|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
10-16-2007, 03:50 PM
|
#1 (permalink) | |
|
Registered User
Join Date: Oct 2007
Location: Karachi
Posts: 33
OS: Windows XP Professional
|
Weird Problem
Hello
I posted my problem with the same topic under general computer security and there Wox mentioned 5 steps for this problem which said do post your problem in this section rather than general security. I m Sorry for wasting your time for looking 2 different threads for solving my problem. Quote:
I hope I have provided everything that you have asked me and hopefully you guys will be able to solve this problem I followed each step and here is what you asked for: I have also attached the results from activescan report. results from Main.txt Deckard's System Scanner v20071014.68 Run by Shams on 2007-10-17 02:30:51 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 9: 2007-10-16 21:30:57 UTC - RP46 - Deckard's System Scanner Restore Point 8: 2007-10-16 16:23:36 UTC - RP45 - Installed Microsoft Office PowerPoint 2003 Template Pack 1 7: 2007-10-15 21:54:08 UTC - RP44 - Installed Vypress Chat 2.1 6: 2007-10-15 04:24:35 UTC - RP43 - System Checkpoint 5: 2007-10-14 01:56:57 UTC - RP42 - System Checkpoint -- First Restore Point -- 1: 2007-10-09 20:41:39 UTC - RP38 - System Checkpoint Backed up registry hives. Performed disk cleanup. Total Physical Memory: 495 MiB (512 MiB recommended). -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2007-10-17 02:33:13 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\explorer.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Symantec AntiVirus\VPTray.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE F:\Softwares\Security Softwares\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.pk/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll (file missing) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {808865C3-1DDA-4B24-85B5-C8E09B3B4E7B} - C:\WINDOWS\system32\dmloade.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SavRoam - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe -- End of file - 6037 bytes -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 ybbnbpzs - c:\windows\system32\drivers\olsshlcu.dat R3 SMBios (Intel (R) System Management BIOS Service) - c:\windows\system32\drivers\smbios.sys <Not Verified; Intel Corporation; Intel (R) System Management BIOS Driver> S3 Ser2pl (Prolific2 Serial port driver) - c:\windows\system32\drivers\ser2pl.sys (file missing) S3 SYMIDSCO - c:\progra~1\common~1\symant~1\symcdata\ids-di~1\20040813.178\symidsco.sys (file missing) S3 usb2vcom (DKU-5 Connectivity Adapter Cable) - c:\windows\system32\drivers\usb2vcom.sys <Not Verified; USB World; USB Data Cable> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R3 ServiceLayer - "c:\program files\pc connectivity solution\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {36FC9E60-C465-11CF-8056-444553540000} Description: USB Mass Storage Device Device ID: USB\VID_041E&PID_4120\0002F9BB3F208A9C Manufacturer: Compatible USB storage device Name: USB Mass Storage Device PNP Device ID: USB\VID_041E&PID_4120\0002F9BB3F208A9C Service: USBSTOR -- Scheduled Tasks ------------------------------------------------------------- 2007-10-15 21:28:00 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2007-09-22 02:31:02 390 --a------ C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1190410111.job -- Files created between 2007-09-17 and 2007-10-17 ----------------------------- 2007-10-17 02  26 0 d-------- C:\Program Files\SpywareBlaster2007-10-17 00:15:12 71 --a------ C:\WINDOWS\system32\pfdnnt_actions.sys 2007-10-17 00:15:12 8704 --a------ C:\WINDOWS\system32\pfdnnt.exe <Not Verified; Panda Software International; Panda Anti-malware> 2007-10-16 21:23:26 0 dr-h----- C:\MSOCache 2007-10-16 07:59:36 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-10-16 02:54:17 0 d-------- C:\Documents and Settings\Shams\Application Data\VyPRESS 2007-10-16 02:54:09 0 d-------- C:\Program Files\Vypress Chat 2007-10-14 01:18:46 106496 --a------ C:\WINDOWS\system32\TwnLib20.dll <Not Verified; Pegasus Software; TWNLIB20> 2007-10-14 01:18:44 364544 -----n--- C:\WINDOWS\system32\TwnLib4.dll <Not Verified; Pegasus Imaging Corp.; TwnLib4> 2007-10-14 01:18:44 471040 -----n--- C:\WINDOWS\system32\ImagXRA7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2007-10-14 01:18:43 262144 -----n--- C:\WINDOWS\system32\ImagXR7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2007-10-14 01:18:43 1568768 -----n--- C:\WINDOWS\system32\ImagX7.dll <Not Verified; Pegasus Imaging Corp.; ImagXpress7> 2007-10-14 01:18:42 38912 -----n--- C:\WINDOWS\system32\picn20.dll <Not Verified; Pegasus Imaging Corp.; PEGASUS> 2007-10-14 01:18:34 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck> 2007-10-14 01:18:34 0 d-------- C:\Program Files\Common Files\Ahead 2007-10-14 01:18:28 0 d-------- C:\Program Files\Ahead 2007-10-11 20:52:51 676224 --a------ C:\WINDOWS\system32\OGACheckControl.dll 2007-10-10 08:42:25 0 d-------- C:\Program Files\AdultPDF 2007-10-09 04:30:33 0 d-------- C:\Documents and Settings\Shams\Application Data\Feedreader 2007-10-09 04:30:26 0 d-------- C:\Program Files\FeedReader30 2007-10-07 04:01:28 0 d--h----- C:\WINDOWS\PIF 2007-10-07 03:53:57 0 --a------ C:\WINDOWS\Infob.dat 2007-10-07 03:53:57 0 --a------ C:\WINDOWS\Infoa.dat 2007-10-07 03:36:28 37376 --a------ C:\WINDOWS\system32\atmpvcn.dll 2007-10-07 03:34:23 37376 --a------ C:\WINDOWS\system32\browsel.dll 2007-10-07 03:18:38 37376 --a------ C:\WINDOWS\system32\Audiode.dll 2007-10-07 03:12:35 0 d-------- C:\Program Files\AliveMedia 2007-10-07 02:27:24 17664 --a------ C:\WINDOWS\system32\drivers\olsshlcu.dat 2007-10-07 02:27:22 5120 --a------ C:\WINDOWS\system32\drivers\hjefqolz.dat 2007-10-07 02:27:21 37376 --a------ C:\WINDOWS\system32\cewmd.dll 2007-10-07 02:26:20 92672 --a------ C:\WINDOWS\system32\dmloade.dll 2007-10-07 00:03:25 17536 --a------ C:\Documents and Settings\Shams\Application Data\GDIPFONTCACHEV1.DAT 2007-10-02 17:25:43 0 d-------- C:\Documents and Settings\Shams\Application Data\Nokia Multimedia Player 2007-10-01 16:33:43 0 d-------- C:\Program Files\SMS-it 2007-10-01 16:33:37 312320 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller> 2007-10-01 16:33:35 0 d-------- C:\Documents and Settings\Shams\WINDOWS 2007-10-01 04:25:36 0 d-------- C:\Documents and Settings\Shams\Phone Browser 2007-10-01 04:17:56 0 d-------- C:\Program Files\Common Files\PCSuite 2007-10-01 04:17:56 0 d-------- C:\Program Files\Common Files\Nokia 2007-10-01 04:16:18 28704 -ra------ C:\WINDOWS\system32\drivers\usb2vcom.sys <Not Verified; USB World; USB Data Cable> 2007-10-01 03:57:26 89728 --a------ C:\WINDOWS\system32\drivers\usbvsp.sys <Not Verified; Atmel Corporation; Atmel USB Serial Adapter> 2007-09-30 20:03:32 0 d-------- C:\Documents and Settings\Shams\Application Data\Apple Computer 2007-09-30 20:03:11 0 d-------- C:\Program Files\iPod 2007-09-30 20:03:06 0 d-------- C:\Program Files\iTunes 2007-09-30 20:02:23 0 d-------- C:\Program Files\QuickTime 2007-09-30 20:02:08 0 d-------- C:\Program Files\Apple Software Update 2007-09-30 20:01:53 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-09-27 18:07:21 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-09-26 16:41:00 3532 --a------ C:\drmHeader.bin 2007-09-23 20:29:47 0 d-------- C:\Program Files\Common Files\xing shared 2007-09-23 20:28:55 0 d-------- C:\Program Files\Common Files\Real 2007-09-23 20:28:18 0 d-------- C:\Program Files\Real 2007-09-23 20:25:47 0 d-------- C:\Documents and Settings\Shams\Application Data\Real 2007-09-23 20:13:33 0 d-------- C:\Documents and Settings\Shams\Application Data\Teleca 2007-09-23 20:13:22 0 d-------- C:\Documents and Settings\Shams\Application Data\Sony Ericsson 2007-09-23 20:04:31 0 d-------- C:\Documents and Settings\All Users\Application Data\Sony Ericsson 2007-09-23 20:04:18 0 d-------- C:\Program Files\Common Files\Teleca Shared 2007-09-23 20:04:17 0 d-------- C:\Program Files\Sony Ericsson 2007-09-23 20:04:17 0 d-------- C:\Documents and Settings\All Users\Application Data\Teleca 