|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
05-11-2008, 08:23 PM
|
#1 (permalink) |
|
Registered User
Join Date: Oct 2007
Location: ohio
Posts: 12
OS: xp
|
Warning! Your're in danger - need help
I have followed the five steps for hjt log submission, hope I've got this all right...
The only piece I could not do was remove "My Way Search Assistant" from installed programs - it does not have the add/remove option in the add remove programs panel... I run Avast and have run adaware, which I'm looking to replace - maybe spyblaster does that? What happened to me is that I clicked on something I cannot remember, and shortly thereafter I got the desktop message pasted that WARNING! Your're in danger! etc... I now have a "Warning: Your computer is infected" message coming up from a bottom of the screen lower right multi colored shield, which points me to http://pcsafetysupply.com/remove_spy...hp?affid=7f0iu to "fix" it. I am also getting Canadian Pharmacy pop-ups, and Adult Friend Finder - this is a bad link, we're sorry pop-ups. I had a guest account which I turned off based on some post. I have one other account left on the pc, which I checked to see if it was getting the same problems. It was not. After a couple more logons, it started having all the same problems. Here is the main.txt file output: Deckard's System Scanner v20071014.68 Run by Dad on 2008-05-11 22:00:08 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 62: 2008-05-12 02:00:15 UTC - RP1156 - Deckard's System Scanner Restore Point 61: 2008-05-10 16:44:56 UTC - RP1155 - System Checkpoint 60: 2008-05-09 15:36:47 UTC - RP1154 - System Checkpoint 59: 2008-05-08 05:39:30 UTC - RP1153 - System Checkpoint 58: 2008-05-07 05:15:30 UTC - RP1152 - System Checkpoint -- First Restore Point -- 1: 2008-03-13 07:58:45 UTC - RP1095 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as Dad.exe) ------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:02:10 PM, on 5/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\brss01a.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Brother\ControlCenter2\brctrcen.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\sysxhtcwbse.exe C:\WINDOWS\syssfzvakqg.exe C:\WINDOWS\sysyeabdgfp.exe C:\WINDOWS\sysvtypkbjx.exe C:\WINDOWS\sysqrnxstju.exe C:\Program Files\DellSupport\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\FinePixViewer\QuickDCF.exe C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe C:\Program Files\Brother\Brmfcmon\BrMfimon.exe C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe C:\Documents and Settings\Dad\Desktop\dss.exe C:\DOCUME~1\Dad\MYDOCU~1\HIJACK~1\Dad.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sports.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: NetGuideBHO Class - {0FD7DAF0-BBEF-4990-B19E-2805D280571F} - C:\PROGRA~1\NetGuide\BHO\NETGUI~1.DLL (file missing) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [OSCD_Creator] c:\Dell\PreODM.EXE O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [{2C70168B-97CE-4f31-B85D-1FEC5002721D}] "C:\WINDOWS\sysxhtcwbse.exe" O4 - HKLM\..\Run: [{78B578D7-BCE1-4d83-9CD4-195BC34D8CB3}] "C:\WINDOWS\syssfzvakqg.exe" O4 - HKLM\..\Run: [{F758F78B-0885-490e-AA3C-4A38D28B0240}] "C:\WINDOWS\sysyeabdgfp.exe" O4 - HKLM\..\Run: [1234klsjdc uiar924c af] "C:\WINDOWS\sysvtypkbjx.exe" O4 - HKLM\..\Run: [{A4C928E8-0ABA-4fd3-83DF-23BE54ADF9A4}] "C:\WINDOWS\sysqrnxstju.exe" O4 - HKLM\..\RunOnce: [OSCD_Creator] C:\Dell\PreODM.EXE /2 O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Exif Launcher.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - http://www.stonyfield.com/coupons/scriptX/smsx.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- End of file - 7996 bytes -- HijackThis Fixed Entries (C:\DOCUME~1\Dad\MYDOCU~1\HIJACK~1\backups\) ------- backup-20080508-193816-436 O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/A...oadcontrol.cab backup-20080508-193816-658 O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} (cpbrkpie Control) - http://a19.g.akamai.net/7/19/7125/40...02/Coupons.cab backup-20080508-193816-667 O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} (CBSTIEPrint Class) - http://offers.e-centives.com/cif/dow...in/actxcab.cab backup-20080508-193817-229 O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver> R2 MASPINT - c:\windows\system32\drivers\maspint.sys <Not Verified; MicroStaff Co.,Ltd.; Aspi32 Driver for WinNT> R3 DSproct - c:\program files\dellsupport\gtaction\triggers\dsproct.sys <Not Verified; Gteko Ltd.; processt> S3 wanatw (WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> R2 sprtsvc_dellsupportcenter (SupportSoft Sprocket Service (dellsupportcenter)) - c:\program files\dell support center\bin\sprtsvc.exe /service /p dellsupportcenter -- Device Manager: Disabled ---------------------------------------------------- No disabled devices found. -- Scheduled Tasks ------------------------------------------------------------- 2008-05-09 18:30:00 350 --a------ C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (D34WBP61-Momma).job 2008-05-05 18:24:02 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2008-04-11 and 2008-05-11 ----------------------------- 2008-05-10 11:45:33 0 d-------- C:\ie-spyad_zo 2008-05-10 11:01:59 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-10 11:01:51 0 d-------- C:\Program Files\SpywareBlaster 2008-05-09 21:45:13 0 d-------- C:\Program Files\Panda Security 2008-05-09 17  14 0 d-------- C:\Program Files\SysCleaner2008-05-09 15:58:34 0 d-------- C:\Program Files\Yahoo! Games 2008-05-08 18:52:06 3072 --a------ C:\WINDOWS\zysjgpcfrbn.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2008-05-08 18:52:06 1409 --a------ C:\WINDOWS\zysauqdhnyc.exe 2008-05-08 18:52:05 84032 --a------ C:\WINDOWS\sysyeabdgfp.exe 2008-05-08 18:52:05 73280 --a------ C:\WINDOWS\sysxhtcwbse.exe 2008-05-08 18:52:05 81984 --a------ C:\WINDOWS\sysvtypkbjx.exe 2008-05-08 18:52:05 85056 --a------ C:\WINDOWS\syssfzvakqg.exe 2008-05-08 18:52:05 80448 --a------ C:\WINDOWS\sysqrnxstju.exe 2008-04-21 01:05:19 0 d-------- C:\Documents and Settings\Guest\Application Data\Viewpoint -- Find3M Report --------------------------------------------------------------- 2008-05-09 16:05:16 0 d-------- C:\Program Files\FrostWire 2008-04-19 14:29:55 0 d-------- C:\Program Files\Apple Software Update 2008-04-04 19:23:29 0 d-------- C:\Program Files\iTunes 2008-04-04 19:22:44 0 d-------- C:\Program Files\iPod 2008-04-04 19:17:27 0 d-------- C:\Program Files\QuickTime 2008-04-01 12:54:06 0 d-------- C:\Program Files\Common Files 2008-04-01 12:54:06 0 d-------- C:\Program Files\Common Files\xing shared 2008-04-01 12:53:57 0 d-------- C:\Program Files\Common Files\Real 2008-03-28 18:44:10 0 d-------- C:\Program Files\Java 2008-03-11 20:27:40 0 d-------- C:\Program Files\Skype 2008-03-11 20:27:37 0 d-------- C:\Program Files\Common Files\Skype -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0FD7DAF0-BBEF-4990-B19E-2805D280571F}] C:\PROGRA~1\NetGuide\BHO\NETGUI~1.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OSCD_Creator"="c:\Dell\PreODM.EXE" [10/31/2004 07:21 AM] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [11/20/2001 12:10 AM] "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [02/04/2002 10:32 PM] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [03/29/2008 02:37 PM] "ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [07/20/2004 10:34 AM] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [10/14/2005 02:49 PM] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [10/14/2005 02:46 PM] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [10/14/2005 02:50 PM] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [03/09/2007 11:09 AM] "Logitech Utility"="Logi_MwX.Exe" [12/17/2003 09:50 AM C:\WINDOWS\LOGI_MWX.EXE] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [10/09/2007 07:57 PM] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04/01/2008 12:53 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [03/28/2008 11:37 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM] "{2C70168B-97CE-4f31-B85D-1FEC5002721D}"="C:\WINDOWS\sysxhtcwbse.exe" [05/08/2008 06:52 PM] "{78B578D7-BCE1-4d83-9CD4-195BC34D8CB3}"="C:\WINDOWS\syssfzvakqg.exe" [05/08/2008 06:52 PM] "{F758F78B-0885-490e-AA3C-4A38D28B0240}"="C:\WINDOWS\sysyeabdgfp.exe" [05/08/2008 06:52 PM] "1234klsjdc uiar924c af"="C:\WINDOWS\sysvtypkbjx.exe" [05/08/2008 06:52 PM] "{A4C928E8-0ABA-4fd3-83DF-23BE54ADF9A4}"="C:\WINDOWS\sysqrnxstju.exe" [05/08/2008 06:52 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [03/15/2007 11:09 AM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 07:00 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] "OSCD_Creator"=C:\Dell\PreODM.EXE /2 C:\Documents and Settings\Dad\Start Menu\Programs\Startup\ DESKTOP.INI [8/10/2004 3:04:12 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DESKTOP.INI [8/10/2004 3:04:12 PM] Exif Launcher.lnk - C:\Program Files\FinePixViewer\QuickDCF.exe [7/16/2005 7:39:19 AM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2/17/1999 4:05:56 PM] Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2/14/2006 3:57:48 PM] -- End of Deckard's System Scanner: finished at 2008-05-11 22:02:42 ------------ Here is the extra.txt file output: Deckard's System Scanner v20071014.68 Extra logfile - please post this as an attachment with your post. -------------------------------------------------------------------------------- -- System Information ---------------------------------------------------------- Microsoft Windows XP Home Edition (build 2600) SP 2.0 Architecture: X86; Language: English CPU 0: Intel(R) Pentium(R) 4 CPU 3.00GHz CPU 1: Intel(R) Pentium(R) 4 CPU 3.00GHz Percentage of Memory in Use: 49% Physical Memory (total/avail): 1014.07 MiB / 516.31 MiB Pagefile Memory (total/avail): 1930.17 MiB / 1571.63 MiB Virtual Memory (total/avail): 2047.88 MiB / 1929.9 MiB C: is Fixed (NTFS) - 34.44 GiB total, 10.06 GiB free. D: is CDROM (No Media) \\.\PHYSICALDRIVE0 - ST340014AS - 37.25 GiB - 3 partitions \PARTITION0 - Unknown - 47.03 MiB \PARTITION1 (bootable) - Installable File System - 34.44 GiB - C: \PARTITION2 - Unknown - 2.75 GiB -- Security Center ------------------------------------------------------------- AUOptions is scheduled to auto-install. Windows Internal Firewall is enabled. FirstRunDisabled is set. AV: avast! antivirus 4.8.1169 [VPS 080511-0] v4.8.1169 (ALWIL Software) [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:America Online 9.0" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:America Online 9.0" "C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD:*:Enabled:Age of Empires II" "C:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe"="C:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe:*:Disabled:Rise of Nations" "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Disabled:AOL Instant Messenger" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\FrostWire\\FrostWire.exe"="C:\\Program Files\\FrostWire\\FrostWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:eBay - Skype" -- Environment Variables ------------------------------------------------------- ALLUSERSPROFILE=C:\Documents and Settings\All Users APPDATA=C:\Documents and Settings\Dad\Application Data CLASSPATH=.;C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip CommonProgramFiles=C:\Program Files\Common Files COMPUTERNAME=D34WBP61 ComSpec=C:\WINDOWS\system32\cmd.exe FP_NO_HOST_CHECK=NO HOMEDRIVE=C: HOMEPATH=\Documents and Settings\Dad LOGONSERVER=\\D34WBP61 NUMBER_OF_PROCESSORS=2 OS=Windows_NT Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\PROGRA~1\Lucky;C:\Program Files\QuickTime\QTSystem\ PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH PROCESSOR_ARCHITECTURE=x86 PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 1, GenuineIntel PROCESSOR_LEVEL=15 PROCESSOR_REVISION=0401 ProgramFiles=C:\Program Files PROMPT=$P$G QTJAVA=C:\Program Files\Java\jre1.6.0_05\lib\ext\QTJava.zip SESSIONNAME=Console SystemDrive=C: SystemRoot=C:\WINDOWS TEMP=C:\DOCUME~1\Dad\LOCALS~1\Temp TMP=C:\DOCUME~1\Dad\LOCALS~1\Temp USERDOMAIN=D34WBP61 USERNAME=Dad USERPROFILE=C:\Documents and Settings\Dad windir=C:\WINDOWS -- User Profiles --------------------------------------------------------------- Momma (admin) Dad (admin) Guest (guest) -- Add/Remove Programs --------------------------------------------------------- --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 --> C:\WINDOWS\IsUninst.exe -fC:\WINDOWS\orun32.isu --> MsiExec.exe /I{403EF592-953B-4794-BCEF-ECAB835C2095} --> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Ad-Aware SE Personal --> C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003} Adobe® Photoshop® Album Starter Edition 3.2 --> MsiExec.exe /I{A654A805-41D9-40C7-AA46-4AF04F044D61} Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543} Apple Software Update --> MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F} avast! Antivirus --> C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup Banctec Service Agreement --> MsiExec.exe /X{4B9F45E8-E3CE-40B4-9463-80A9B3481DEF} Brother MFL-Pro Suite --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{40A6C96D-808E-41DD-8716-617AB6B0F1F1}\Setup.exe" -l0x9 Brunin03.dllBrunin03.dll DeductionPro 2004-05 --> C:\PROGRA~1\DEDUCT~1\UNWISE.EXE C:\PROGRA~1\DEDUCT~1\INSTALL.LOG Dell Driver Reset Tool --> MsiExec.exe /I{5905F42D-3F5F-4916-ADA6-94A3646AEE76} Dell Support Center --> MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1} DellSupport --> MsiExec.exe /X{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D} DING! --> MsiExec.exe /X{84031A18-BA9A-4156-A74F-E05B52DDFCE2} ESPN Java Check --> C:\WINDOWS\system32\javaws.exe -uninstall -prompt "http://games.espn.go.com/s/flblm/07/livedraft/jws-check.jarjnlp" FinePixViewer Ver.4.0 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{24ED4D80-8294-11D5-96CD-0040266301AD}\SETUP.EXE" FrostWire 4.13.5 --> C:\Program Files\FrostWire\Uninstall.exe FUJIFILM USB Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5490882C-6961-11D5-BAE5-00E0188E010B}\SETUP.EXE" GTK+ Runtime 2.6.9 rev a (remove only) --> C:\Program Files\Common Files\GTK\2.0\uninst.exe HDCleaner --> C:\Program Files\HDCleaner\Uninstaller.exe HijackThis 2.0.2 --> "C:\DOCUME~1\Dad\MYDOCU~1\HIJACK~1\HijackThis.exe" /uninstall Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" iAUDIO U2 User's Guide --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{15D9A37B-DB3A-47E0-ACD0-439D13DFBD9B}\setup.exe" -l0x9 ImageMixer VCD for FinePix --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D3AA158A-9421-4883-8767-E771B0964A1D}\setup.exe" Intel(R) Graphics Media Accelerator Driver --> RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_2782 PCI\VEN_8086&DEV_2582 Intel(R) PRO Network Adapters and Drivers --> Prounstl.exe Intel(R) PROSet for Wired Connections --> MsiExec.exe /I{17334AAF-C9E7-483B-9F45-E3FCAF07FFA7} Internet Explorer Default Page --> MsiExec.exe /I{35BDEFF1-A610-4956-A00D-15453C116395} iTunes --> MsiExec.exe /I{585776BC-4BD6-4BD2-A19A-1D6CB44A403B} Jasc Paint Shop Photo Album --> MsiExec.exe /I{CC000127-5E5D-4A1C-90CB-EEAAAC1E3AC0} Java(TM) 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050} jetAudio Basic --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}\setup.exe" -l0x9 -removeonly JetShell PRO --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1826E565-D493-4B93-9031-D3667B340E80}\setup.exe" -l0x9 Logitech MouseWare 9.79.1 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5809E7CF-4DCF-11D4-9875-00105ACE7734}\Setup.exe" -l0x9 -l0009 UNINSTALL Macromedia Shockwave Player --> C:\WINDOWS\SYSTEM32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\SYSTEM32\Macromed\SHOCKW~1\Install.log Microsoft Age of Empires II --> "C:\Program Files\Microsoft Games\Age of Empires II\UNINSTAL.EXE" /runtemp /uninstall Microsoft Age of Empires II: The Conquerors Expansion --> "C:\Program Files\Microsoft Games\Age of Empires II\UNINSTALX.EXE" /runtemp /addremove Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Money 2005 --> C:\Program Files\Microsoft Money 2005\MNYCoreFiles\Setup\uninst.exe /s:120 Microsoft Office 2000 Professional --> MsiExec.exe /I{00010409-78E1-11D2-B60F-006097C998E7} Microsoft Plus! Digital Media Edition Installer --> MsiExec.exe /X{6E45BA47-383C-4C1E-8ED0-0D4845C293D7} Microsoft Plus! Photo Story 2 LE --> MsiExec.exe /X{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B} Microsoft Rise Of Nations --> "C:\Program Files\Microsoft Games\Rise of Nations\UNINSTAL.EXE" /runtemp /addremove Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe" MicroStaff WINASPI NT --> C:\MWASPINT\uninst.exe MSN --> C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP MSXML4 Parser --> MsiExec.exe /I{01501EBA-EC35-4F9F-8889-3BE346E5DA13} Panda ActiveScan 2.0 --> C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe QuickTime --> MsiExec.exe /I{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD} Railroad Tycoon & Airport Tycoon --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Take 2\Railroad & Airport Tycoon\Uninst.isu" RAW FILE CONVERTER LE --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D680C913-5955-469D-9D88-C1940F7506D6}\SETUP.EXE" -l0x9 RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0 Rise of Nations Thrones and Patriots --> "C:\Program Files\Microsoft Games\Rise of Nations\UNINSTLX.EXE" /runtemp /uninstall Security Update for Step By Step Interactive Training (KB898458) --> "C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe" Security Update for Step By Step Interactive Training (KB923723) --> "C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe" Skype™ 3.6 --> MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82} SpywareBlaster 4.0 --> "C:\Program Files\SpywareBlaster\unins000.exe" SysCleaner --> C:\Program Files\SysCleaner\Uninstall.exe TaxACT 2005 --> C:\PROGRA~1\2NDSTO~1\TAXACT~1\Unta05.exe C:\PROGRA~1\2NDSTO~1\TAXACT~1\Install.log TaxACT 2006 --> C:\PROGRA~1\2NDSTO~1\TAXACT~2\Unta06.exe C:\PROGRA~1\2NDSTO~1\TAXACT~2\Install.log TaxACT 2007 --> C:\PROGRA~1\2NDSTO~1\TAXACT~3\Unta07.exe C:\PROGRA~1\2NDSTO~1\TAXACT~3\Install.log TaxCut 2004 --> C:\Program Files\TaxCut04\Program\removetc.exe Turbo Combo (remove only) --> "C:\Program Files\Yahoo! Games\Turbo Combo\Uninstall.exe" Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" WordPerfect Office 12 --> MsiExec.exe /I{AF19F291-F22F-4798-9662-525305AE9E48} -- Application Event Log ------------------------------------------------------- Event Record #/Type4443 / Warning Event Submitted/Written: 05/10/2008 08:41:24 AM Event ID/Source: 32068 / Microsoft Fax Event Description: The outgoing routing rule is not valid because it cannot find a valid device. The outgoing faxes that use this rule will not be routed. Verify that the targeted device or devices (if routed to a group of devices) is connected and installed correctly, and turned on. If routed to a group, verify that the group is configured correctly. Country/region code: '*' Area code: '*' Event Record #/Type4442 / Warning Event Submitted/Written: 05/10/2008 08:41:24 AM Event ID/Source: 32026 / Microsoft Fax Event Description: Fax Service failed to initialize any assigned fax devices (virtual or TAPI). No faxes can be sent or received until a fax device is installed. Event Record #/Type4437 / Error Event Submitted/Written: 05/09/2008 03:49:29 PM Event ID/Source: 1001 / Application Hang Event Description: Fault bucket 288155955. Event Record #/Type4436 / Error Event Submitted/Written: 05/09/2008 03:49:27 PM Event ID/Source: 1002 / Application Hang Event Description: Hanging application Weather.exe, version 6.7.0.10, hang module hungapp, version 0.0.0.0, hang address 0x00000000. Event Record #/Type4434 / Warning Event Submitted/Written: 05/09/2008 01:53:46 PM Event ID/Source: 32068 / Microsoft Fax Event Description: The outgoing routing rule is not valid because it cannot find a valid device. The outgoing faxes that use this rule will not be routed. Verify that the targeted device or devices (if routed to a group of devices) is connected and installed correctly, and turned on. If routed to a group, verify that the group is configured correctly. Country/region code: '*' Area code: '*' -- Security Event Log ---------------------------------------------------------- No Errors/Warnings found. -- System Event Log ------------------------------------------------------------ Event Record #/Type23533 / Error Event Submitted/Written: 05/11/2008 10:02:14 PM Event ID/Source: 7016 / Service Control Manager Event Description: The BrSplService service has reported an invalid current state 0. Event Record #/Type23530 / Error Event Submitted/Written: 05/11/2008 09:19:11 PM Event ID/Source: 1000 / Dhcp Event Description: Your computer has lost the lease to its IP address 192.168.0.103 on the Network Card with network address 001111BA1B91. Event Record #/Type23529 / Warning Event Submitted/Written: 05/11/2008 09:19:11 PM Event ID/Source: 1003 / Dhcp Event Description: Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 001111BA1B91. The following error occurred: %%121. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. Event Record #/Type23526 / Error Event Submitted/Written: 05/10/2008 05:45:17 PM Event ID/Source: 1000 / Dhcp Event Description: Your computer has lost the lease to its IP address 192.168.0.103 on the Network Card with network address 001111BA1B91. Event Record #/Type23525 / Warning Event Submitted/Written: 05/10/2008 05:45:17 PM Event ID/Source: 1003 / Dhcp Event Description: Your computer was not able to renew its address from the network (from the DHCP Server) for the Network Card with network address 001111BA1B91. The following error occurred: %%121. Your computer will continue to try and obtain an address on its own from the network address (DHCP) server. -- End of Deckard's System Scanner: finished at 2008-05-11 22:02:42 ------------ Here is the ActiveScan.txt output - I had the Disinfect button popped up and it seemed to work for the two items it found: ;*********************************************************************************************************************************************************************************** ANALYSIS: 2008-05-10 10:44:12 PROTECTIONS: 1 MALWARE: 66 SUSPECTS: 2 ;*********************************************************************************************************************************************************************************** PROTECTIONS Description Version Active Updated ;=================================================================================================================================================================================== avast! antivirus 4.8.1169 [VPS 080509-0] 4.8.1169 No Yes ;=================================================================================================================================================================================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=================================================================================================================================================================================== 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@trafficmp[2].txt 00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@trafficmp[2].txt 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@casalemedia[1].txt 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@casalemedia[2].txt 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@casalemedia[1].txt 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@doubleclick[2].txt 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@doubleclick[2].txt 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@doubleclick[1].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@atdmt[2].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@atdmt[2].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@atdmt[2].txt 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@tradedoubler[1].txt 00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@247realmedia[1].txt 00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@247realmedia[1].txt 00145453 Cookie/Bfast TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@bfast[2].txt 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@fastclick[2].txt 00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@fastclick[1].txt 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@tribalfusion[1].txt 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@tribalfusion[2].txt 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@tribalfusion[2].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@mediaplex[2].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@mediaplex[1].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@mediaplex[1].txt 00145807 Cookie/Linksynergy TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@linksynergy[1].txt 00147824 Cookie/Clickbank TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@clickbank[1].txt 00148914 Cookie/Tucows TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@tucows[2].txt 00149064 Cookie/Maxserving TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@maxserving[1].txt 00152401 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@belnk[1].txt 00159564 Cookie/WUpd TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@revenue[2].txt 00162730 Cookie/Belnk TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@dist.belnk[2].txt 00167430 Cookie/myaffiliateprogram TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@www.myaffiliateprogram[1].txt 00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@com[1].txt 00167672 Cookie/DomainSponsor TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@landing.domainsponsor[2].txt 00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@xiti[1].txt 00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@xiti[1].txt 00167726 Cookie/Tickle TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@tickle[1].txt 00167730 Cookie/Hitbox TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@ehg.hitbox[2].txt 00167747 Cookie/Azjmp TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@azjmp[2].txt 00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@toplist[1].txt 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@statcounter[1].txt 00167760 Cookie/Hitslink TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@counter.hitslink[1].txt 00168048 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@perf.overture[1].