21:05 --------- d-----w C:\Program Files\Windows Mail 2008-03-12 20:52 0 ----a-w C:\Users\Emma\AppData\Roaming\wklnhst.dat 2008-02-29 04:16 2,027,008 ----a-w C:\Windows\System32\win32k.sys 2008-02-21 04:43 826,368 ----a-w C:\Windows\System32\wininet.dll 2008-02-21 04:43 56,320 ----a-w C:\Windows\System32\iesetup.dll 2008-02-21 04:43 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2008-02-21 04:43 296,448 ----a-w C:\Windows\System32\gdi32.dll 2008-02-21 04:43 26,624 ----a-w C:\Windows\System32\ieUnatt.exe 2008-02-14 20:50 194,560 ----a-w C:\Windows\System32\WebClnt.dll 2008-02-14 20:47 595,456 ----a-w C:\Windows\System32\schedsvc.dll 2008-02-14 20:47 39,424 ----a-w C:\Windows\System32\lodctr.exe 2008-02-14 20:47 32,256 ----a-w C:\Windows\System32\unlodctr.exe 2008-02-14 20:47 23,552 ----a-w C:\Windows\System32\nshhttp.dll 2008-02-14 20:47 17,408 ----a-w C:\Windows\System32\prflbmsg.dll 2008-02-14 20:47 115,200 ----a-w C:\Windows\System32\loadperf.dll 2008-02-14 20:42 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe 2008-02-14 20:42 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe 2008-02-14 20:41 24,064 ----a-w C:\Windows\System32\netcfg.exe 2008-02-14 20:41 22,016 ----a-w C:\Windows\System32\netiougc.exe 2008-02-14 20:41 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll 2008-02-14 20:40 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll 2008-02-14 20:40 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll 2008-02-14 20:40 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll 2008-02-14 20:40 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll 2008-02-14 20:40 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll 2008-02-14 20:40 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll 2008-02-14 20:40 1,686,528 ----a-w C:\Windows\System32\gameux.dll 2007-08-29 17:23 174 --sha-w C:\Program Files\desktop.ini 2008-01-20 16:44 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat 2008-01-20 16:44 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat 2008-01-20 16:44 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat . ------- Sigcheck ------- . ((((((((((((((((((((((((((((( snapshot@2008-05-13_19.48.39.75 ))))))))))))))))))))))))))))))))))))))))) . + 2008-05-13 20:13:24 7,680 ----a-w C:\Windows\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\Accessibility.dll + 2008-05-13 20:18:53 16,384 ----a-w C:\Windows\assembly\GAC\Arbus.Interfacing.Library\1.0.0.27362__2be3a081d8c94867\Arbus.Interfacing.Library.dll + 2008-05-13 20:18:51 16,384 ----a-w C:\Windows\assembly\GAC\ArbusApplicationController\1.0.2563.27362__da57d5d39b1d6dd8\ArbusApplicationController.dll + 2008-05-13 20:13:16 12,288 ----a-w C:\Windows\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\cscompmgd.dll + 2008-05-13 20:13:25 33,792 ----a-w C:\Windows\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\CustomMarshalers.dll + 2008-05-13 20:13:34 7,168 ----a-w C:\Windows\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll + 2008-05-13 20:13:25 32,768 ----a-w C:\Windows\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll + 2008-05-13 20:13:25 4,608 ----a-w C:\Windows\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\IIEHost.dll + 2008-05-13 20:13:25 26,112 ----a-w C:\Windows\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\ISymWrapper.dll + 2008-05-13 20:13:16 716,800 ----a-w C:\Windows\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll + 2008-05-13 20:13:15 28,672 ----a-w C:\Windows\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll + 2008-05-13 20:13:17 299,008 ----a-w C:\Windows\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll + 2008-05-13 20:13:17 6,144 ----a-w C:\Windows\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualC.dll + 2008-05-13 20:13:15 11,264 ----a-w C:\Windows\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll + 2008-05-13 20:13:15 32,768 ----a-w C:\Windows\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll + 2008-05-13 20:13:15 6,656 ----a-w C:\Windows\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll + 2008-05-13 20:13:26 1,564,672 ----a-w C:\Windows\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\mscorcfg.dll + 2008-05-13 20:13:35 32,768 ----a-w C:\Windows\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll + 2008-05-13 20:13:26 77,824 ----a-w C:\Windows\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\System.Configuration.Install.dll + 2008-05-13 20:13:37 299,008 ----a-w C:\Windows\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll + 2008-05-13 20:13:26 1,290,240 ----a-w C:\Windows\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll + 2008-05-13 20:13:27 1,699,840 ----a-w C:\Windows\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll + 2008-05-13 20:13:28 86,016 ----a-w C:\Windows\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll + 2008-05-13 20:13:28 65,536 ----a-w C:\Windows\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.Design.dll + 2008-05-13 20:13:29 466,944 ----a-w C:\Windows\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll + 2008-05-13 20:13:28 