2007-09-23 20:03:32 0 d-------- C:\WINDOWS\Downloaded Installations 2007-09-23 17:37:39 0 d-------- C:\Program Files\Total Video Converter 2007-09-23 17:24:50 0 d-------- C:\Download 2007-09-23 17:22:03 0 d-------- C:\Program Files\uTorrent 2007-09-23 17:21:42 0 d-------- C:\Documents and Settings\Shams\Application Data\uTorrent 2007-09-23 16:59:25 0 d-------- C:\WINDOWS\FLV Player 2007-09-23 16:59:25 0 d-------- C:\Program Files\FLV Player 2007-09-23 14:02:35 0 d-------- C:\Documents and Settings\Shams\Application Data\AdobeUM 2007-09-23 14:02:27 0 d-------- C:\Documents and Settings\Shams\Application Data\Adobe 2007-09-23 14:02:26 0 d-------- C:\Program Files\Common Files\Adobe 2007-09-23 03:48:39 0 d-------- C:\Documents and Settings\All Users\Application Data\PC Suite 2007-09-23 03:47:34 0 d-------- C:\Documents and Settings\Shams\Application Data\Nokia 2007-09-23 03:46:47 0 d-------- C:\Program Files\DIFX 2007-09-23 03:46:45 0 d-------- C:\Documents and Settings\Shams\Application Data\PC Suite 2007-09-23 03:46:38 0 d-------- C:\Program Files\PC Connectivity Solution 2007-09-23 03:46:27 0 d-------- C:\Program Files\Nokia 2007-09-23 03:46:01 0 d-------- C:\Documents and Settings\All Users\Application Data\Installations 2007-09-22 22:37:27 0 d-------- C:\Documents and Settings\Shams\Application Data\Yahoo! 2007-09-22 22:29:19 0 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! 2007-09-22 22:21:32 0 d-------- C:\Program Files\Yahoo! 2007-09-22 20:15:25 0 d-------- C:\Program Files\Symantec AntiVirus 2007-09-22 19:55:23 0 d-------- C:\Program Files\Norton AntiVirus 2007-09-22 19:54:57 0 d-------- C:\Documents and Settings\Shams\Application Data\Symantec 2007-09-22 19:54:48 0 d-------- C:\Program Files\Symantec 2007-09-22 19:54:48 0 d-------- C:\Program Files\Common Files\Symantec Shared 2007-09-22 19:54:46 0 d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2007-09-22 19:53:38 0 d-------- C:\WINDOWS\system32\appmgmt 2007-09-22 04:56:55 0 d--hs---- C:\WINDOWS\Installer 2007-09-22 04:56:54 0 d-------- C:\Program Files\Common Files\ODBC 2007-09-22 04:56:50 0 d-------- C:\Program Files\Common Files\SpeechEngines 2007-09-22 04:56:49 0 dr------- C:\Program Files 2007-09-22 04:56:49 0 d-------- C:\Program Files\Common Files 2007-09-22 04:56:21 0 d--h----- C:\Documents and Settings\Default User\Templates 2007-09-22 04:56:21 0 dr------- C:\Documents and Settings\Default User\Start Menu 2007-09-22 04:56:21 0 dr-h----- C:\Documents and Settings\Default User\SendTo 2007-09-22 04:56:21 0 d--h----- C:\Documents and Settings\Default User\Recent 2007-09-22 04:56:21 0 d--h----- C:\Documents and Settings\Default User\PrintHood 2007-09-22 04:56:21 0 d--h----- C:\Documents and Settings\Default User\NetHood 2007-09-22 04:56:21 0 d-------- C:\Documents and Settings\Default User\My Documents 2007-09-22 04:56:21 0 dr-h----- C:\Documents and Settings\Default User\Local Settings 2007-09-22 04:56:21 0 d-------- C:\Documents and Settings\Default User\Favorites 2007-09-22 04:56:21 0 d-------- C:\Documents and Settings\Default User\Desktop 2007-09-22 04:56:21 0 d---s---- C:\Documents and Settings\Default User\Cookies 2007-09-22 04:56:21 0 d--h----- C:\Documents and Settings\All Users\Templates 2007-09-22 04:56:21 0 dr------- C:\Documents and Settings\All Users\Start Menu 2007-09-22 04:56:21 0 d-------- C:\Documents and Settings\All Users\Favorites 2007-09-22 04:56:21 0 dr------- C:\Documents and Settings\All Users\Documents 2007-09-22 04:56:21 0 d-------- C:\Documents and Settings\All Users\Desktop 2007-09-22 04:54:54 0 d-------- C:\WINDOWS\system32\CatRoot2 2007-09-22 04:54:54 0 d-------- C:\WINDOWS\system32\CatRoot 2007-09-22 04:54:48 0 dr-h----- C:\Documents and Settings\Default User\Application Data 2007-09-22 04:54:48 0 d---s---- C:\Documents and Settings\Default User\Application Data\Microsoft 2007-09-22 04:54:48 0 dr-h----- C:\Documents and Settings\All Users\Application Data 2007-09-22 04:54:48 0 d---s---- C:\Documents and Settings\All Users\Application Data\Microsoft 2007-09-22 04:54:20 0 d-------- C:\Documents and Settings 2007-09-22 04:54:19 0 d--hs---- C:\System Volume Information 2007-09-22 04:44:07 0 d-------- C:\WINDOWS 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\WinSxS 2007-09-22 04:44:07 0 dr------- C:\WINDOWS\Web 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\twain_32 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\wins 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\wbem 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\usmt 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\spool 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\ShellExt 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\Setup 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\ras 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\oobe 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\npp 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\mui 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\inetsrv 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\IME 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\icsxml 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\ias 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\export 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\drivers 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\drivers\etc 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\drivers\disdn 2007-09-22 04:44:07 0 dr-hs--c- C:\WINDOWS\system32\dllcache 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\dhcp 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\config 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\3com_dmi 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\3076 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\2052 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\1054 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\1042 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\1041 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\1037 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\1033 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\1031 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\1028 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system32\1025 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\system 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\security 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\Resources 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\repair 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\Provisioning 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\PeerNet 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\pchealth 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\mui 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\msapps 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\msagent 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\Media 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\java 2007-09-22 04:44:07 0 d--h----- C:\WINDOWS\inf 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\ime 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\Help 2007-09-22 04:44:07 0 dr--s---- C:\WINDOWS\Fonts 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\ehome 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\Driver Cache 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\Debug 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\Cursors 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\Connection Wizard 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\Config 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\AppPatch 2007-09-22 04:44:07 0 d-------- C:\WINDOWS\addins 2007-09-22 03:13:01 0 d-------- C:\Program Files\MOBILedit! 