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@ad.yieldmanager[2].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@ad.yieldmanager[2].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@ad.yieldmanager[2].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@apmebf[2].txt 00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@burstnet[1].txt 00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@burstnet[2].txt 00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@burstnet[2].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@serving-sys[1].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@serving-sys[1].txt 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@bs.serving-sys[1].txt 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@bs.serving-sys[1].txt 00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@www.burstbeacon[2].txt 00168101 Cookie/Falkag TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@as-us.falkag[1].txt 00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@adtech[2].txt 00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@server.iad.liveperson[1].txt 00168114 Cookie/onestat.com TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@stat.onestat[1].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@advertising[2].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@advertising[1].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@advertising[2].txt 00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@media.adrevolver[3].txt 00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@media.adrevolver[3].txt 00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@statse.webtrendslive[1].txt 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@ads.pointroll[1].txt 00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@ads.pointroll[2].txt 00170535 Cookie/GoClick TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@c.goclick[2].txt 00170550 Cookie/Humanclick TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@hc2.humanclick[2].txt 00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@overture[1].txt 00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@overture[1].txt 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@realmedia[1].txt 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@realmedia[1].txt 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@realmedia[2].txt 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@questionmarket[2].txt 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@questionmarket[1].txt 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@zedo[2].txt 00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@zedo[1].txt 00182104 Cookie/Hitbox TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@phg.hitbox[2].txt 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@adrevolver[2].txt 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@adrevolver[1].txt 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@adrevolver[2].txt 00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@adultfriendfinder[2].txt 00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@adultfriendfinder[1].txt 00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@go[2].txt 00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@go[1].txt 00199983 Cookie/Valueclick TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@valueclick[2].txt 00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@searchportal.information[1].txt 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@target[2].txt 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@target[1].txt 00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@target[2].txt 00207712 Cookie/360i TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@ct.360i[1].txt 00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@did-it[2].txt 00241834 Application/MyWebSearch HackTools No 0 Yes No C:\Program Files\MyWebSearchWB\bar\1.bin\NPMYSRWB.DLL 00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Dad\Cookies\dad@atwola[2].txt 00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@atwola[1].txt 00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@atwola[1].txt 00286736 Cookie/Cgi-bin TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@www6.addfreestats[1].txt 00286738 Cookie/Cgi-bin TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@cgi-bin[1].txt 00286739 Cookie/Hitbox TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@ehg-dig.hitbox[2].txt 00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@ads.addynamix[1].txt 00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No C:\Documents and Settings\Momma\Cookies\momma@ads.addynamix[1].txt 02900692 Application/Playmp3z HackTools No 0 Yes No C:\Documents and Settings\Momma\My Documents\My Music\Shared\spyburner.zip[Setup.exe] 02906998 Trj/Agent.IIG Virus/Trojan Yes 1 Yes Yes C:\WINDOWS\SYSVTYPKBJX.EXE 02919777 Generic Malware Virus/Trojan No 0 Yes Yes C:\Program Files\SysCleaner\com\scsdelete.dll ;=================================================================================================================================================================================== SUSPECTS Sent Location B ;=================================================================================================================================================================================== No C:\WINDOWS\SYSSFZVAKQG.EXE B No C:\WINDOWS\SYSXHTCWBSE.EXE B ;=================================================================================================================================================================================== VULNERABILITIES Id Severity Description B ;=================================================================================================================================================================================== ;=================================================================================================================================================================================== I just deleted the cookies / files / history from the Dad account. Have not done anything to the Mom account. Please advise as to next course of action. Thanks for the help! |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
05-14-2008, 04:46 AM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Warning! Your're in danger - need help
Hello and welcome to TSF
Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe. ======== Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present. Please Do Not Attach logs to your posts unless you are advised to do so. ========= Please print out or copy this page to Notepad in order to assist you when carrying out the following instructions. ========= Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs: SysCleaner<--- SysCleaner is a corrupt anti-spyware application that deals with infecting its victim's systems via trojans and then harassing them with security notification. This parasite also runs a faux-scan for spyware and shows an exaggerated threat report in order to scare users into purchasing the "full" SysCleaner version. =========== Download SDFix and save it to your Desktop. Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows Directory, typically C:SDFix) Please then reboot your computer in Safe Mode by doing the following :
========== Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time. Once the Recovery Console is installed using ComboFix, you should see a message that says: The Recovery Console was successfully installed.  Please continue as follows: Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. Click Yes to allow ComboFix to continue scanning for malware. When the tool is finished, it will produce a report for you. ========== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========== Logs Required Report.txt C:\Combofix.txt Hijackthis Log |
|
|
|
|
05-14-2008, 08:45 PM
|
#4 (permalink) |
|
Registered User
Join Date: Oct 2007
Location: ohio
Posts: 12
OS: xp
|
Re: Warning! Your're in danger - need help
Results follow (DSS log version of hjt log):
ComboFix 08-05-12.1 - Dad 2008-05-14 20:18:57.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.597 [GMT -4:00] Running from: C:\Documents and Settings\Dad\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Dad\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\SysCleaner C:\Program Files\SysCleaner\com\scsdelete.dll C:\WINDOWS\config.ini C:\WINDOWS\mywallpaper.bmp C:\WINDOWS\sysqrnxstju.exe C:\WINDOWS\syssfzvakqg.exe C:\WINDOWS\sysvtypkbjx.exe C:\WINDOWS\sysxhtcwbse.exe C:\WINDOWS\sysyeabdgfp.exe C:\WINDOWS\zysauqdhnyc.exe C:\WINDOWS\zyshbnmarcz.exe C:\WINDOWS\zysjgpcfrbn.exe C:\WINDOWS\zysrhupbxtf.exe . ((((((((((((((((((((((((( Files Created from 2008-04-15 to 2008-05-15 ))))))))))))))))))))))))))))))) . 2008-05-14 18:49 . 2008-05-14 18:49 <DIR> d-------- C:\WINDOWS\ERUNT 2008-05-14 18:40 . 2008-05-14 19:20 <DIR> d-------- C:\SDFix 2008-05-11 21:59 . 2008-05-11 21:59 <DIR> d-------- C:\Deckard 2008-05-10 11:45 . 2008-05-10 11:45 <DIR> d-------- C:\ie-spyad_zo 2008-05-10 11:01 . 2008-05-10 11:04 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-05-10 11:01 . 2008-05-10 11:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-09 21:45 . 2008-05-09 21:48 <DIR> d-------- C:\Program Files\Panda Security 2008-05-09 15:58 . 2008-05-09 17:10 <DIR> d-------- C:\Program Files\Yahoo! Games 2008-04-21 01:05 . 2008-04-21 01:05 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\Viewpoint . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-10 01:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-05-09 21:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst 2008-05-09 21:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games 2008-05-09 20:05 --------- d-----w C:\Program Files\FrostWire 2008-04-29 17:35 --------- d-----w C:\Documents and Settings\Guest\Application Data\WeatherBug 2008-04-19 18:29 --------- d-----w C:\Program Files\Apple Software Update 2008-04-11 00:30 --------- d-----w C:\Documents and Settings\Guest\Application Data\Skype 2008-04-04 23:23 --------- d-----w C:\Program Files\iTunes 2008-04-04 23:22 --------- d-----w C:\Program Files\iPod 2008-04-04 23:17 --------- d-----w C:\Program Files\QuickTime 2008-04-01 16:54 --------- d-----w C:\Program Files\Common Files\xing shared 2008-04-01 16:53 --------- d-----w C:\Program Files\Common Files\Real 2008-03-28 22:44 --------- d-----w C:\Program Files\Java 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\SYSTEM32\msjint40.dll 2008-03-27 08:12 151,583 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msjint40.dll 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\SYSTEM32\win32k.sys 2008-03-19 09:47 1,845,248 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\win32k.sys 2008-03-12 00:30 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2008-03-01 22:36 3,591,680 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll 2008-02-29 08:55 70,656 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe 2008-02-29 08:55 625,664 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe 2008-02-22 10:00 13,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\SYSTEM32\gdi32.dll 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\gdi32.dll 2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\SYSTEM32\dnsrslvr.dll 2008-02-20 05:32 45,568 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dnsrslvr.dll 2008-02-20 05:32 148,992 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dnsapi.dll 2008-02-15 05:44 161,792 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0FD7DAF0-BBEF-4990-B19E-2805D280571F}] C:\PROGRA~1\NetGuide\BHO\NETGUI~1.DLL [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OSCD_Creator"="c:\Dell\PreODM.EXE" [2004-10-31 07:21 408576] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-20 00:10 196608] "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 22:32 53248] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 14:37 79224] "ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2004-07-20 10:34 851968] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 14:49 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 14:46 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 14:50 114688] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712] "Logitech Utility"="Logi_MwX.Exe" [2003-12-17 09:50 19968 C:\WINDOWS\LOGI_MWX.EXE] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 19:57 16384] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-01 12:53 185896] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "OSCD_Creator"="C:\Dell\PreODM.exe" [2004-10-31 07:21 408576] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Exif Launcher.lnk - C:\Program Files\FinePixViewer\QuickDCF.exe [2005-07-16 07:39:19 200704] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 16:05:56 65588] Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2006-02-14 15:57:48 819200] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.jxvd"= JetMPVx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"= "C:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\FrostWire\\FrostWire.