241,664 ----a-w C:\Windows\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll + 2008-05-13 20:13:28 64,000 ----a-w C:\Windows\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll + 2008-05-13 20:13:30 368,640 ----a-w C:\Windows\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll + 2008-05-13 20:13:30 241,664 ----a-w C:\Windows\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll + 2008-05-13 20:13:30 323,584 ----a-w C:\Windows\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll + 2008-05-13 20:13:30 131,072 ----a-w C:\Windows\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll + 2008-05-13 20:13:31 77,824 ----a-w C:\Windows\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll + 2008-05-13 20:13:31 126,976 ----a-w C:\Windows\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll + 2008-05-13 20:13:35 819,200 ----a-w C:\Windows\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll + 2008-05-13 20:13:32 57,344 ----a-w C:\Windows\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll + 2008-05-13 20:13:32 569,344 ----a-w C:\Windows\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll + 2008-05-13 20:13:31 1,245,184 ----a-w C:\Windows\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll + 2008-05-13 20:13:33 2,039,808 ----a-w C:\Windows\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll + 2008-05-13 20:13:34 1,335,296 ----a-w C:\Windows\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.Xml.dll + 2008-05-13 20:13:28 1,216,512 ----a-w C:\Windows\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll + 2008-05-13 20:14:31 61,440 ----a-w C:\Windows\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_9bda1b13\CustomMarshalers.dll + 2008-05-13 20:14:38 3,289,088 ----a-w C:\Windows\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_6ddbe14e\mscorlib.dll + 2008-05-13 20:14:48 1,462,272 ----a-w C:\Windows\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_6caf964d\System.Design.dll + 2008-05-13 20:15:02 90,112 ----a-w C:\Windows\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_66091ae3\System.Drawing.Design.dll + 2008-05-13 20:15:04 835,584 ----a-w C:\Windows\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_41b91aa9\System.Drawing.dll + 2008-05-13 20:15:09 2,994,176 ----a-w C:\Windows\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_b3f36722\System.Windows.Forms.dll + 2008-05-13 20:15:12 2,076,672 ----a-w C:\Windows\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_2ba1018c\System.Xml.dll + 2008-05-13 20:15:00 1,929,216 ----a-w C:\Windows\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_0ac4c29d\System.dll - 2008-05-13 17:48:51 67,584 --s-a-w C:\Windows\bootstat.dat + 2008-05-14 17:17:21 67,584 --s-a-w C:\Windows\bootstat.dat + 2007-09-06 18:03:02 4,280,176 ----a-r C:\Windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6215\WRD12CNV.DLL + 2007-08-29 00:07:58 24,928 ----a-r C:\Windows\Installer\$PatchCache$\Managed\00002119F20000000000000000F01FEC\12.0.6215\WRD12EXE.EXE - 2008-04-17 21:05:15 1,165,584 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\accicons.exe + 2008-05-14 17:29:12 1,165,584 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\accicons.exe - 2008-04-17 21:05:15 20,240 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\cagicon.exe + 2008-05-14 17:29:14 20,240 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\cagicon.exe - 2008-04-17 21:05:15 159,504 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\inficon.exe + 2008-05-14 17:29:13 159,504 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\inficon.exe - 2008-04-17 21:05:15 217,864 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\misc.exe + 2008-05-14 17:29:14 217,864 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\misc.exe - 2008-04-17 21:05:15 18,704 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\mspicons.exe + 2008-05-14 17:29:14 18,704 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\mspicons.exe - 2008-04-17 21:05:16 35,088 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\oisicon.exe + 2008-05-14 17:29:14 35,088 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\oisicon.exe - 2008-04-17 21:05:15 845,584 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\outicon.exe + 2008-05-14 17:29:13 845,584 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\outicon.exe - 2008-04-17 21:05:15 922,384 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pptico.exe + 2008-05-14 17:29:14 922,384 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pptico.exe - 2008-04-17 21:05:15 272,648 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pubs.exe + 2008-05-14 17:29:14 272,648 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\pubs.exe - 2008-04-17 21:05:16 888,080 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\wordicon.exe + 2008-05-14 17:29:14 888,080 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\wordicon.exe - 2008-04-17 21:05:15 1,172,240 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\xlicons.exe + 2008-05-14 17:29:13 1,172,240 ----a-r