2007-09-22 03:10:58 0 d-------- C:\Documents and Settings\Shams\Application Data\DivX 2007-09-22 02:30:50 0 d-------- C:\Documents and Settings\Shams\Application Data\Hewlett-Packard 2007-09-22 02:20:59 16606 -----n--- C:\WINDOWS\hpomdl01.dat 2007-09-22 02:20:59 19558 --a------ C:\WINDOWS\hpoins01.dat 2007-09-22 02:16:01 0 d-------- C:\WINDOWS\system32\NtmsData 2007-09-22 01:52:21 0 d---s---- C:\Documents and Settings\Shams\UserData 2007-09-22 01:36:20 0 d-------- C:\Documents and Settings\Shams\Application Data\Macromedia 2007-09-22 01:32:45 0 d-------- C:\Documents and Settings\Shams\Application Data\Google 2007-09-22 01:32:40 0 d-------- C:\Documents and Settings\All Users\Application Data\Google 2007-09-22 01:25:37 0 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater 2007-09-22 01:25:35 0 d-------- C:\Program Files\Google 2007-09-22 01:20:32 0 d-------- C:\Program Files\Common Files\Hewlett-Packard 2007-09-22 01:19:14 0 d-------- C:\Program Files\Hewlett-Packard 2007-09-22 01:02:26 0 d-------- C:\Documents and Settings\Shams\Contacts 2007-09-22 00:54:39 0 d-------- C:\Program Files\Microsoft ActiveSync 2007-09-22 00:53:21 0 d-------- C:\WINDOWS\ShellNew 2007-09-22 00:51:29 0 d-------- C:\Program Files\DivX 2007-09-22 00:50:04 0 d-------- C:\Program Files\CyberLink 2007-09-22 00:50:04 0 d-------- C:\Documents and Settings\All Users\Application Data\CyberLink 2007-09-22 00:50:01 0 d-------- C:\Program Files\ASUSTek 2007-09-22 00:42:00 1495552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll <Not Verified; PGP Corporation; PGPsdk> 2007-09-22 00:42:00 0 d-------- C:\Program Files\Common Files\Cisco Systems 2007-09-22 00:34:14 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2007-09-22 00:33:19 0 d-------- C:\WINDOWS\Cache 2007-09-22 00:33:15 0 d-------- C:\Documents and Settings\Shams\Application Data\WinRAR 2007-09-22 00:31:14 0 d-------- C:\WINDOWS\RegisteredPackages 2007-09-22 00:30:45 0 d------c- C:\WINDOWS\system32\DRVSTORE 2007-09-22 00:30:36 0 d-------- C:\Program Files\MSN Messenger 2007-09-22 00:27:51 0 d-------- C:\WINDOWS\pss 2007-09-22 00:26:51 0 dr-h----- C:\Documents and Settings\Shams\Recent 2007-09-22 00:24:39 0 d-------- C:\WINDOWS\Drivers 2007-09-22 00:22:17 208896 -----n--- C:\WINDOWS\alcupd.exe <Not Verified; Realtek Semiconductor Corp.; Update Application for Realtek AC'97> 2007-09-22 00:22:17 139264 -----n--- C:\WINDOWS\alcrmv.exe <Not Verified; Realtek Semiconductor Corp.; Realtek AC'97 Removing Tool> 2007-09-22 00:20:43 0 d-------- C:\Program Files\Intel 2007-09-22 00:19:56 0 d-------- C:\WINDOWS\system32\ReinstallBackups 2007-09-22 00:19:55 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-09-22 00:19:53 0 d-------- C:\Program Files\Common Files\InstallShield 2007-09-22 00:19:39 36484 --a------ C:\WINDOWS\system32\drivers\SMBios.sys <Not Verified; Intel Corporation; Intel (R) System Management BIOS Driver> 2007-09-22 00:19:27 0 d-------- C:\TempEI4 2007-09-22 00:17:27 0 d-------- C:\Documents and Settings\Shams\Application Data\Identities 2007-09-22 00:17:07 0 d--h----- C:\Documents and Settings\Shams\Templates 2007-09-22 00:17:07 0 dr------- C:\Documents and Settings\Shams\Start Menu 2007-09-22 00:17:07 0 dr-h----- C:\Documents and Settings\Shams\SendTo 2007-09-22 00:17:07 0 d--h----- C:\Documents and Settings\Shams\PrintHood 2007-09-22 00:17:07 4456448 --ah----- C:\Documents and Settings\Shams\NTUSER.DAT 2007-09-22 00:17:07 0 d--h----- C:\Documents and Settings\Shams\NetHood 2007-09-22 00:17:07 0 d--h----- C:\Documents and Settings\Shams\Local Settings 2007-09-22 00:17:07 0 dr------- C:\Documents and Settings\Shams\Favorites 2007-09-22 00:17:07 0 d-------- C:\Documents and Settings\Shams\Desktop 2007-09-22 00:17:07 0 d---s---- C:\Documents and Settings\Shams\Cookies 2007-09-22 00:17:07 0 dr-h----- C:\Documents and Settings\Shams\Application Data 2007-09-22 00:16:08 0 d-------- C:\WINDOWS\SoftwareDistribution 2007-09-22 00:16:01 0 d-------- C:\WINDOWS\Prefetch 2007-09-22 00:16:00 0 d---s---- C:\WINDOWS\system32\Microsoft 2007-09-22 00:15:59 262144 --ah----- C:\Documents and Settings\LocalService\NTUSER.DAT 2007-09-22 00:15:59 0 d--h----- C:\Documents and Settings\LocalService\Local Settings 2007-09-22 00:15:59 0 d---s---- C:\Documents and Settings\LocalService\Cookies 2007-09-22 00:15:59 0 d-------- C:\Documents and Settings\LocalService\Application Data 2007-09-22 00:15:59 0 d---s---- C:\Documents and Settings\LocalService\Application Data\Microsoft 2007-09-22 00:15:46 225280 --ah----- C:\Documents and Settings\NetworkService\NTUSER.DAT 2007-09-22 00:15:46 0 d--h----- C:\Documents and Settings\NetworkService\Local Settings 2007-09-22 00:15:46 0 d---s---- C:\Documents and Settings\NetworkService\Cookies 2007-09-22 00:15:46 0 d-------- C:\Documents and Settings\NetworkService\Application Data 2007-09-22 00:15:46 0 d---s---- C:\Documents and Settings\NetworkService\Application Data\Microsoft 2007-09-22 00:09:14 0 d-------- C:\WINDOWS\system32\xircom 2007-09-22 00:09:14 0 d-------- C:\Program Files\microsoft frontpage 2007-09-22 00:08:51 225280 ---h----- C:\Documents and Settings\Default User\NTUSER.DAT 2007-09-22 00:08:41 0 -rahs---- C:\MSDOS.SYS 2007-09-22 00:08:41 0 -rahs---- C:\IO.SYS 2007-09-22 00:08:41 0 --a------ C:\CONFIG.SYS 2007-09-22 00:08:41 0 --a------ C:\AUTOEXEC.BAT 2007-09-22 00:07:14 0 d--hs---- C:\Documents and Settings\All Users\DRM 2007-09-22 00 58 0 dr------- C:\WINDOWS\Offline Web Pages2007-09-22 00 58 0 d---s---- C:\WINDOWS\Downloaded Program Files2007-09-22 00 41 0 d--h----- C:\Program Files\WindowsUpdate2007-09-22 00 18 0 d-------- C:\WINDOWS\system32\DirectX2007-09-22 00:05:45 0 d---s---- C:\WINDOWS\Tasks 2007-09-22 00:05:44 0 d-------- C:\Program Files\Common Files\MSSoap 2007-09-22 00:05:40 0 d-------- C:\WINDOWS\srchasst 2007-09-22 00:05:39 0 d-------- C:\WINDOWS\system32\Macromed 2007-09-22 00:05:30 0 d-------- C:\Program Files\Movie Maker 2007-09-22 00:05:22 0 d-------- C:\WINDOWS\system32\Restore 2007-09-22 00:04:32 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat 2007-09-22 00:04:18 0 d-------- C:\WINDOWS\Registration 2007-09-22 00:04:11 0 d-------- C:\Program Files\Online Services 2007-09-22 00:04:06 0 d-------- C:\Program Files\Messenger 2007-09-22 00:04:02 0 d-------- C:\Program Files\MSN Gaming Zone 2007-09-22 00:03:19 0 d-------- C:\Program Files\Windows NT 2007-09-22 00:03:15 0 d-------- C:\WINDOWS\system32\MsDtc 2007-09-22 00:03:13 0 d-------- C:\WINDOWS\system32\Com -- Find3M Report --------------------------------------------------------------- 2007-10-02 18:55:33 8 --a------ C:\Documents and Settings\Shams\Application Data\NMM-MetaData.db 2007-09-22 04:56:21 62 --ahs---- C:\Documents and Settings\Shams\Application Data\desktop.ini -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{808865C3-1DDA-4B24-85B5-C8E09B3B4E7B}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [06/02/2005 09:21 AM] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [06/23/2005 07:27 PM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [09/23/2007 08:28 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [01/19/2007 12:54 PM] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [09/23/2007 05:22 PM] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [09/22/2007 01:25 AM] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoFolderOptions"=0 (0x0) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoFolderOptions"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Vypress Chat StartUp.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Vypress Chat StartUp.lnk backup=C:\WINDOWS\pss\Vypress Chat StartUp.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8a8cb3f2-689b-11dc-bda8-806d6172696f}] AutoRun\command- Nokia_DKU_5.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8b08994f-76dd-11dc-a7b6-00095b07f654}] Auto\command- setup.exe AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a240a776-78ad-11dc-a7c3-00095b07f654}] AutoRun\command- RavMon.exe explore\Command- RavMon.exe -e open\Command- RavMon.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d46c4a48-6a7e-11dc-a76c-00095b07f654}] AutoRun\command- I:\ explore\Command- I:\RECYCLER\INFO.exe open\Command- I:\RECYCLER\INFO.exe -- End of Deckard's System Scanner: finished at 2007-10-17 02:35:55 ------------ |
|
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
10-19-2007, 12:24 AM
|
#2 (permalink) | |
|
Security Team (ret.)