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 14:31] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 14:35] R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-10-09 19:56] S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-06-12 05:27] S3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 04:28] . Contents of the 'Scheduled Tasks' folder "2008-05-05 22:24:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-05-09 22:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (D34WBP61-Momma).job" - c:\program files\mcafee.com\vso\mcmnhdlr.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-14 20:21:22 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce OSCD_Creator = C:\Dell\PreODM.EXE /2?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-14 20:22:42 ComboFix-quarantined-files.txt 2008-05-15 00:22:26 Pre-Run: 10,841,178,112 bytes free Post-Run: 11,093,225,472 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 144 --- E O F --- 2008-05-14 22:42:21 DSS log... Deckard's System Scanner v20071014.68 Run by Dad on 2008-05-14 20:37:17 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Dad.exe) ------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 8:38:10 PM, on 5/14/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Brother\ControlCenter2\brctrcen.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\DellSupport\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\FinePixViewer\QuickDCF.exe C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\explorer.exe C:\Program Files\internet explorer\iexplore.exe C:\Documents and Settings\Dad\Desktop\dss.exe C:\DOCUME~1\Dad\MYDOCU~1\HIJACK~1\Dad.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sports.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: NetGuideBHO Class - {0FD7DAF0-BBEF-4990-B19E-2805D280571F} - C:\PROGRA~1\NetGuide\BHO\NETGUI~1.DLL (file missing) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [OSCD_Creator] c:\Dell\PreODM.EXE O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\RunOnce: [OSCD_Creator] C:\Dell\PreODM.EXE /2 O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Global Startup: Exif Launcher.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - http://www.stonyfield.com/coupons/scriptX/smsx.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- End of file - 7194 bytes -- Files created between 2008-04-14 and 2008-05-14 ----------------------------- 2008-05-14 20:18:38 0 d-------- C:\cmdcons 2008-05-14 20:17:51 68096 --a------ C:\WINDOWS\zip.exe 2008-05-14 20:17:51 49152 --a------ C:\WINDOWS\VFind.exe 2008-05-14 20:17:51 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-05-14 20:17:51 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-05-14 20:17:51 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-05-14 20:17:51 98816 --a------ C:\WINDOWS\sed.exe 2008-05-14 20:17:51 80412 --a------ C:\WINDOWS\grep.exe 2008-05-14 20:17:51 73728 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-05-14 18:49:18 0 d-------- C:\WINDOWS\ERUNT 2008-05-10 11:45:33 0 d-------- C:\ie-spyad_zo 2008-05-10 11:01:59 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-10 11:01:51 0 d-------- C:\Program Files\SpywareBlaster 2008-05-09 21:45:13 0 d-------- C:\Program Files\Panda Security 2008-05-09 15:58:34 0 d-------- C:\Program Files\Yahoo! Games 2008-04-21 01:05:19 0 d-------- C:\Documents and Settings\Guest\Application Data\Viewpoint -- Find3M Report --------------------------------------------------------------- 2008-05-09 16:05:16 0 d-------- C:\Program Files\FrostWire 2008-04-19 14:29:55 0 d-------- C:\Program Files\Apple Software Update 2008-04-04 19:23:29 0 d-------- C:\Program Files\iTunes 2008-04-04 19:22:44 0 d-------- C:\Program Files\iPod 2008-04-04 19:17:27 0 d-------- C:\Program Files\QuickTime 2008-04-01 12:54:06 0 d-------- C:\Program Files\Common Files 2008-04-01 12:54:06 0 d-------- C:\Program Files\Common Files\xing shared 2008-04-01 12:53:57 0 d-------- C:\Program Files\Common Files\Real 2008-03-28 18:44:10 0 d-------- C:\Program Files\Java -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0FD7DAF0-BBEF-4990-B19E-2805D280571F}] C:\PROGRA~1\NetGuide\BHO\NETGUI~1.DLL [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OSCD_Creator"="c:\Dell\PreODM.EXE" [10/31/2004 07:21 AM] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [11/20/2001 12:10 AM] "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [02/04/2002 10:32 PM] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [03/29/2008 02:37 PM] "ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [07/20/2004 10:34 AM] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [10/14/2005 02:49 PM] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [10/14/2005 02:46 PM] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [10/14/2005 02:50 PM] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [03/09/2007 11:09 AM] "Logitech Utility"="Logi_MwX.Exe" [12/17/2003 09:50 AM C:\WINDOWS\LOGI_MWX.EXE] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [10/09/2007 07:57 PM] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04/01/2008 12:53 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [03/28/2008 11:37 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [03/15/2007 11:09 AM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 07:00 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] "OSCD_Creator"=C:\Dell\PreODM.EXE /2 C:\Documents and Settings\Dad\Start Menu\Programs\Startup\ DESKTOP.INI [8/10/2004 3:04:12 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DESKTOP.INI [8/10/2004 3:04:12 PM] Exif Launcher.lnk - C:\Program Files\FinePixViewer\QuickDCF.exe [7/16/2005 7:39:19 AM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2/17/1999 4:05:56 PM] Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2/14/2006 3:57:48 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=1 (0x1) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=1 (0x1) "HideStartupScripts"=0 (0x0) -- End of Deckard's System Scanner: finished at 2008-05-14 20:38:29 ------------ Report.txt ... SDFix: Version 1.182 Run by Dad on Wed 05/14/2008 at 06:54 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting Checking Files : No Trojan Files Found Removing Temp Files ADS Check : Final Check : catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-14 19:16:47 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:America Online 9.0" "C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"="C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD:*:Enabled:Age of Empires II" "C:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe"="C:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe:*:Disabled:Rise of Nations" "C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Disabled:AOL Instant Messenger" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\FrostWire\\FrostWire.exe"="C:\\Program Files\\FrostWire\\FrostWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:eBay - Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe:*:Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe:*:Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe:*:Enabled:America Online 9.0" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Tue 24 Aug 2004 155,648 A..H. --- "C:\DELL\PRIMOSDK.DLL" Tue 24 Aug 2004 360,448 A..H. --- "C:\DELL\PX.DLL" Wed 28 Jul 2004 56,832 A..H. --- "C:\DELL\PXCPYA64.EXE" Wed 28 Jul 2004 108,544 A..H. --- "C:\DELL\PXCPYI64.EXE" Wed 18 Aug 2004 389,120 A..H. --- "C:\DELL\PXDRV.DLL" Mon 2 Aug 2004 20,576 A..H. --- "C:\DELL\PXHELP20.SYS" Mon 2 Aug 2004 54,976 A..H. --- "C:\DELL\PXHELP64.SYS" Mon 2 Aug 2004 32,272 A..H. --- "C:\DELL\PXHELPER.SYS" Mon 2 Aug 2004 26,720 A..H. --- "C:\DELL\PXHLPA64.SYS" Mon 2 Aug 2004 57,344 A..H. --- "C:\DELL\PXHPINST.EXE" Mon 2 Aug 2004 53,760 A..H. --- "C:\DELL\PXINSA64.EXE" Mon 2 Aug 2004 104,960 A..H. --- "C:\DELL\PXINSI64.EXE" Tue 24 Aug 2004 159,744 A..H. --- "C:\DELL\PXMAS.DLL" Wed 28 Jul 2004 57,344 A..H. --- "C:\DELL\PXSETUP.EXE" Tue 24 Aug 2004 339,968 A..H. --- "C:\DELL\PXWAVE.DLL" Thu 20 May 2004 28,672 A..H. --- "C:\DELL\VXBLOCK.DLL" Tue 24 Aug 2004 155,648 A..H. --- "C:\DELL\MEDIAEXE\PRIMOSDK.DLL" Tue 24 Aug 2004 360,448 A..H. --- "C:\DELL\MEDIAEXE\PX.DLL" Wed 28 Jul 2004 56,832 A..H. --- "C:\DELL\MEDIAEXE\PXCPYA64.EXE" Wed 28 Jul 2004 108,544 A..H. --- "C:\DELL\MEDIAEXE\PXCPYI64.EXE" Wed 18 Aug 2004 389,120 A..H. --- "C:\DELL\MEDIAEXE\PXDRV.DLL" Mon 2 Aug 2004 20,576 A..H. --- "C:\DELL\MEDIAEXE\PXHELP20.SYS" Mon 2 Aug 2004 54,976 A..H. --- "C:\DELL\MEDIAEXE\PXHELP64.SYS" Mon 2 Aug 2004 32,272 A..H. --- "C:\DELL\MEDIAEXE\PXHELPER.SYS" Mon 2 Aug 2004 26,720 A..H. --- "C:\DELL\MEDIAEXE\PXHLPA64.SYS" Mon 2 Aug 2004 57,344 A..H. --- "C:\DELL\MEDIAEXE\PXHPINST.EXE" Mon 2 Aug 2004 53,760 A..H. --- "C:\DELL\MEDIAEXE\PXINSA64.EXE" Mon 2 Aug 2004 104,960 A..H. --- "C:\DELL\MEDIAEXE\PXINSI64.EXE" Tue 24 Aug 2004 159,744 A..H. --- "C:\DELL\MEDIAEXE\PXMAS.DLL" Wed 28 Jul 2004 57,344 A..H. --- "C:\DELL\MEDIAEXE\PXSETUP.EXE" Tue 24 Aug 2004 339,968 A..H. --- "C:\DELL\MEDIAEXE\PXWAVE.DLL" Thu 20 May 2004 28,672 A..H. --- "C:\DELL\MEDIAEXE\VXBLOCK.DLL" Thu 29 Jul 2004 60,928 ...H. --- "C:\Program Files\Microsoft Money 2005\mnysl05.dll" Thu 29 Jul 2004 199,680 ...H. --- "C:\Program Files\Microsoft Money 2005\mnysvc05.dll" Thu 29 Jul 2004 80,384 ...H. --- "C:\Program Files\Microsoft Money 2005\mnyupdate!@#@.exe" Thu 29 Jul 2004 229,888 ...H. --- "C:\Program Files\Microsoft Money 2005\unicows.dll" Thu 29 Jul 2004 121,344 ...H. --- "C:\Program Files\Microsoft Money 2005\utilsurf.dll" Wed 20 Sep 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Fri 9 May 2008 157,945 ...H. --- "C:\Program Files\Yahoo! Games\Turbo Combo\Uninstall.exe" Wed 13 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp" Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\BIT20.tmp" Wed 11 Apr 2007 8 A..H. --- "C:\Documents and Settings\Dad\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp" Wed 11 Apr 2007 8 A..H. --- "C:\Documents and Settings\Dad\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp" Wed 11 Apr 2007 8 A..H. --- "C:\Documents and Settings\Dad\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u3\lock.tmp" Wed 11 Apr 2007 8 A..H. --- "C:\Documents and Settings\Dad\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp" Sat 28 Apr 2007 8 A..H. --- "C:\Documents and Settings\Guest\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u1\lock.tmp" Sat 28 Apr 2007 8 A..H. --- "C:\Documents and Settings\Guest\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u2\lock.tmp" Sat 28 Apr 2007 8 A..H. --- "C:\Documents and Settings\Guest\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u3\lock.tmp" Sat 28 Apr 2007 8 A..H. --- "C:\Documents and Settings\Guest\Application Data\Gtek\GTUpdate\AUpdate\Channels\ch_u4\lock.tmp" Finished! Thanks for the help, let me know what to do next... |
|
|
|
|
05-15-2008, 04:33 AM
|
#5 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Warning! Your're in danger - need help
Hello again Kevin
Please post the logs in the correct order, also only post the logs that are required, thanks. ======== Download ATF-Cleaner by Atribune to your desktop.Do not run just yet, we will shortly ======== Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall =========== JAVA OUTDATED Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
=========== Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
============ Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ============ Logs Required C:\Combofix.txt Kaspersky Scan Report Hijackthis Log An update on how your system is performing. |
|
|
|
|
|
05-21-2008, 06:34 PM
|
#6 (permalink) |
|
Registered User
Join Date: Oct 2007
Location: ohio
Posts: 12
OS: xp
|
Re: Warning! Your're in danger - need help
I followed latest advise on 5/17, but my Kaspersky scan report is over 6M and I cannot attach it....