C:\Windows\Installer\{90120000-0011-0000-0000-0000000FF1CE}\xlicons.exe - 2008-04-17 21:04:38 20,240 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe + 2008-05-14 17:27:40 20,240 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe - 2008-04-17 21:04:37 184,080 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe + 2008-05-14 17:27:38 184,080 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe - 2008-04-17 21:04:38 217,864 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe + 2008-05-14 17:27:40 217,864 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe - 2008-04-17 21:04:38 18,704 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe + 2008-05-14 17:27:40 18,704 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe - 2008-04-17 21:04:38 35,088 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe + 2008-05-14 17:27:41 35,088 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe - 2008-04-17 21:04:38 922,384 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe + 2008-05-14 17:27:39 922,384 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe - 2008-04-17 21:04:38 888,080 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe + 2008-05-14 17:27:41 888,080 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe - 2008-04-17 21:04:37 1,172,240 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe + 2008-05-14 17:27:37 1,172,240 ----a-r C:\Windows\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe + 2003-02-21 01:59:44 16,896 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\1033\alinkui.dll + 2003-02-21 02:55:06 94,208 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\1033\cscompui.dll + 2003-02-21 02:02:16 131,072 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\1033\vbc7ui.dll + 2003-02-21 04:04:20 155,648 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\1033\Vsavb7rtUI.dll + 2003-02-21 06:24:08 7,680 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\Accessibility.dll + 2003-02-21 04:00:36 98,304 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\alink.dll + 2003-02-20 18:19:42 24,576 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_filter.dll + 2003-02-20 18:19:32 253,952 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll + 2003-02-20 18:19:22 40,960 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_rc.dll + 2003-02-20 18:19:34 20,480 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe + 2003-02-20 18:19:38 32,768 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe + 2003-02-20 18:19:36 32,768 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe + 2002-07-29 10:11:50 219,136 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\c_g18030.dll + 2003-02-21 06:24:10 94,208 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\CasPol.exe + 2003-02-21 06:24:32 49,152 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe + 2003-02-20 18:09:08 77,824 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll + 2003-02-21 09:20:44 49,152 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\csc.exe + 2003-02-21 09:21:00 626,688 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\cscomp.dll + 2003-02-21 06:24:34 12,288 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\cscompmgd.dll + 2003-02-21 06:24:36 33,792 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\CustomMarshalers.dll + 2003-02-21 03:12:24 28,672 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\cvtres.exe + 2003-02-21 09:21:40 524,288 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\diasymreader.dll + 2003-02-20 18:16:32 798,720 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\EventLogMessages.dll + 2003-02-20 18 20 282,624 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\fusion.dll+ 2003-02-21 06:24:38 7,680 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\IEExec.exe + 2003-02-21 06:24:38 7,168 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll + 2003-02-21 06:24:40 32,768 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\IEHost.dll + 2003-02-21 06:24:40 4,608 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\IIEHost.dll + 2003-02-20 18:09:40 196,608 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\ilasm.exe + 2003-02-21 06:24:42 15,872 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe + 2003-02-20 18:22:24 40,960 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\InstallUtilLib.dll + 2003-02-21 06:24:44 26,112 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\ISymWrapper.dll + 2003-02-21 06:24:52 40,960 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\jsc.exe + 2003-02-21 06:26:36 716,800 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll + 2003-02-21 06:26:38 299,008 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll + 2003-02-21 06:24:54 28,672 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.Vsa.dll + 2003-02-21 06:25:02 6,144 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualC.Dll + 2003-02-21 06:24:58 32,768 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.dll + 2003-02-21 06:25:06 11,264 ----a-w C:\Windows\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.Vb.CodeDOMProcessor.dl |