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3
|
Re: Weird Problem
If I:\ is a flash/thumb drive make sure to insert it before running the script.
Please download Combofix from HERE or HERE Save ComboFix to the desktop. Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. It's IMPORTANT to carry out the instructions in the sequence listed below. 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Open *notepad* and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFScript.txt into ComboFix.exe Restart your computer. When finished, it shall produce a log for you at C:\ComboFix.txt Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please. *Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall*
__________________
Eddy Last edited by Pancake; 10-19-2007 at 12:28 AM. |
|
|
|
|
|
10-19-2007, 06:53 AM
|
#3 (permalink) |
|
Registered User
Join Date: Oct 2007
Location: Karachi
Posts: 33
OS: Windows XP Professional
|
Re: Weird Problem
I did everything that you said. there were two problems that occured when windows restarted.
1. There was this error of Generic Host Process for Win32 Services...... 2. In my Security Centre option of "change the way security Centre alerts me" is gone. Please help me also with above 2 problems here is what you asked for: ComboFix 07-10-17.8@ - Shams 2007-10-19 17:36:38.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.253 [GMT 5:00] Running from: C:\Documents and Settings\Shams\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Shams\Desktop\CFScript.txt * Created a new restore point FILE:: C:\WINDOWS\system\atmpvcn.dll C:\WINDOWS\system3\Audiode.dll C:\WINDOWS\system32\browsel.dll C:\WINDOWS\system32\cewmd.dll C:\WINDOWS\system32\d3dr C:\WINDOWS\system32\dmloade.dll I:\RECYCLER\INFO.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\browsel.dll C:\WINDOWS\system32\cewmd.dll . ((((((((((((((((((((((((( Files Created from 2007-09-19 to 2007-10-19 ))))))))))))))))))))))))))))))) . 2007-10-18 23:21 <DIR> d-------- C:\Program Files\RM to MP3 Converter 2007-10-18 23:20 <DIR> d-------- C:\Program Files\Alo RM Converter 2007-10-18 07:55 <DIR> d-------- C:\Program Files\EA Sports 2007-10-18 07:53 <DIR> dr-h----- C:\Documents and Settings\Shams\Application Data\SecuROM 2007-10-18 07:53 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-10-18 07:27 <DIR> d-------- C:\fifa 08 2007-10-18 03:17 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-17 03:30 <DIR> d-------- C:\Program Files\DirectVobSub 2007-10-17 03:13 <DIR> d-------- C:\Program Files\Spyware Doctor 2007-10-17 02:06 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-10-16 21:23 <DIR> dr-h----- C:\MSOCache 2007-10-16 07:59 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-10-16 02:54 <DIR> d-------- C:\Program Files\Vypress Chat 2007-10-16 02:54 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\VyPRESS 2007-10-14 01:18 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-10-14 01:18 <DIR> d-------- C:\Program Files\Ahead 2007-10-14 01:18 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2007-10-14 01:18 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-10-14 01:18 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2007-10-14 01:18 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2007-10-14 01:18 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2007-10-14 01:18 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-10-14 01:18 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-10-14 01:18 38,912 --------- C:\WINDOWS\system32\picn20.dll 2007-10-11 20:52 676,224 --a------ C:\WINDOWS\system32\OGACheckControl.dll 2007-10-10 08:42 <DIR> d-------- C:\Program Files\AdultPDF 2007-10-09 04:30 <DIR> d-------- C:\Program Files\FeedReader30 2007-10-09 04:30 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Feedreader 2007-10-07 04:01 <DIR> d--h----- C:\WINDOWS\PIF 2007-10-07 03:53 0 --a------ C:\WINDOWS\Infob.dat 2007-10-07 03:53 0 --a------ C:\WINDOWS\Infoa.dat 2007-10-07 03:36 37,376 --a------ C:\WINDOWS\system32\atmpvcn.dll 2007-10-07 03:18 37,376 --a------ C:\WINDOWS\system32\Audiode.dll 2007-10-07 03:12 <DIR> d-------- C:\Program Files\AliveMedia 2007-10-07 00:03 17,536 --a------ C:\Documents and Settings\Shams\Application Data\GDIPFONTCACHEV1.DAT 2007-10-02 17:25 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Nokia Multimedia Player 2007-10-01 16:33 <DIR> d-------- C:\Program Files\SMS-it 2007-10-01 16:33 <DIR> d-------- C:\Documents and Settings\Shams\WINDOWS 2007-10-01 16:33 312,320 --a------ C:\WINDOWS\IsUninst.exe 2007-10-01 04:25 <DIR> d-------- C:\Documents and Settings\Shams\Phone Browser 2007-10-01 04:17 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2007-10-01 04:17 <DIR> d-------- C:\Program Files\Common Files\Nokia 2007-10-01 04:16 28,704 -ra------ C:\WINDOWS\system32\drivers\usb2vcom.sys 2007-10-01 03:57 89,728 --a------ C:\WINDOWS\system32\drivers\usbvsp.sys 2007-09-30 20:03 <DIR> d-------- C:\Program Files\iTunes 2007-09-30 20:03 <DIR> d-------- C:\Program Files\iPod 2007-09-30 20:03 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Apple Computer 2007-09-30 20:02 <DIR> d-------- C:\Program Files\QuickTime 2007-09-30 20:02 <DIR> d-------- C:\Program Files\Apple Software Update 2007-09-30 20:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-09-27 18:07 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-09-26 16:41 3,532 --a------ C:\drmHeader.bin 2007-09-23 20:29 <DIR> d-------- C:\Program Files\Common Files\xing shared 2007-09-23 20:28 <DIR> d-------- C:\Program Files\Real 2007-09-23 20:28 <DIR> d-------- C:\Program Files\Common Files\Real 2007-09-23 20:13 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Teleca 2007-09-23 20:13 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Sony Ericsson 2007-09-23 20:04 <DIR> d-------- C:\Program Files\Sony Ericsson 2007-09-23 20:04 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared 2007-09-23 20:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Teleca 2007-09-23 20:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony Ericsson 2007-09-23 20:03 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-09-23 17:37 <DIR> d-------- C:\Program Files\Total Video Converter 2007-09-23 17:24 <DIR> d-------- C:\Download 2007-09-23 17:22 <DIR> d-------- C:\Program Files\uTorrent 2007-09-23 17:21 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\uTorrent 2007-09-23 16:59 <DIR> d-------- C:\WINDOWS\FLV Player 2007-09-23 16:59 <DIR> d-------- C:\Program Files\FLV Player 2007-09-23 14:02 <DIR> d-------- C:\Program Files\Common Files\Adobe 2007-09-23 14:02 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\AdobeUM 2007-09-23 03:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite 2007-09-23 03:47 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Nokia 2007-09-23 03:46 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2007-09-23 03:46 <DIR> d-------- C:\Program Files\Nokia 2007-09-23 03:46 <DIR> d-------- C:\Program Files\DIFX 2007-09-23 03:46 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\PC Suite 2007-09-23 03:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations 2007-09-23 03:46 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2007-09-22 22:37 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Yahoo! 2007-09-22 22:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! 2007-09-22 22:21 <DIR> d-------- C:\Program Files\Yahoo! 