I also did not see where you might want me to do anything with the ATF Cleaner. Attached are the combo fix log and the hijackthis log. Please advise. ComboFix 08-05-12.1 - Dad 2008-05-17 14:22:40.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.504 [GMT -4:00] Running from: C:\Documents and Settings\Dad\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Dad\Desktop\CFscript.txt * Created a new restore point FILE :: C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (D34WBP61-Momma).job . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Viewpoint C:\Documents and Settings\Guest\Application Data\Viewpoint C:\Documents and Settings\Guest\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00\URLCache.ini C:\Documents and Settings\Guest\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01\URLCache.ini C:\Documents and Settings\Guest\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02\URLCache.ini C:\Documents and Settings\Guest\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03\URLCache.ini C:\Documents and Settings\Guest\Application Data\WeatherBug C:\Documents and Settings\Guest\Application Data\WeatherBug\0107_Winter.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\0107_Winter_Mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\06_Winter_121807.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\06_Winter_121807_Mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\06_Winter_BUBBLE_Mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\06_Winter_Bubble_Wrap.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96_Allergy.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96_Blue.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96_ColdAndFlu_VZ.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96_ColdAndFluMobile.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96_Disney_Chance2Win.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96_DisneyRoadTrip.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96_GrHog_tile.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96_Hurricane_09252007.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96_HurricaneCommandCenterWithFlag.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96_NST_3-22-07.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96FarmersAlmanacOutlookTile.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96LiveTrafficCameras.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96Mobile2_0507.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96PlusMobile.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96PlusNVerizon.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96SponsorTileMobileVideo.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96TP-MA-FF.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96video.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\102x96video1_mobile2.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\501.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\535.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Applebees_background.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Applebees_mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60_blueyellow.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60_blueyellow_mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Default_Fall_1007.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Default_Fall_1007_Mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Generic_Sun_0306_Final.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Generic_Sun_0306_Final.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Generic200_Spring_Mask_031908.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Generic2006_Fall_091406.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Generic2006_Fall_091406.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Generic2007_Spring_031908.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Generic2007_Summe_0807r.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Generic2007_Summer_Mask_0807.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60_GenericPLUS_Summer_082906.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60_GenericPLUS_Summer_082906.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Hampton_Inn.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Hampton_Inn_Mask_07.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60_HarperCollins-Publishers.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Jarden_SunbeamBedding_Mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Jarden_SunbeamBedding_Skin.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60_nav_light_round_0706.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60_nav_light_square_0706.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Spring_Bubble_0507.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60_Spring_Bubble_Mask_0507.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales-Chantix0907.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales-Chantix0907.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales-KraftHoneyBunches.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales-KraftHoneyBunches.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales-StIves.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales-StIves.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales-Vicks1007.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales-Vicks1007.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales_Ace_Hardware.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales_Alaway_mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales_Alaway_shell.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales_Chantix_Mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales_Chantix_shell.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales_CincinnatiUSA_Mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales_CincinnatiUSA_skin.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales_history_MASK.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\60Sales_history_shell.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\60SalesAce_Hardware_Mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\Allstate.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\Allstate_Mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\Fall-VZWbubble_APPROVED.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\Fall-VZWbubble_APPROVED_102407.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\Fall-VZWbubble_MASK.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\Fall-VZWbubble_MASK_102407.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\Fall.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\Fall_Mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\jcPenny_60wrap.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\jcPenny_60wrap_MASK.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\Kmart.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\Kmart_Mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\Lowes_APPROVED.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\Lowes_MASK.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\nav_07182007.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\nav_Generic2005_032907.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\nav_Generic2006_0706.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\Philly_Cream_Cheese.JPG C:\Documents and Settings\Guest\Application Data\WeatherBug\Philly_Cream_Cheese_Mask.BMP C:\Documents and Settings\Guest\Application Data\WeatherBug\Sears_Generic.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\Sears_Generic_MASK.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\Spring_2007.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\Spring_2007_Mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\topnav_Business.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\topnav_Generic2005.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\topnav_Generic2005_121505.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\topnav_Generic2007.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\topnav_square.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\topnav_square_121505.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\Travelers_Approved_Skin_103107.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\Travelers_MASK_103107.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\Verizon_Bubble_0208.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\Verizon_Bubble_0208_MASK.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\VerizonWrap_Approved.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\VerizonWrap_MASK.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\WeatherAlert.jpg C:\Documents and Settings\Guest\Application Data\WeatherBug\WeatherAlert_Mask.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\Winter_BUBBLE2.bmp C:\Documents and Settings\Guest\Application Data\WeatherBug\Winter_BUBBLE2.jpg C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (D34WBP61-Momma).job . ((((((((((((((((((((((((( Files Created from 2008-04-17 to 2008-05-17 ))))))))))))))))))))))))))))))) . 2008-05-15 18:46 . 2008-05-15 18:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Oberon Games 2008-05-15 18:42 . 2006-03-23 20:12 139,264 --a------ C:\WINDOWS\SYSTEM32\igfxres.dll 2008-05-15 11:06 . 2006-03-23 20:38 61,440 --a------ C:\WINDOWS\SYSTEM32\iAlmCoIn_v4543.dll 2008-05-14 18:49 . 2008-05-14 18:49 <DIR> d-------- C:\WINDOWS\ERUNT 2008-05-14 18:40 . 2008-05-14 19:20 <DIR> d-------- C:\SDFix 2008-05-11 21:59 . 2008-05-11 21:59 <DIR> d-------- C:\Deckard 2008-05-10 11:45 . 2008-05-10 11:45 <DIR> d-------- C:\ie-spyad_zo 2008-05-10 11:01 . 2008-05-10 11:04 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-05-10 11:01 . 2008-05-10 11:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-09 21:45 . 2008-05-09 21:48 <DIR> d-------- C:\Program Files\Panda Security 2008-05-09 15:58 . 2008-05-09 17:10 <DIR> d-------- C:\Program Files\Yahoo! Games . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-09 21:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst 2008-05-09 21:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games 2008-05-09 20:05 --------- d-----w C:\Program Files\FrostWire 2008-04-19 18:29 --------- d-----w C:\Program Files\Apple Software Update 2008-04-11 00:30 --------- d-----w C:\Documents and Settings\Guest\Application Data\Skype 2008-04-04 23:23 --------- d-----w C:\Program Files\iTunes 2008-04-04 23:22 --------- d-----w C:\Program Files\iPod 2008-04-04 23:17 --------- d-----w C:\Program Files\QuickTime 2008-04-01 16:54 --------- d-----w C:\Program Files\Common Files\xing shared 2008-04-01 16:53 --------- d-----w C:\Program Files\Common Files\Real 2008-03-28 22:44 --------- d-----w C:\Program Files\Java 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\SYSTEM32\msjint40.dll 2008-03-27 08:12 151,583 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msjint40.dll 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\SYSTEM32\win32k.sys 2008-03-19 09:47 1,845,248 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\win32k.sys 2008-03-12 00:30 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2008-03-01 22:36 3,591,680 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll 2008-02-29 08:55 70,656 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe 2008-02-29 08:55 625,664 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe 2008-02-22 10:00 13,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\SYSTEM32\gdi32.dll 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\gdi32.dll 2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\SYSTEM32\dnsrslvr.dll 2008-02-20 05:32 45,568 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dnsrslvr.dll 2008-02-20 05:32 148,992 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\dnsapi.dll . ((((((((((((((((((((((((((((( snapshot@2008-05-14_20.22.17.09 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-14 22:58:58 2,048 --s-a-w C:\WINDOWS\BOOTSTAT.DAT + 2008-05-15 15:08:10 2,048 --s-a-w C:\WINDOWS\BOOTSTAT.DAT - 2005-10-14 19:15:18 1,302,812 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\ialmnt5.sys + 2006-03-24 00:47:06 1,166,972 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\ialmnt5.sys - 2005-10-14 18:45:22 73,728 ----a-w C:\WINDOWS\SYSTEM32\hccutils.dll + 2006-03-24 00:12:26 73,728 ----a-w C:\WINDOWS\SYSTEM32\hccutils.dll - 2005-10-14 18:46:34 77,824 ----a-w C:\WINDOWS\SYSTEM32\hkcmd.exe + 2006-03-24 00:13:40 77,824 ----a-w C:\WINDOWS\SYSTEM32\hkcmd.exe - 2005-10-14 19:14:16 901,242 ----a-w C:\WINDOWS\SYSTEM32\ialmdd5.dll + 2006-03-24 00:45:54 956,026 ----a-w C:\WINDOWS\SYSTEM32\ialmdd5.dll - 2005-10-14 19 40 213,274 ----a-w C:\WINDOWS\SYSTEM32\ialmdev5.dll+ 2006-03-24 00:38:30 238,650 ----a-w C:\WINDOWS\SYSTEM32\ialmdev5.dll - 2005-10-14 19 52 118,395 ----a-w C:\WINDOWS\SYSTEM32\ialmdnt5.dll+ 2006-03-24 00:38:42 121,467 ----a-w C:\WINDOWS\SYSTEM32\ialmdnt5.dll - 2005-10-14 19 54 49,152 ----a-w C:\WINDOWS\SYSTEM32\ialmrem.dll+ 2006-03-24 00:38:46 49,152 ----a-w C:\WINDOWS\SYSTEM32\ialmrem.dll - 2005-10-14 19 58 36,990 ----a-w C:\WINDOWS\SYSTEM32\ialmrnt5.dll+ 2006-03-24 00:38:50 45,694 ----a-w C:\WINDOWS\SYSTEM32\ialmrnt5.dll - 2005-10-14 18:51:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuARA.dll + 2006-03-24 00:24:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuARA.dll - 2005-10-14 18:51:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuARB.dll + 2006-03-24 00:24:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuARB.dll - 2005-10-14 18:51:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuCHS.dll + 2006-03-24 00:24:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuCHS.dll - 2005-10-14 18:51:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuCHT.dll + 2006-03-24 00:24:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuCHT.dll - 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuCSY.dll + 2006-03-24 00:24:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuCSY.dll - 2005-10-14 18:51:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuDAN.dll + 2006-03-24 00:24:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuDAN.dll - 2005-10-14 18:51:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuDEU.dll + 2006-03-24 00:24:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuDEU.dll - 2005-10-14 18:51:06 114,688 ----a-w C:\WINDOWS\SYSTEM32\ialmudlg.exe + 2006-03-24 00:24:04 114,688 ----a-w C:\WINDOWS\SYSTEM32\ialmudlg.exe - 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuELL.dll + 2006-03-24 00:24:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuELL.dll - 2005-10-14 18:51:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuENG.dll + 2006-03-24 00:24:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuENG.dll - 2005-10-14 18:51:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuESP.dll + 2006-03-24 00:24:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuESP.dll - 2005-10-14 18:51:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuFIN.dll + 2006-03-24 00:24:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuFIN.dll - 2005-10-14 18:51:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuFRA.dll + 2006-03-24 00:24:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuFRA.dll - 2005-10-14 18:51:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuFRC.dll + 2006-03-24 00:24:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuFRC.dll - 2005-10-14 18:51:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuHEB.dll + 2006-03-24 00:24:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuHEB.dll - 2005-10-14 18:51:14 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuHUN.dll + 2006-03-24 00:24:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuHUN.dll - 2005-10-14 18:51:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuITA.dll + 2006-03-24 00:24:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuITA.dll - 2005-10-14 18:51:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuJPN.dll + 2006-03-24 00:24:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuJPN.dll - 2005-10-14 18:51:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuKOR.dll + 2006-03-24 00:24:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuKOR.dll - 2005-10-14 18:51:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuNLD.dll + 2006-03-24 00:24:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuNLD.dll - 2005-10-14 18:51:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuNOR.dll + 2006-03-24 00:24:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuNOR.dll - 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuPLK.dll + 2006-03-24 00:24:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuPLK.dll - 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuPTB.dll + 2006-03-24 00:24:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuPTB.dll - 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuPTG.dll + 2006-03-24 00:24:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuPTG.dll - 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuRUS.dll + 2006-03-24 00:24:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuRUS.dll - 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuSVE.dll + 2006-03-24 00:24:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuSVE.dll - 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuTHA.dll + 2006-03-24 00:24:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuTHA.dll - 2005-10-14 18:51:14 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuTRK.dll + 2006-03-24 00:24:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ialmuTRK.dll - 2005-10-14 18:49:08 446,464 ----a-w C:\WINDOWS\SYSTEM32\igfxcfg.exe + 2006-03-24 00:16:24 450,560 ----a-w C:\WINDOWS\SYSTEM32\igfxcfg.exe - 2005-10-14 18:45:38 135,168 ----a-w C:\WINDOWS\SYSTEM32\igfxdev.dll + 2006-03-24 00:12:42 139,264 ----a-w C:\WINDOWS\SYSTEM32\igfxdev.dll - 2005-10-14 18:46:38 86,016 ----a-w C:\WINDOWS\SYSTEM32\igfxdo.dll + 2006-03-24 00:13:46 86,016 ----a-w C:\WINDOWS\SYSTEM32\igfxdo.dll - 2005-10-14 18:50:24 40,960 ----a-w C:\WINDOWS\SYSTEM32\igfxexps.dll + 2006-03-24 00:17:44 40,960 ----a-w C:\WINDOWS\SYSTEM32\igfxexps.dll - 2005-10-14 18:50:22 94,208 ----a-w C:\WINDOWS\SYSTEM32\igfxext.exe + 2006-03-24 00:17:42 94,208 ----a-w C:\WINDOWS\SYSTEM32\igfxext.exe - 2005-10-14 18:50:30 114,688 ----a-w C:\WINDOWS\SYSTEM32\igfxpers.exe + 2006-03-24 00:17:50 118,784 ----a-w C:\WINDOWS\SYSTEM32\igfxpers.exe - 2005-10-14 18:49:30 147,456 ----a-w C:\WINDOWS\SYSTEM32\igfxpph.dll + 2006-03-24 00:16:46 143,360 ----a-w C:\WINDOWS\SYSTEM32\igfxpph.dll - 2005-10-14 18:49:36 1,503,232 ----a-w C:\WINDOWS\SYSTEM32\igfxress.dll + 2006-03-24 00:16:50 1,503,232 ----a-w C:\WINDOWS\SYSTEM32\igfxress.dll - 2005-10-14 18:46:28 57,344 ----a-w C:\WINDOWS\SYSTEM32\igfxsrvc.dll + 2006-03-24 00:13:32 61,440 ----a-w C:\WINDOWS\SYSTEM32\igfxsrvc.dll - 2005-10-14 18:46:24 159,744 ----a-w C:\WINDOWS\SYSTEM32\igfxsrvc.exe + 2006-03-24 00:13:30 163,840 ----a-w C:\WINDOWS\SYSTEM32\igfxsrvc.exe - 2005-10-14 18:49:46 94,208 ----a-w C:\WINDOWS\SYSTEM32\igfxtray.exe + 2006-03-24 00:17:04 94,208 ----a-w C:\WINDOWS\SYSTEM32\igfxtray.exe - 2005-10-14 18:50:16 114,688 ----a-w C:\WINDOWS\SYSTEM32\igfxzoom.exe + 2006-03-24 00:17:36 114,688 ----a-w C:\WINDOWS\SYSTEM32\igfxzoom.exe - 2005-10-14 18:59:00 524,288 ----a-w C:\WINDOWS\SYSTEM32\igldev32.dll + 2006-03-24 00:31:34 524,288 ----a-w C:\WINDOWS\SYSTEM32\igldev32.dll - 2005-10-14 18:57:06 2,310,144 ----a-w C:\WINDOWS\SYSTEM32\iglicd32.dll + 2006-03-24 00:29:56 2,318,336 ----a-w C:\WINDOWS\SYSTEM32\iglicd32.dll - 2008-04-06 05:56:20 19,836,024 ----a-w C:\WINDOWS\SYSTEM32\MRT.exe + 2008-05-09 21:35:04 16,863,864 ----a-w C:\WINDOWS\SYSTEM32\MRT.exe - 2005-01-23 14:30:32 118,784 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\hccutils.dll + 2005-10-14 18:45:22 73,728 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\hccutils.dll - 2005-01-23 14:31:34 126,976 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\hkcmd.exe + 2005-10-14 18:46:34 77,824 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\hkcmd.exe - 2005-01-23 14:55:54 61,440 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\iAlmCoIn.dll + 2005-10-14 19 54 61,440 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\iAlmCoIn.dll- 2005-01-23 15:04:20 878,651 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmdd5.dll + 2005-10-14 19:14:16 901,242 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmdd5.dll - 2005-01-23 14:55:42 178,779 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmdev5.dll + 2005-10-14 19 40 213,274 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmdev5.dll- 2005-01-23 14:55:54 108,092 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmdnt5.dll + 2005-10-14 19 52 118,395 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmdnt5.dll- 2005-01-23 15:05:06 804,317 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmnt5.sys + 2006-03-24 00:47:06 1,166,972 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmnt5.sys - 2005-01-23 14:55:56 49,152 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmrem.dll + 2006-03-24 00:38:46 49,152 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmrem.dll - 2005-01-23 14:56:00 37,951 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmrnt5.dll + 2005-10-14 19 58 36,990 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmrnt5.dll+ 2006-03-24 00:24:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuARA.dll + 2006-03-24 00:24:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuARB.dll + 2006-03-24 00:24:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuCHS.dll + 2006-03-24 00:24:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuCHT.dll + 2006-03-24 00:24:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuCSY.dll + 2006-03-24 00:24:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuDAN.dll + 2006-03-24 00:24:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuDEU.dll + 2006-03-24 00:24:04 114,688 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmudlg.exe + 2006-03-24 00:24:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuELL.dll + 2006-03-24 00:24:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuENG.dll + 2006-03-24 00:24:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuESP.dll + 2006-03-24 00:24:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuFIN.dll + 2006-03-24 00:24:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuFRA.dll + 2006-03-24 00:24:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuFRC.dll + 2006-03-24 00:24:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuHEB.dll + 2006-03-24 00:24:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuHUN.dll + 2006-03-24 00:24:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuITA.dll + 2006-03-24 00:24:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuJPN.dll + 2006-03-24 00:24:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuKOR.dll + 2006-03-24 00:24:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuNLD.dll + 2006-03-24 00:24:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuNOR.dll + 2006-03-24 00:24:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuPLK.dll + 2006-03-24 00:24:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuPTB.dll + 2006-03-24 00:24:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuPTG.dll + 2006-03-24 00:24:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuRUS.dll + 2006-03-24 00:24:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuSVE.dll + 2006-03-24 00:24:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuTHA.dll + 2006-03-24 00:24:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\ialmuTRK.dll - 2005-01-23 14:33:30 503,808 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxcfg.exe + 2006-03-24 00:16:24 450,560 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxcfg.exe - 2005-01-23 14:30:24 139,264 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxdev.dll + 2005-10-14 18:45:38 135,168 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxdev.dll - 2005-01-23 14:30:04 86,016 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxdo.dll + 2006-03-24 00:13:46 86,016 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxdo.dll - 2005-01-23 14:36:20 36,864 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxexps.dll + 2006-03-24 00:17:44 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxexps.dll - 2005-01-23 14:36:18 106,496 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxext.exe + 2006-03-24 00:17:42 94,208 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxext.exe + 2005-10-14 18:50:30 114,688 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxpers.exe - 2005-01-23 14:35:42 225,280 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxpph.dll + 2006-03-24 00:16:46 143,360 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxpph.dll - 2005-01-23 14:30:44 1,245,184 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxress.dll + 2006-03-24 00:16:50 1,503,232 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxress.dll - 2005-01-23 14:31:10 348,160 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxsrvc.dll + 2005-10-14 18:46:28 57,344 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxsrvc.dll + 2006-03-24 00:13:30 163,840 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxsrvc.exe - 2005-01-23 14:36:10 155,648 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxtray.exe + 2006-03-24 00:17:04 94,208 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxtray.exe - 2005-01-23 14:36:44 114,688 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxzoom.exe + 2006-03-24 00:17:36 114,688 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igfxzoom.exe + 2006-03-24 00:31:34 524,288 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\igldev32.dll + 2006-03-24 00:29:56 2,318,336 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0016\DriverFiles\iglicd32.dll + 2005-10-14 18:45:22 73,728 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\hccutils.dll + 2005-10-14 18:46:34 77,824 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\hkcmd.exe + 2005-10-14 19 54 61,440 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\iAlmCoIn.dll+ 2005-10-14 19:14:16 901,242 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmdd5.dll + 2005-10-14 19 40 213,274 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmdev5.dll+ 2005-10-14 19 52 118,395 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmdnt5.dll+ 2005-10-14 19:15:18 1,302,812 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmnt5.sys + 2005-10-14 19 54 49,152 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmrem.dll+ 2005-10-14 19 58 36,990 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmrnt5.dll+ 2005-10-14 18:51:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuARA.dll + 2005-10-14 18:51:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuARB.dll + 2005-10-14 18:51:06 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuCHS.dll + 2005-10-14 18:51:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuCHT.dll + 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuCSY.dll + 2005-10-14 18:51:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuDAN.dll + 2005-10-14 18:51:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuDEU.dll + 2005-10-14 18:51:06 114,688 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmudlg.exe + 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuELL.dll + 2005-10-14 18:51:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuENG.dll + 2005-10-14 18:51:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuESP.dll + 2005-10-14 18:51:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuFIN.dll + 2005-10-14 18:51:08 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuFRA.dll + 2005-10-14 18:51:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuFRC.dll + 2005-10-14 18:51:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuHEB.dll + 2005-10-14 18:51:14 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuHUN.dll + 2005-10-14 18:51:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuITA.dll + 2005-10-14 18:51:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuJPN.dll + 2005-10-14 18:51:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuKOR.dll + 2005-10-14 18:51:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuNLD.dll + 2005-10-14 18:51:10 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuNOR.dll + 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuPLK.dll + 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuPTB.dll + 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuPTG.dll + 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuRUS.dll + 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuSVE.dll + 2005-10-14 18:51:12 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuTHA.dll + 2005-10-14 18:51:14 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\ialmuTRK.dll + 2005-10-14 18:49:08 446,464 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\igfxcfg.exe + 2005-10-14 18:45:38 135,168 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\igfxdev.dll + 2005-10-14 18:46:38 86,016 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\igfxdo.dll + 2005-10-14 18:50:24 40,960 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\igfxexps.dll + 2005-10-14 18:50:22 94,208 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\igfxext.exe + 2005-10-14 18:50:30 114,688 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\igfxpers.exe + 2005-10-14 18:49:30 147,456 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\igfxpph.dll + 2005-10-14 18:49:36 1,503,232 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\igfxress.dll + 2005-10-14 18:46:28 57,344 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\igfxsrvc.dll + 2005-10-14 18:46:24 159,744 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\igfxsrvc.exe + 2005-10-14 18:49:46 94,208 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\igfxtray.exe + 2005-10-14 18:50:16 114,688 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\igfxzoom.exe + 2005-10-14 18:59:00 524,288 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\igldev32.dll + 2005-10-14 18:57:06 2,310,144 ----a-w C:\WINDOWS\SYSTEM32\ReinstallBackups\0018\DriverFiles\iglicd32.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 19:56 202544] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OSCD_Creator"="c:\Dell\PreODM.EXE" [2004-10-31 07:21 408576] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-20 00:10 196608] "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 22:32 53248] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 14:37 79224] "ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2004-07-20 10:34 851968] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712] "Logitech Utility"="Logi_MwX.Exe" [2003-12-17 09:50 19968 C:\WINDOWS\LOGI_MWX.EXE] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 19:57 16384] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-01 12:53 185896] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 19:56 202544] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 20:17 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 20:13 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 20:17 118784] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Exif Launcher.lnk - C:\Program Files\FinePixViewer\QuickDCF.exe [2005-07-16 07:39:19 200704] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 16:05:56 65588] Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2006-02-14 15:57:48 819200] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.jxvd"= JetMPVx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"= "C:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\FrostWire\\FrostWire.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 14:31] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 14:35] R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-10-09 19:56] S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-06-12 05:27] S3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 04:28] . Contents of the 'Scheduled Tasks' folder "2008-05-05 22:24:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-17 14:25:22 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-17 14:27:50 ComboFix-quarantined-files.txt 2008-05-17 18:26:52 ComboFix2.txt 2008-05-15 00:22:43 Pre-Run: 10,268,274,688 bytes free Post-Run: 10,281,127,936 bytes free 468 --- E O F --- 2008-05-17 07:01:28 --------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:34:41 PM, on 5/17/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\brss01a.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Brother\ControlCenter2\brctrcen.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\WINDOWS\Logi_MwX.Exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\DellSupport\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\FinePixViewer\QuickDCF.exe C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe C:\Program Files\Brother\Brmfcmon\BrMfimon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\system32\wscntfy.exe C:\Documents and Settings\Dad\My Documents\hijackthis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sports.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [OSCD_Creator] c:\Dell\PreODM.EXE O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\RunOnce: [OSCD_Creator] C:\Dell\PreODM.EXE /2 O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - Global Startup: Exif Launcher.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - http://www.stonyfield.com/coupons/scriptX/smsx.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- End of file - 7446 bytes Last edited by TheBruce1; 05-22-2008 at 06:37 AM. |
|
|
|
|
05-22-2008, 06:48 AM
|
#7 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Warning! Your're in danger - need help
Quote:
|
|
|
|
|
|
05-31-2008, 12:42 PM
|
#8 (permalink) |
|
Registered User
Join Date: Oct 2007
Location: ohio
Posts: 12
OS: xp
|
Re: Warning! Your're in danger - need help
finally, got the kaspersky logs broken into pieces...
sorry for the delay...wife making me do to much manual labor... today, started getting popups again, not as bad, something called popup mgr was in the list of ok to manage popups on ie... |
|
|
|
|
06-01-2008, 07:54 AM
|
#9 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Warning! Your're in danger - need help
Nothing showing in the Kaspersky log, i need you to run another Deckard System Scanner, since its been nine days since your last post and things can change. Post the main.txt from DSS.
|
|
|
|
|
06-01-2008, 08:35 AM
|
#10 (permalink) |
|
Registered User
Join Date: Oct 2007
Location: ohio
Posts: 12
OS: xp
|
Re: Warning! Your're in danger - need help
Continuing to get mucho self generating popups, not sure why...