2007-09-22 21:57 88,560 -ra------ C:\WINDOWS\system32\drivers\w200mgmt.sys 2007-09-22 21:56 86,368 -ra------ C:\WINDOWS\system32\drivers\w200obex.sys 2007-09-22 21:52 97,056 -ra------ C:\WINDOWS\system32\drivers\w200mdm.sys 2007-09-22 21:52 9,328 -ra------ C:\WINDOWS\system32\drivers\w200mdfl.sys 2007-09-22 21:52 6,208 -ra------ C:\WINDOWS\system32\drivers\w200cmnt.sys 2007-09-22 21:52 6,208 -ra------ C:\WINDOWS\system32\drivers\w200cm.sys 2007-09-22 21:51 61,504 -ra------ C:\WINDOWS\system32\drivers\w200bus.sys 2007-09-22 21:51 5,840 -ra------ C:\WINDOWS\system32\drivers\w200whnt.sys 2007-09-22 21:51 5,840 -ra------ C:\WINDOWS\system32\drivers\w200wh.sys 2007-09-22 20:15 <DIR> d-------- C:\Program Files\Symantec AntiVirus 2007-09-22 20:15 123,488 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-09-22 20:15 91,856 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2007-09-22 19:55 <DIR> d-------- C:\Program Files\Norton AntiVirus 2007-09-22 19:54 <DIR> d-------- C:\Program Files\Symantec 2007-09-22 19:54 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2007-09-22 19:54 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Symantec 2007-09-22 19:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2007-09-22 05:00 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-09-22 05:00 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-18 18:20 90,112 ----a-w C:\WINDOWS\system32\agsaami.dll 2007-10-18 18:20 610,304 ----a-w C:\WINDOWS\system32\agsaamg.dll 2007-10-18 18:20 372,736 ----a-w C:\WINDOWS\system32\agsaamc.dll 2007-10-18 18:20 2,535,424 ----a-w C:\WINDOWS\system32\agsaamj.dll 2007-10-18 18:20 196,608 ----a-w C:\WINDOWS\system32\maag.dll 2007-10-18 18:20 1,986,560 ----a-w C:\WINDOWS\system32\akll.dll 2007-10-18 18:20 1,245,184 ----a-w C:\WINDOWS\system32\bkll.dll 2007-10-18 18:20 1,212,416 ----a-w C:\WINDOWS\system32\ckll.dll 2007-10-16 19:39 --------- d-----w C:\Program Files\MSN Messenger 2007-09-30 22:57 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-09-24 17:07 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-09-21 19:54 --------- d-----w C:\Program Files\Microsoft ActiveSync 2007-09-21 19:51 --------- d-----w C:\Program Files\DivX 2007-09-21 19:50 --------- d-----w C:\Program Files\CyberLink 2007-09-21 19:50 --------- d-----w C:\Program Files\ASUSTek 2007-09-21 19:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink 2007-09-21 19:42 --------- d-----w C:\Program Files\Common Files\Cisco Systems 2007-09-21 19:20 --------- d-----w C:\Program Files\Intel 2007-09-21 19:09 --------- d-----w C:\Program Files\microsoft frontpage . ((((((((((((((((((((((((((((( snapshot@2007-10-18_ 3.25.35.09 ))))))))))))))))))))))))))))))))))))))))) . + 2007-10-18 03:01:58 25,622 ----a-r C:\WINDOWS\Installer\{0A2A5039-B37F-489D-B1DC-A5258DF9E697}\fifapc.exe + 2007-10-18 18:20:18 53,760 ----a-w C:\WINDOWS\system\ppacklib.dll + 2003-08-07 10:01:50 237,568 ----a-w C:\WINDOWS\system32\lame_enc.dll + 2007-04-30 11:32:58 53,248 ----a-w C:\WINDOWS\system32\Macromed\Common\SwSupport.dll + 2007-05-02 07:32:04 182,512 ----a-w C:\WINDOWS\system32\Macromed\Director\SwDir.dll + 2007-04-30 12:11:28 585,728 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\Control.dll + 2007-04-30 11:08:40 1,490,944 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\dirapi.dll + 2007-04-30 11:30:38 24,576 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\DynaPlayer.dll + 2007-04-30 11:05:32 606,208 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\iml32.dll + 2007-04-30 12:11:22 339,968 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\Plugin.dll + 2007-04-30 12:11:24 483,328 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\PluginPing.dll + 2007-04-30 12:11:30 180,224 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\Proj.dll + 2007-05-02 07:31:46 383,216 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\SwHelper_1020022.exe + 2007-04-30 11:33:00 77,824 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\SwInit.exe + 2007-04-30 11:29:00 86,016 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\SwMenu.dll + 2007-04-30 11:33:00 98,304 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\SwOnce.dll + 1999-06-25 05:55:30 149,504 ----a-w C:\WINDOWS\system32\Macromed\Shockwave 10\UNWISE.EXE + 2003-05-21 20:50:42 73,793 ----a-w C:\WINDOWS\system32\RMBin\codecs\atrc.dll + 2004-04-05 18:04:30 548,919 ----a-w C:\WINDOWS\system32\RMBin\codecs\colorcvt.dll + 2004-04-05 18:05:10 65,602 ----a-w C:\WINDOWS\system32\RMBin\codecs\cook.dll + 2004-07-02 11:33:30 102,464 ----a-w C:\WINDOWS\system32\RMBin\codecs\drv1.dll + 2004-07-02 11:33:30 176,195 ----a-w C:\WINDOWS\system32\RMBin\codecs\drv2.dll + 2004-07-02 11:33:30 327,749 ----a-w C:\WINDOWS\system32\RMBin\codecs\drvc.dll + 2005-01-19 11:45:56 376,899 ----a-w C:\WINDOWS\system32\RMBin\codecs\erv2.dll + 2004-04-05 18:07:04 266,306 ----a-w C:\WINDOWS\system32\RMBin\codecs\erv3.dll + 2004-04-05 18:08:06 479,298 ----a-w C:\WINDOWS\system32\RMBin\codecs\erv4.dll + 2004-04-05 18:05:38 548,940 ----a-w C:\WINDOWS\system32\RMBin\codecs\raac.dll + 2004-04-05 18:05:34 155,702 ----a-w C:\WINDOWS\system32\RMBin\codecs\ralf.dll + 2004-04-05 18:05:20 102,465 ----a-w C:\WINDOWS\system32\RMBin\codecs\sipr.dll + 2002-12-06 08:02:58 49,152 ----a-w C:\WINDOWS\system32\RMBin\plugins\auth3260.dll + 2002-12-06 08:02:58 40,960 ----a-w C:\WINDOWS\system32\RMBin\plugins\basc3260.dll + 2004-04-05 18 28 262,204 ----a-w C:\WINDOWS\system32\RMBin\plugins\rmwrtr.dll+ 2002-12-06 08:02:58 45,056 ----a-w C:\WINDOWS\system32\RMBin\plugins\rn5a3260.dll + 2002-12-06 08:02:58 61,440 ----a-w C:\WINDOWS\system32\RMBin\plugins\sdpp3260.dll + 2004-04-05 18:08:10 61,493 ----a-w C:\WINDOWS\system32\RMBin\plugins\smplfsys.dll + 2002-12-06 08:02:58 272,896 ----a-w C:\WINDOWS\system32\RMBin\pncrt.dll + 2004-04-05 18:01:02 53,341 ----a-w C:\WINDOWS\system32\RMBin\tools\audiofmtconverter.dll + 2004-04-05 18:01:08 49,235 ----a-w C:\WINDOWS\system32\RMBin\tools\audiolimiter.dll + 2004-04-05 18:04:14 65,634 ----a-w C:\WINDOWS\system32\RMBin\tools\audiolosslesscodec.dll + 2004-04-05 18:01:16 53,327 ----a-w C:\WINDOWS\system32\RMBin\tools\audiometer.dll + 2004-04-05 18:01:22 327,767 ----a-w C:\WINDOWS\system32\RMBin\tools\audioresampler.dll + 2004-04-05 17:59:18 856,132 ----a-w C:\WINDOWS\system32\RMBin\tools\encsession.dll + 2002-12-06 08:02:58 36,864 ----a-w C:\WINDOWS\system32\RMBin\tools\enlv3260.dll + 2004-04-05 18:01:28 53,325 ----a-w C:\WINDOWS\system32\RMBin\tools\eventpack.dll + 2004-04-05 17:59:38 53,321 ----a-w C:\WINDOWS\system32\RMBin\tools\mediasink.dll + 2004-04-05 18:01:42 57,443 ----a-w C:\WINDOWS\system32\RMBin\tools\mpeg4audiopacketizer.dll + 2004-02-24 04:19:38 548,864 ----a-w C:\WINDOWS\system32\RMBin\tools\rmme3260.dll + 2004-04-05 18:02:18 86,110 ----a-w C:\WINDOWS\system32\RMBin\tools\rmsessionformat.dll + 2004-02-24 04:19:38 356,352 ----a-w C:\WINDOWS\system32\RMBin\tools\rmto3260.dll + 2004-04-05 18:00:30 241,736 ----a-w C:\WINDOWS\system32\RMBin\tools\rmwriter.dll + 2004-04-05 18:03:42 69,718 ----a-w C:\WINDOWS\system32\RMBin\tools\rnaudiocodec.dll + 2004-04-05 18:03:48 77,920 ----a-w C:\WINDOWS\system32\RMBin\tools\rnaudiopacketizer.dll + 2004-04-05 18:04:00 106,582 ----a-w C:\WINDOWS\system32\RMBin\tools\rnvideocodec.dll + 2004-04-05 18:01:46 49,249 ----a-w C:\WINDOWS\system32\RMBin\tools\videocolorconverter.dll + 2004-04-05 18:01:54 45,139 ----a-w C:\WINDOWS\system32\RMBin\tools\videolumaadj.dll - 2007-10-05 05:07:31 279,552 ----a-w C:\WINDOWS\system32\swreg.exe + 2007-04-02 09:21:27 139,776 ----a-w C:\WINDOWS\system32\swreg.exe . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-06-02 09:21] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-06-23 19:27] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2007-09-23 17:22] "Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [2005-01-06 14:04] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-22 01:25] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoFolderOptions"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Vypress Chat StartUp.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Vypress Chat StartUp.lnk backup=C:\WINDOWS\pss\Vypress Chat StartUp.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\DOCUME~1] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\DOCUME~1\Shams] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\DOCUME~1\Shams\LOCALS~1] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\DOCUME~1\Shams\LOCALS~1\Temp] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\DOCUME~1\Shams\LOCALS~1\Temp\FIFA08.exe] C:\DOCUME~1\Shams\LOCALS~1\Temp\FIFA08.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet R3 FA312;NETGEAR FA330/FA312/FA311 Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys S3 usb2vcom;DKU-5 Connectivity Adapter Cable;C:\WINDOWS\system32\DRIVERS\usb2vcom.sys S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8b08994f-76dd-11dc-a7b6-00095b07f654}] Auto\command - setup.exe AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe . Contents of the 'Scheduled Tasks' folder "2007-10-15 16:28:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" "2007-09-21 21:31:02 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1190410111.job" - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-19 17:40:30 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-19 17:42:38 - machine was rebooted C:\ComboFix2.txt ... 2007-10-18 03:26 . --- E O F --- hijackthis log: Logfile of HijackThis v1.99.1 Scan saved at 5:52:14 PM, on 10/19/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\HijackThis\HijackThis.exe O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe regards, |
|
|
|
|
10-19-2007, 03:56 PM
|
#4 (permalink) | |
|
Security Team (ret.)
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3
|
Re: Weird Problem
Just need to run these two and we should then be all done..
Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. It's IMPORTANT to carry out the instructions in the sequence listed below. 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Open *notepad* and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFScript.txt into ComboFix.exe Restart your computer. When finished, it shall produce a log for you at C:\ComboFix.txt Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please. *Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall* ============================= Place a shortcut to Panda ActiveScan on your desktop. Click the Panda ActiveScan shortcut. ** click on "Free use ActiveScan" located on the top right hand corner
__________________
Eddy |
|
|
|
|
|
10-21-2007, 10:46 AM
|
#5 (permalink) |
|
Registered User
Join Date: Oct 2007
Location: Karachi
Posts: 33
OS: Windows XP Professional
|
Re: Weird Problem
I did as you suggested but there occured a problem after 7th stage completion and error was of "sed.cfexe" however all stages were completed even after i clicked "dont send" on that error. this error also appeared at the time when windows was re booted and combofix was preparing an error report, i clicked dont send and after few seconds combofix prepared a log file.
here is combofix log file: ComboFix 07-10-17.8@ - Shams 2007-10-21 21:23:23.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.188 [GMT 5:00] Running from: F:\Softwares\Security Softwares\ComboFix.exe Command switches used :: F:\Softwares\Security Softwares\CFScript.txt * Created a new restore point FILE:: C:\WINDOWS\system32\atmpvcn.dll C:\WINDOWS\system32\Audiode.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Shams\Application Data\installer_en[1].exe C:\WINDOWS\system32\atmpvcn.dll C:\WINDOWS\system32\Audiode.dll . ((((((((((((((((((((((((( Files Created from 2007-09-21 to 2007-10-21 ))))))))))))))))))))))))))))))) . 2007-10-20 06:17 <DIR> d-------- C:\Program Files\Advanced Batch Converter 2007-10-20 02:42 65,536 -ra------ C:\WINDOWS\system32\Audio3D.dll 2007-10-18 23:21 <DIR> d-------- C:\Program Files\RM to MP3 Converter 2007-10-18 23:20 <DIR> d-------- C:\Program Files\Alo RM Converter 2007-10-18 07:55 <DIR> d-------- C:\Program Files\EA Sports 2007-10-18 07:53 <DIR> dr-h----- C:\Documents and Settings\Shams\Application Data\SecuROM 2007-10-18 07:53 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-10-18 07:27 <DIR> d-------- C:\fifa 08 2007-10-18 03:17 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-17 03:30 <DIR> d-------- C:\Program Files\DirectVobSub 2007-10-17 03:13 <DIR> d-------- C:\Program Files\Spyware Doctor 2007-10-17 02:06 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-10-16 21:23 <DIR> dr-h----- C:\MSOCache 2007-10-16 07:59 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-10-16 02:54 <DIR> d-------- C:\Program Files\Vypress Chat 2007-10-16 02:54 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\VyPRESS 2007-10-14 01:18 <DIR> d-------- C:\Program Files\Common Files\Ahead 2007-10-14 01:18 <DIR> d-------- C:\Program Files\Ahead 2007-10-14 01:18 1,568,768 --------- C:\WINDOWS\system32\ImagX7.dll 2007-10-14 01:18 476,320 --------- C:\WINDOWS\system32\ImagXpr7.dll 2007-10-14 01:18 471,040 --------- C:\WINDOWS\system32\ImagXRA7.dll 2007-10-14 01:18 364,544 --------- C:\WINDOWS\system32\TwnLib4.dll 2007-10-14 01:18 262,144 --------- C:\WINDOWS\system32\ImagXR7.dll 2007-10-14 01:18 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe 2007-10-14 01:18 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-10-14 01:18 38,912 --------- C:\WINDOWS\system32\picn20.dll 2007-10-11 20:52 676,224 --a------ C:\WINDOWS\system32\OGACheckControl.dll 2007-10-10 08:42 <DIR> d-------- C:\Program Files\AdultPDF 2007-10-09 04:30 <DIR> d-------- C:\Program Files\FeedReader30 2007-10-09 04:30 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Feedreader 2007-10-07 04:01 <DIR> d--h----- C:\WINDOWS\PIF 2007-10-07 03:53 0 --a------ C:\WINDOWS\Infob.dat 2007-10-07 03:53 0 --a------ C:\WINDOWS\Infoa.dat 2007-10-07 03:12 <DIR> d-------- C:\Program Files\AliveMedia 2007-10-07 00:03 17,536 --a------ C:\Documents and Settings\Shams\Application Data\GDIPFONTCACHEV1.DAT 2007-10-02 17:25 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Nokia Multimedia Player 2007-10-01 16:33 <DIR> d-------- C:\Program Files\SMS-it 2007-10-01 16:33 <DIR> d-------- C:\Documents and Settings\Shams\WINDOWS 2007-10-01 16:33 312,320 --a------ C:\WINDOWS\IsUninst.exe 2007-10-01 04:25 <DIR> d-------- C:\Documents and Settings\Shams\Phone Browser 2007-10-01 04:17 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2007-10-01 04:17 <DIR> d-------- C:\Program Files\Common Files\Nokia 2007-10-01 04:16 28,704 -ra------ C:\WINDOWS\system32\drivers\usb2vcom.sys 2007-10-01 03:57 89,728 --a------ C:\WINDOWS\system32\drivers\usbvsp.sys 2007-09-30 20:03 <DIR> d-------- C:\Program Files\iTunes 2007-09-30 20:03 <DIR> d-------- C:\Program Files\iPod 2007-09-30 20:03 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Apple Computer 2007-09-30 20:02 <DIR> d-------- C:\Program Files\QuickTime 2007-09-30 20:02 <DIR> d-------- C:\Program Files\Apple Software Update 2007-09-30 20:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-09-27 18:07 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-09-26 16:41 3,532 --a------ C:\drmHeader.bin 2007-09-23 20:29 <DIR> d-------- C:\Program Files\Common Files\xing shared 2007-09-23 20:28 <DIR> d-------- C:\Program Files\Real 2007-09-23 20:28 <DIR> d-------- C:\Program Files\Common Files\Real 2007-09-23 20:13 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Teleca 2007-09-23 20:13 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Sony Ericsson 2007-09-23 20:04 <DIR> d-------- C:\Program Files\Sony Ericsson 2007-09-23 20:04 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared 2007-09-23 20:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Teleca 2007-09-23 20:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony Ericsson 2007-09-23 20:03 <DIR> d-------- C:\WINDOWS\Downloaded Installations 2007-09-23 17:37 <DIR> d-------- C:\Program Files\Total Video Converter 2007-09-23 17:24 <DIR> d-------- C:\Download 2007-09-23 17:22 <DIR> d-------- C:\Program Files\uTorrent 2007-09-23 17:21 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\uTorrent 2007-09-23 16:59 <DIR> d-------- C:\WINDOWS\FLV Player 2007-09-23 16:59 <DIR> d-------- C:\Program Files\FLV Player 2007-09-23 14:02 <DIR> d-------- C:\Program Files\Common Files\Adobe 2007-09-23 14:02 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\AdobeUM 2007-09-23 03:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite 2007-09-23 03:47 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Nokia 2007-09-23 03:46 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2007-09-23 03:46 <DIR> d-------- C:\Program Files\Nokia 2007-09-23 03:46 <DIR> d-------- C:\Program Files\DIFX 2007-09-23 03:46 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\PC Suite 2007-09-23 03:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations 2007-09-23 03:46 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2007-09-22 22:37 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Yahoo! 2007-09-22 22:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! 2007-09-22 22:21 <DIR> d-------- C:\Program Files\Yahoo! 2007-09-22 21:57 88,560 -ra------ C:\WINDOWS\system32\drivers\w200mgmt.sys 2007-09-22 21:56 86,368 -ra------ C:\WINDOWS\system32\drivers\w200obex.sys 2007-09-22 21:52 97,056 -ra------ C:\WINDOWS\system32\drivers\w200mdm.sys 2007-09-22 21:52 9,328 -ra------ C:\WINDOWS\system32\drivers\w200mdfl.sys 2007-09-22 21:52 6,208 -ra------ C:\WINDOWS\system32\drivers\w200cmnt.sys 2007-09-22 21:52 6,208 -ra------ C:\WINDOWS\system32\drivers\w200cm.sys 2007-09-22 21:51 61,504 -ra------ C:\WINDOWS\system32\drivers\w200bus.sys 2007-09-22 21:51 5,840 -ra------ C:\WINDOWS\system32\drivers\w200whnt.sys 2007-09-22 21:51 5,840 -ra------ C:\WINDOWS\system32\drivers\w200wh.sys 2007-09-22 20:15 <DIR> d-------- C:\Program Files\Symantec AntiVirus 2007-09-22 20:15 123,488 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-09-22 20:15 91,856 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2007-09-22 19:55 <DIR> d-------- C:\Program Files\Norton AntiVirus 2007-09-22 19:54 <DIR> d-------- C:\Program Files\Symantec 2007-09-22 19:54 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2007-09-22 19:54 <DIR> d-------- C:\Documents and Settings\Shams\Application Data\Symantec 2007-09-22 19:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2007-09-22 05:00 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2007-09-22 05:00 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-18 18:20 90,112 ----a-w C:\WINDOWS\system32\agsaami.dll 2007-10-18 18:20 610,304 ----a-w C:\WINDOWS\system32\agsaamg.dll 2007-10-18 18:20 372,736 ----a-w C:\WINDOWS\system32\agsaamc.dll 2007-10-18 18:20 2,535,424 ----a-w C:\WINDOWS\system32\agsaamj.dll 2007-10-18 18:20 196,608 ----a-w C:\WINDOWS\system32\maag.dll 2007-10-18 18:20 1,986,560 ----a-w C:\WINDOWS\system32\akll.dll 2007-10-18 18:20 1,245,184 ----a-w C:\WINDOWS\system32\bkll.dll 2007-10-18 18:20 1,212,416 ----a-w C:\WINDOWS\system32\ckll.dll 2007-10-16 19:39 --------- d-----w C:\Program Files\MSN Messenger 2007-09-30 22:57 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-09-24 17:07 --------- d-----w C:\Program Files\Common Files\InstallShield 2007-09-21 19:54 --------- d-----w C:\Program Files\Microsoft ActiveSync 2007-09-21 19:51 --------- d-----w C:\Program Files\DivX 2007-09-21 19:50 --------- d-----w C:\Program Files\CyberLink 2007-09-21 19:50 --------- d-----w C:\Program Files\ASUSTek 2007-09-21 19:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink 2007-09-21 19:42 --------- d-----w C:\Program Files\Common Files\Cisco Systems 2007-09-21 19:20 --------- d-----w C:\Program Files\Intel 2007-09-21 19:09 --------- d-----w C:\Program Files\microsoft frontpage . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2005-06-02 09:21] "vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2005-06-23 19:27] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-23 20:28] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54] "uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2007-09-23 17:22] "Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [2005-01-06 14:04] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-22 01:25] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoFolderOptions"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Vypress Chat StartUp.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Vypress Chat StartUp.lnk backup=C:\WINDOWS\pss\Vypress Chat StartUp.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\DOCUME~1] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\DOCUME~1\Shams] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\DOCUME~1\Shams\LOCALS~1] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\DOCUME~1\Shams\LOCALS~1\Temp] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\C:\DOCUME~1\Shams\LOCALS~1\Temp\FIFA08.exe] C:\DOCUME~1\Shams\LOCALS~1\Temp\FIFA08.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] C:\WINDOWS\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet R3 FA312;NETGEAR FA330/FA312/FA311 Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys S3 usb2vcom;DKU-5 Connectivity Adapter Cable;C:\WINDOWS\system32\DRIVERS\usb2vcom.sys S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8b08994f-76dd-11dc-a7b6-00095b07f654}] Auto\command - setup.exe AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL setup.exe . Contents of the 'Scheduled Tasks' folder "2007-10-15 16:28:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" "2007-09-21 21:31:02 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1190410111.job" - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-21 21:27:58 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-21 21:30:58 - machine was rebooted C:\ComboFix2.txt ... 2007-10-19 17:42 C:\ComboFix3.txt ... 2007-10-18 03:26 . --- E O F --- Here is fresh hijackthis log: Logfile of HijackThis v1.99.1 Scan saved at 9:32:26 PM, on 10/21/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\SYMANT~1\VPTray.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\uTorrent\uTorrent.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\HijackThis\HijackThis.exe O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe |
|
|
|
|
10-22-2007, 02:32 PM
|
#7 (permalink) |
|
Registered User
Join Date: Oct 2007
Location: Karachi
Posts: 33
OS: Windows XP Professional
|
Re: Weird Problem
Hello Pancake,
Thank you so much for helping me through out this weird problem and really appreciate that:) Yes problem of redirecting me to some other site from search engine is solved. But there is a error that keeps coming "generic host ...." I don't know what to do for that. Now that you have seen details of my PC, suggest me the softwares that will protect me from any kind of security threats now. Take Care and thanks alot for solving this problem. |
|
|
|
|
10-22-2007, 04:09 PM
|
#8 (permalink) |
|
Security Team (ret.)
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3
|
Re: Weird Problem
Try this for that host problem....
Download the program HostsXpert When it opens, click on the Restore Original Hosts button and then exit Hoster. =========================================== Now that you are clean,and If you wish to do so, here are a few things that you can do that will help keep your computer a bit more clean and secure..they can be done at your leisure. THESE STEPS ARE VERY IMPORTANT (ITEM 1) Let's reset system restore Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points. A To disable the System Restore feature: 1. Click on the Start button. 2. Go to My Computer icon on the desktop, right click on it and then click Properties. 3. On the left hand side, click Advanced Settings. 4. If asked to permit the action, click on Allow. 5. Click on the System Protection tab. 6. Uncheck any checkboxes listed for your hard drives. 7. Press OK. B. Reboot. C Turn ON System Restore. Follow the steps like you did when disabling system restore but on step 6. check any checkboxes listed for your hard drives. ======================================== ( ITEM 2) Download and scan with CCleaner 1. Starting with v1.27.260, CCleaner installs the Yahoo Toolbar as an option which IS checkmarked by default during the installation. IF you do NOT want it, REMOVE the checkmark when provided with the option OR download the toolbar-free Basic or Slim versions instead of the Standard Build. 2. Before first use, select Options > Advanced and UNCHECK "Only delete files in Windows Temp folder older than 48 hours" 3. Then select the items you wish to clean up. In the Windows Tab: • Clean all entries in the "Internet Explorer" section except Cookies. • Clean all the entries in the "Windows Explorer" section. • Clean all entries in the "System" section. • Clean all entries in the "Advanced" section. • Clean any others that you choose. In the Applications Tab: • Clean all except cookies in the Firefox/Mozilla section if you use it. • Clean all in the Opera section if you use it. • Clean Sun Java in the Internet Section. • Clean any others that you choose. 4. Click the "Run Cleaner" button. 5. A pop up box will appear advising this process will permanently delete files from your system. 6. Click "OK" and it will scan and clean your system. 7. Click "exit" when done. ========================================= Is your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version if required. Updating Java: Download the latest version of Java Runtime Environment (JRE) 6u3 (http://java.sun.com/javase/downloads/index.jsp). Scroll down to where it says The J2SE Runtime Environment (JRE) allows end-users to run Java applications. Click the Download button to the right. Check the box that says: Accept License Agreement. The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-6u2-windows-i586-p.exe to install the newest version. UPDATING WINDOWS AND INTERNET EXPLORER IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site (http://windowsupdate.microsoft.com/) to get the critical updates. If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update. Make your Internet Explorer more secure This can be done by following these simple instructions: From within Internet Explorer click on the Tools menu and then click on Options. Click once on the Security tab Click once on the Internet icon so it becomes highlighted. Click once on the Custom Level button. Change the Download signed ActiveX controls to Prompt Change the Download unsigned ActiveX controls to Disable Change the Initialize and script ActiveX controls not marked as safe to Disable Change the Installation of desktop items to Prompt Change the Launching programs and files in an IFRAME to Prompt Change the Navigate sub-frames across different domains to Prompt When all these settings have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button. Next press the Apply button and then the OK to exit the Internet Properties page. ======================================================== The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item. Download SpywareBlaster Spyware blaster is a program that stops known malicious activex controls from installing on your computer. It works by changing settings in your registry. It makes kill bits in the registry, so that certain activex controls can't install. If you don't know what activex controls are, see here (http://www.webopedia.com/TERM/A/ActiveX_control.html) You can download SpywareBlaster here here (http://majorgeeks.com/downloadget.ph...7615f4682b4cef) SpywareBlaster tutorial (http://www.bleepingcomputer.com/forums/tutorial49.html) Download iespyad It puts many bad webpages on your restricted zones list. This means that you can still view the bad webpages, but the webpages cannot do certain things (such as use javascripts and cookies). Download it here (http://www.spywarewarrior.com/uiuc/res/ie-spyad.exe) hosts file: Every version of windows has a hosts file as part of them. In a very basic sense, they are used to locate webpages. We can customize a hosts file so that it blocks certain webpages. However, it can slow down certain computers. This is why using a hosts file is optional!! Download it here (http://www.mvps.org/winhelp2002/hosts.htm). Make sure you read the instructions on how to install the hosts file. There is a good tutorial here (http://www.bleepingcomputer.com/forums/tutorial51.html) If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps: Click the start button (at the lower left hand corner of your screen) Click run In the dialog box, type services.msc hit enter, then locate dns client Highlight it, then double-click it. On the dropdown box, change the setting from automatic to manual. Click ok Keep Anti Virus Software updated - Most AVs will update automatically, but if not I would recommend making updating the AV the first job every time the PC is connected to the internet. An AV that is using defs that are seven days old is not going to be much protection. If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out. See here (http://www.snapfiles.com/Freeware/security/fwvirus.html) to choose one. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For more info, check this (http://www.bleepingcomputer.com/forums/tutorial60.html) webpage out. Here (http://www.snapfiles.com/Freeware/se...wfirewall.html) are some Vista compatible firewalls also. Know What You're Installing Check the source. To avoid malware, make sure your software comes from a reputable source. Be particularly suspicious of sponsored software (software that relies on advertising) or software that claims to speed up your Internet connection. Use Custom Install. If you feel comfortable with software installation, you can choose Custom Install (as opposed to Typical Install). Custom Install allows you to select only the software components you wish to install, and leave out others (such as potential spyware). Modify Security Settings (Internet Explorer 6) To reduce the risk of installing malware, you can set Internet Explorer to high security mode. To do so: Open Internet Explorer. Go to Tools > Internet Options…. On the Internet Options screen, select the Security tab, then select the Internet icon (if it is not already selected). Under Security level for this zone, click Default Level. Set the slider to High. Note: You may have to lower the security level to view certain Web sites. Next, select the Trusted Sites icon. Under Security level for this zone, click Default Level. Set the slider to Medium. Click Apply, then OK to save the changes. Before using or purchasing any Spyware/Malware protection/removal program, always check the Rogue/Suspect Spyware List. It will save you a lot of grief, as well as money if you are thinking of purchasing. Here is the link: http://www.spywarewarrior.com/rogue_anti-spyware.htm If you want to know just how effective your anti-spyware program is, or how well any of the "rogue" programs listed at the above link work, check this for an independent comparison of several anti-spyware programs: http://www.spywarewarrior.com/asw-test-guide.htm Let us know if we have not resolved your problem. Otherwise, you are good to go. Happy and Safe Surfing!
__________________
Eddy |
|
|
|
|
10-24-2007, 05:22 PM
|
#11 (permalink) |
|
Registered User
Join Date: Oct 2007
Location: Karachi
Posts: 33
OS: Windows XP Professional
|
Re: Weird Problem
I did as you directed but the error keeps coming atleast once after I turn on my PC.
Apart from this Problem of Spyware is Solved but I really need a solution for this generic host problem Thanks Regards, |
|
|
|
|
10-28-2007, 09:01 AM
|
#14 (permalink) |
|
Registered User
Join Date: Oct 2007
Location: Karachi
Posts: 33
OS: Windows XP Professional
|
Re: Weird Problem
Thank you So really much for all the time and effort that you had put in solving my problems of PC:):)
Generic Host Problem is gone Now:) Thank you once again for all the help:) Regards, Khaliq Uz Zaman Shaikh |
|
|
|
| Thread Tools | |
|
|