Here's the main.txt... eckard's System Scanner v20071014.68 Run by Dad on 2008-06-01 10:29:24 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as Dad.exe) ------------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:30:22 AM, on 6/1/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\brss01a.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Brother\ControlCenter2\brctrcen.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\WINDOWS\Logi_MwX.Exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\DellSupport\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\FinePixViewer\QuickDCF.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Dad\Desktop\dss.exe C:\DOCUME~1\Dad\MYDOCU~1\HIJACK~1\Dad.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sports.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [OSCD_Creator] c:\Dell\PreODM.EXE O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [Love default global mess] C:\Documents and Settings\All Users\Application Data\great coal love default\Seek For.exe O4 - HKLM\..\RunOnce: [OSCD_Creator] C:\Dell\PreODM.EXE /2 O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - Global Startup: Exif Launcher.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - http://www.stonyfield.com/coupons/scriptX/smsx.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- End of file - 7679 bytes -- Files created between 2008-05-01 and 2008-06-01 ----------------------------- 2008-05-30 19:44:33 0 d-------- C:\Documents and Settings\All Users\Application Data\great coal love default 2008-05-30 19:44:19 0 d-------- C:\Program Files\ooze about default 2008-05-17 15:03:28 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-05-17 15:03:27 0 d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-05-15 18:46:41 0 d-------- C:\Documents and Settings\All Users\Application Data\Oberon Games 2008-05-14 20:18:38 0 d-------- C:\cmdcons 2008-05-14 20:17:51 68096 --a------ C:\WINDOWS\zip.exe 2008-05-14 20:17:51 49152 --a------ C:\WINDOWS\VFind.exe 2008-05-14 20:17:51 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists> 2008-05-14 20:17:51 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller> 2008-05-14 20:17:51 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor> 2008-05-14 20:17:51 98816 --a------ C:\WINDOWS\sed.exe 2008-05-14 20:17:51 80412 --a------ C:\WINDOWS\grep.exe 2008-05-14 20:17:51 73728 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; > 2008-05-14 18:49:18 0 d-------- C:\WINDOWS\ERUNT 2008-05-10 11:45:33 0 d-------- C:\ie-spyad_zo 2008-05-10 11:01:59 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-10 11:01:51 0 d-------- C:\Program Files\SpywareBlaster 2008-05-09 21:45:13 0 d-------- C:\Program Files\Panda Security 2008-05-09 15:58:34 0 d-------- C:\Program Files\Yahoo! Games -- Find3M Report --------------------------------------------------------------- 2008-05-17 14:56:17 0 d-------- C:\Program Files\Java 2008-05-09 16:05:16 0 d-------- C:\Program Files\FrostWire 2008-04-19 14:29:55 0 d-------- C:\Program Files\Apple Software Update 2008-04-04 19:23:29 0 d-------- C:\Program Files\iTunes 2008-04-04 19:22:44 0 d-------- C:\Program Files\iPod 2008-04-04 19:17:27 0 d-------- C:\Program Files\QuickTime 2008-04-01 12:54:06 0 d-------- C:\Program Files\Common Files 2008-04-01 12:54:06 0 d-------- C:\Program Files\Common Files\xing shared 2008-04-01 12:53:57 0 d-------- C:\Program Files\Common Files\Real -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OSCD_Creator"="c:\Dell\PreODM.EXE" [10/31/2004 07:21 AM] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [11/20/2001 12:10 AM] "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [02/04/2002 10:32 PM] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [05/15/2008 07:19 PM] "ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [07/20/2004 10:34 AM] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [03/09/2007 11:09 AM] "Logitech Utility"="Logi_MwX.Exe" [12/17/2003 09:50 AM C:\WINDOWS\LOGI_MWX.EXE] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [10/09/2007 07:57 PM] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [04/01/2008 12:53 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [03/28/2008 11:37 PM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [10/09/2007 07:56 PM] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [03/23/2006 08:17 PM] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [03/23/2006 08:13 PM] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [03/23/2006 08:17 PM] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [03/25/2008 04:28 AM] "Love default global mess"="C:\Documents and Settings\All Users\Application Data\great coal love default\Seek For.exe" [06/01/2008 10:22 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [03/15/2007 11:09 AM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 07:00 AM] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [10/09/2007 07:56 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce] "OSCD_Creator"=C:\Dell\PreODM.EXE /2 C:\Documents and Settings\Dad\Start Menu\Programs\Startup\ DESKTOP.INI [8/10/2004 3:04:12 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DESKTOP.INI [8/10/2004 3:04:12 PM] Exif Launcher.lnk - C:\Program Files\FinePixViewer\QuickDCF.exe [7/16/2005 7:39:19 AM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2/17/1999 4:05:56 PM] Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2/14/2006 3:57:48 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=1 (0x1) "HideStartupScripts"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "HideLegacyLogonScripts"=0 (0x0) "HideLogoffScripts"=0 (0x0) "RunLogonScriptSync"=1 (0x1) "RunStartupScriptSync"=1 (0x1) "HideStartupScripts"=0 (0x0) -- End of Deckard's System Scanner: finished at 2008-06-01 10:30:42 ------------ |
|
|
|
|
06-01-2008, 08:52 AM
|
#11 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Warning! Your're in danger - need help
Open notepad and copy/paste the text in the quotebox below into it:
Quote:
Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========= Double-click ATF Cleaner.exe to open it Under Main choose: Windows Temp Current User Temp All Users Temp Cookies Temporary Internet Files Prefetch Java Cache *The other boxes are optional* Then click the Empty Selected button. If you have Firefox installed: Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. If you have Opera installed: Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt. Click Exit on the Main menu to close the program. ========== BitDefender Online Scan Go here and do the BitDefender online virus scan. * Click "I Agree" to agree to the EULA. * Allow the ActiveX control to install when prompted. * Leave the scanning options at default and press "Click here to scan" to begin the scan. * Please refrain from using the computer until the scan is finished. * When the scan is finished, click on "Click here to export the scan results" * Save the report to your desktop then come back here and post it in your next reply along with a new Hijack This log ========== Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ========== Logs Required C:\Combofix.txt BitDefender Scan Report Hijackthis Log |
|
|
|
|
|
06-01-2008, 04:23 PM
|
#12 (permalink) |
|
Registered User
Join Date: Oct 2007
Location: ohio
Posts: 12
OS: xp
|
Re: Warning! Your're in danger - need help
All worked ok...
Combo fix log (had to download a new copy cuz it said it was expired...) ComboFix 08-06-01.3 - Dad 2008-06-01 16:36:36.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.593 [GMT -4:00] Running from: C:\Documents and Settings\Dad\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Dad\Desktop\cfscript.txt * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\great coal love default C:\Documents and Settings\All Users\Application Data\great coal love default\Seek For.exe . ((((((((((((((((((((((((( Files Created from 2008-05-01 to 2008-06-01 ))))))))))))))))))))))))))))))) . 2008-05-30 19:44 . 2008-05-30 19:44 <DIR> d-------- C:\Program Files\ooze about default 2008-05-17 15:03 . 2008-05-17 15:03 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab 2008-05-17 15:03 . 2008-05-17 15:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-05-17 14:56 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\SYSTEM32\javacpl.cpl 2008-05-15 18:46 . 2008-05-15 18:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Oberon Games 2008-05-15 18:42 . 2006-03-23 20:12 139,264 --a------ C:\WINDOWS\SYSTEM32\igfxres.dll 2008-05-15 11:06 . 2006-03-23 20:38 61,440 --a------ C:\WINDOWS\SYSTEM32\iAlmCoIn_v4543.dll 2008-05-14 18:49 . 2008-05-14 18:49 <DIR> d-------- C:\WINDOWS\ERUNT 2008-05-14 18:40 . 2008-05-14 19:20 <DIR> d-------- C:\SDFix 2008-05-11 21:59 . 2008-05-11 21:59 <DIR> d-------- C:\Deckard 2008-05-10 11:45 . 2008-05-10 11:45 <DIR> d-------- C:\ie-spyad_zo 2008-05-10 11:01 . 2008-05-31 15:34 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-05-10 11:01 . 2008-05-31 15:40 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-09 21:45 . 2008-05-09 21:48 <DIR> d-------- C:\Program Files\Panda Security 2008-05-09 15:58 . 2008-05-09 17:10 <DIR> d-------- C:\Program Files\Yahoo! Games . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-17 18:56 --------- d-----w C:\Program Files\Java 2008-05-09 21:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst 2008-05-09 21:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games 2008-05-09 20:05 --------- d-----w C:\Program Files\FrostWire 2008-04-19 18:29 --------- d-----w C:\Program Files\Apple Software Update 2008-04-11 00:30 --------- d-----w C:\Documents and Settings\Guest\Application Data\Skype 2008-04-04 23:23 --------- d-----w C:\Program Files\iTunes 2008-04-04 23:22 --------- d-----w C:\Program Files\iPod 2008-04-04 23:17 --------- d-----w C:\Program Files\QuickTime 2008-04-01 16:54 --------- d-----w C:\Program Files\Common Files\xing shared 2008-04-01 16:53 --------- d-----w C:\Program Files\Common Files\Real 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\SYSTEM32\msjint40.dll 2008-03-27 08:12 151,583 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msjint40.dll 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\SYSTEM32\win32k.sys 2008-03-19 09:47 1,845,248 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\win32k.sys 2008-03-12 00:30 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2008-03-01 22:36 3,591,680 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll . ((((((((((((((((((((((((((((( snapshot_2008-05-17_14.26.41.73 ))))))))))))))))))))))))))))))))))))))))) . + 2008-02-26 11:48:44 297,984 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\SP2QFE\msctf.dll + 2007-03-06 01:22:36 14,048 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\spmsg.dll + 2007-03-06 01:22:41 213,216 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\spuninst.exe + 2007-03-06 01:22:34 22,752 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\update\spcustom.dll + 2007-03-06 01:22:59 716,000 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\update\update.exe + 2007-03-06 01:23:51 371,424 ----a-w C:\WINDOWS\$hf_mig$\KB932823-v3\update\updspapi.dll - 2008-05-15 15:08:10 2,048 --s-a-w C:\WINDOWS\BOOTSTAT.DAT + 2008-06-01 14:15:08 2,048 --s-a-w C:\WINDOWS\BOOTSTAT.DAT - 2000-08-31 12:00:00 73,728 ----a-w C:\WINDOWS\fdsv.exe + 2000-08-31 12:00:00 89,504 ----a-w C:\WINDOWS\fdsv.exe - 2008-03-29 18:45:49 1,146,232 ----a-w C:\WINDOWS\SYSTEM32\aswBoot.exe + 2008-05-15 23:24:43 1,152,888 ----a-w C:\WINDOWS\SYSTEM32\aswBoot.exe - 2008-03-29 18:23:22 95,608 ----a-w C:\WINDOWS\SYSTEM32\AVASTSS.scr + 2008-05-15 23:12:36 95,608 ----a-w C:\WINDOWS\SYSTEM32\AVASTSS.scr - 2004-08-04 11:00:00 294,400 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msctf.dll + 2008-02-26 11:59:50 294,912 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\msctf.dll - 2008-03-29 18:26:52 26,944 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\aavmker4.sys + 2008-05-15 23:13:26 26,944 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\aavmker4.sys - 2008-03-29 18:35:49 20,560 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\aswFsBlk.sys + 2008-05-15 23:16:06 20,560 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\aswFsBlk.sys - 2008-03-29 18:35:21 94,544 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\aswmon2.sys + 2008-05-15 23:18:33 94,416 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\aswmon2.sys - 2008-03-29 18:29:08 23,152 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\aswRdr.sys + 2008-05-15 23:15:29 23,152 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\aswRdr.sys - 2008-03-29 18:31:34 75,856 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\aswSP.sys + 2008-05-15 23:20:32 78,416 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\aswSP.sys - 2008-03-29 18:27:33 42,912 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\aswTdi.sys + 2008-05-15 23:14:11 42,912 ----a-w C:\WINDOWS\SYSTEM32\DRIVERS\aswTdi.sys - 2008-02-22 05:23:35 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe + 2008-03-25 05:28:39 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe - 2008-02-22 05:23:39 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe + 2008-03-25 05:28:43 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe - 2008-02-22 06:33:32 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe + 2008-03-25 06:37:01 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe + 2005-05-24 16:27:16 213,048 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll + 2007-08-29 19:47:20 94,208 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe + 2007-08-29 19:49:54 950,272 ----a-w C:\WINDOWS\SYSTEM32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll - 2004-08-04 11:00:00 294,400 ----a-w C:\WINDOWS\SYSTEM32\MSCTF.DLL + 2008-02-26 11:59:50 294,912 ----a-w C:\WINDOWS\SYSTEM32\msctf.dll + 2008-06-01 14:15:17 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_520.dat . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 19:56 202544] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OSCD_Creator"="c:\Dell\PreODM.EXE" [2004-10-31 07:21 408576] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-20 00:10 196608] "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 22:32 53248] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-15 19:19 79224] "ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2004-07-20 10:34 851968] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712] "Logitech Utility"="Logi_MwX.Exe" [2003-12-17 09:50 19968 C:\WINDOWS\LOGI_MWX.EXE] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 19:57 16384] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-01 12:53 185896] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 19:56 202544] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 20:17 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 20:13 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 20:17 118784] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Exif Launcher.lnk - C:\Program Files\FinePixViewer\QuickDCF.exe [2005-07-16 07:39:19 200704] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 16:05:56 65588] Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2006-02-14 15:57:48 819200] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.jxvd"= JetMPVx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"= "C:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\FrostWire\\FrostWire.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 19:20] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 19:16] R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-10-09 19:56] S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-06-12 05:27] S3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 04:28] . Contents of the 'Scheduled Tasks' folder "2008-06-01 17:00:00 C:\WINDOWS\Tasks\AEF05A589C5FD078.job" - c:\docume~1\momma\applic~1\oozeab~1\pop face dent.exe "2008-05-26 22:24:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-01 16:40:56 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-01 16:42:13 ComboFix-quarantined-files.txt 2008-06-01 20:41:46 ComboFix2.txt 2008-05-17 18:27:51 ComboFix3.txt 2008-05-15 00:22:43 Pre-Run: 8,037,986,304 bytes free Post-Run: 8,283,328,512 bytes free 164 --- E O F --- 2008-05-28 07:01:09 ATF Cleaner ran ok Bit Defender scan report: BitDefender Online Scanner Scan report generated at: Sun, Jun 01, 2008 - 18:08:47 Scan path: C:\;D:\; Statistics Time 01:18:29 Files 255494 Folders 8956 Boot Sectors 4 Archives 10328 Packed Files 13855 Results Identified Viruses 9 Infected Files 20 Suspect Files 0 Warnings 0 Disinfected 0 Deleted Files 20 Engines Info Virus Definitions 1255534 Engine build AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36) Scan plugins 16 Archive plugins 42 Unpack plugins 7 E-mail plugins 6 System plugins 5 Scan Settings First Action Disinfect Second Action Delete Heuristics Yes Enable Warnings Yes Scanned Extensions *; Exclude Extensions Scan Emails Yes Scan Archives Yes Scan Packed Yes Scan Files Yes Scan Boot Yes Scanned File Status C:\Documents and Settings\Dad\My Documents\hijackthis\backups\backup-20080508-193816-658.dll Detected with: Adware.Coupons.F C:\Documents and Settings\Dad\My Documents\hijackthis\backups\backup-20080508-193816-658.dll Deleted C:\Program Files\CursorZone\TrackingPostBack.exe Detected with: Adware.Netguide.A C:\Program Files\CursorZone\TrackingPostBack.exe Deleted C:\Program Files\MyWebSearchWB\bar\1.bin\NPMYSRWB.DLL Detected with: Adware.Toolbar.MyWebSearch.AC C:\Program Files\MyWebSearchWB\bar\1.bin\NPMYSRWB.DLL Deleted C:\QooBox\Quarantine\C\Program Files\SysCleaner\com\scsdelete.dll.vir Detected with: Adware.Ultimatedefender.AV C:\QooBox\Quarantine\C\Program Files\SysCleaner\com\scsdelete.dll.vir Deleted C:\QooBox\Quarantine\C\WINDOWS\sysqrnxstju.exe.vir Infected with: Trojan.Zlob.5038 C:\QooBox\Quarantine\C\WINDOWS\sysqrnxstju.exe.vir Deleted C:\QooBox\Quarantine\C\WINDOWS\syssfzvakqg.exe.vir Infected with: Trojan.Generic.255207 C:\QooBox\Quarantine\C\WINDOWS\syssfzvakqg.exe.vir Deleted C:\QooBox\Quarantine\C\WINDOWS\sysvtypkbjx.exe.vir Infected with: Trojan.Generic.255213 C:\QooBox\Quarantine\C\WINDOWS\sysvtypkbjx.exe.vir Deleted C:\QooBox\Quarantine\C\WINDOWS\sysxhtcwbse.exe.vir Infected with: Trojan.Generic.255294 C:\QooBox\Quarantine\C\WINDOWS\sysxhtcwbse.exe.vir Deleted C:\QooBox\Quarantine\C\WINDOWS\sysyeabdgfp.exe.vir Infected with: Trojan.Generic.255221 C:\QooBox\Quarantine\C\WINDOWS\sysyeabdgfp.exe.vir Deleted C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1153\A0121171.ocx Detected with: Adware.Coupons.F C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1153\A0121171.ocx Deleted C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1154\A0125358.dll Detected with: Adware.Ultimatedefender.AV C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1154\A0125358.dll Deleted C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1157\A0125451.exe Detected with: Adware.Ultimatedefender.AV C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1157\A0125451.exe Deleted C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1160\A0126550.dll Detected with: Adware.Ultimatedefender.AV C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1160\A0126550.dll Deleted C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1160\A0126552.exe Infected with: Trojan.Zlob.5038 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1160\A0126552.exe Deleted C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1160\A0126553.exe Infected with: Trojan.Generic.255207 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1160\A0126553.exe Deleted C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1160\A0126554.exe Infected with: Trojan.Generic.255213 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1160\A0126554.exe Deleted C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1160\A0126555.exe Infected with: Trojan.Generic.255294 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1160\A0126555.exe Deleted C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1160\A0126556.exe Infected with: Trojan.Generic.255221 C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1160\A0126556.exe Deleted C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1180\A0129592.exe Detected with: Adware.Netguide.A C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1180\A0129592.exe Deleted C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1180\A0129594.DLL Detected with: Adware.Toolbar.MyWebSearch.AC C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1180\A0129594.DLL Deleted Hijackthis log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:12:54 PM, on 6/1/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\brss01a.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Brother\ControlCenter2\brctrcen.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\WINDOWS\Logi_MwX.Exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\DellSupport\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\FinePixViewer\QuickDCF.exe C:\WINDOWS\explorer.exe C:\Program Files\internet explorer\iexplore.exe C:\Documents and Settings\Dad\My Documents\hijackthis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sports.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O4 - HKLM\..\Run: [OSCD_Creator] c:\Dell\PreODM.EXE O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - Global Startup: Exif Launcher.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - http://www.stonyfield.com/coupons/scriptX/smsx.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- End of file - 7752 bytes After running the combofix with the text insert, popups dropped off dramatically, if not stopped altogether... Thanks again for the help! |
|
|
|
|
06-01-2008, 04:49 PM
|
#13 (permalink) | |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Warning! Your're in danger - need help
Almost there.
Open HijackThis and click on 'Do a System Scan Only'. Check the following entries (If they still exist, make sure you do not miss any) R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/mywaybiz R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) Please remember to close all other windows, including browsers then click Fix checked. ========== Open notepad and copy/paste the text in the quotebox below into it: Quote:
Refering to the picture above, drag CFscript into ComboFix.exe Follow the prompts, and post the resulting log, C:\ComboFix.txt Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Warning: Do not mouseclick combofix's window whilst it's running. That may cause it to stall ========= Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ======== Logs Required C:\Combofix.txt Hijackthis Log |
|
|
|
|
|
06-02-2008, 08:24 AM
|
#14 (permalink) |
|
Registered User
Join Date: Oct 2007
Location: ohio
Posts: 12
OS: xp
|
Re: Warning! Your're in danger - need help
those worked fine. no notable changes to system.
combo fix log: ComboFix 08-06-01.3 - Dad 2008-06-02 10:07:40.4 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.508 [GMT -4:00] Running from: C:\Documents and Settings\Dad\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Dad\Desktop\cfscript.txt * Created a new restore point FILE :: C:\WINDOWS\Tasks\AEF05A589C5FD078.job . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\ooze about default C:\WINDOWS\Tasks\AEF05A589C5FD078.job . ((((((((((((((((((((((((( Files Created from 2008-05-02 to 2008-06-02 ))))))))))))))))))))))))))))))) . 2008-06-01 21:04 . 2008-06-01 22:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater 2008-06-01 16:47 . 2008-06-01 16:47 <DIR> d-------- C:\WINDOWS\LastGood 2008-06-01 16:47 . 2008-06-01 18:08 <DIR> d-------- C:\WINDOWS\BDOSCAN8 2008-05-17 15:03 . 2008-05-17 15:03 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab 2008-05-17 15:03 . 2008-05-17 15:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-05-17 14:56 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\SYSTEM32\javacpl.cpl 2008-05-15 18:46 . 2008-05-15 18:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Oberon Games 2008-05-15 18:42 . 2006-03-23 20:12 139,264 --a------ C:\WINDOWS\SYSTEM32\igfxres.dll 2008-05-15 11:06 . 2006-03-23 20:38 61,440 --a------ C:\WINDOWS\SYSTEM32\iAlmCoIn_v4543.dll 2008-05-14 18:49 . 2008-05-14 18:49 <DIR> d-------- C:\WINDOWS\ERUNT 2008-05-14 18:40 . 2008-05-14 19:20 <DIR> d-------- C:\SDFix 2008-05-11 21:59 . 2008-05-11 21:59 <DIR> d-------- C:\Deckard 2008-05-10 11:45 . 2008-05-10 11:45 <DIR> d-------- C:\ie-spyad_zo 2008-05-10 11:01 . 2008-05-31 15:34 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-05-10 11:01 . 2008-05-31 15:40 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-05-09 21:45 . 2008-05-09 21:48 <DIR> d-------- C:\Program Files\Panda Security 2008-05-09 15:58 . 2008-05-09 17:10 <DIR> d-------- C:\Program Files\Yahoo! Games . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-02 01:04 --------- d-----w C:\Program Files\Google 2008-06-01 21:23 --------- d-----w C:\Program Files\CursorZone 2008-05-17 18:56 --------- d-----w C:\Program Files\Java 2008-05-09 21:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst 2008-05-09 21:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games 2008-05-09 20:05 --------- d-----w C:\Program Files\FrostWire 2008-04-19 18:29 --------- d-----w C:\Program Files\Apple Software Update 2008-04-11 00:30 --------- d-----w C:\Documents and Settings\Guest\Application Data\Skype 2008-04-04 23:23 --------- d-----w C:\Program Files\iTunes 2008-04-04 23:22 --------- d-----w C:\Program Files\iPod 2008-04-04 23:17 --------- d-----w C:\Program Files\QuickTime 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\SYSTEM32\msjint40.dll 2008-03-27 08:12 151,583 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msjint40.dll 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\SYSTEM32\win32k.sys 2008-03-19 09:47 1,845,248 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\win32k.sys 2008-03-12 00:30 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat . ((((((((((((((((((((((((((((( snapshot_2008-06-01_16.41.31.90 ))))))))))))))))))))))))))))))))))))))))) . + 2008-06-01 20:47:51 45,056 ----a-w C:\WINDOWS\BDOSCAN8\avxdisk.dll + 2008-06-01 20:47:51 10,240 ----a-w C:\WINDOWS\BDOSCAN8\avxs.dll + 2008-06-01 20:47:52 27,136 ----a-w C:\WINDOWS\BDOSCAN8\avxt.dll + 2008-06-01 20:47:54 181,760 ----a-w C:\WINDOWS\BDOSCAN8\bdcore.dll + 2008-01-09 19:01:48 118,784 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll + 2008-01-09 19:01:48 53,248 ----a-w C:\WINDOWS\BDOSCAN8\ipsupd.dll + 2008-06-01 20:47:55 142,848 ----a-w C:\WINDOWS\BDOSCAN8\libfn.dll + 2008-06-01 20:47:52 86,016 ----a-w C:\WINDOWS\BDOSCAN8\librtvr.dll + 2008-01-09 19:01:48 53,248 ----a-w C:\WINDOWS\bdoscandel.exe + 2008-01-09 19:01:48 118,784 ----a-w C:\WINDOWS\Downloaded Program Files\bdupd.dll + 2008-01-09 19:01:48 53,248 ----a-w C:\WINDOWS\Downloaded Program Files\ipsupd.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 19:56 202544] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OSCD_Creator"="c:\Dell\PreODM.EXE" [2004-10-31 07:21 408576] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [2001-11-20 00:10 196608] "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 22:32 53248] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-15 19:19 79224] "ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [2004-07-20 10:34 851968] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712] "Logitech Utility"="Logi_MwX.Exe" [2003-12-17 09:50 19968 C:\WINDOWS\LOGI_MWX.EXE] "dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 19:57 16384] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-01 12:53 185896] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 19:56 202544] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 20:17 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 20:13 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 20:17 118784] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Exif Launcher.lnk - C:\Program Files\FinePixViewer\QuickDCF.exe [2005-07-16 07:39:19 200704] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 16:05:56 65588] Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [2006-02-14 15:57:48 819200] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.jxvd"= JetMPVx.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"= "C:\\Program Files\\Microsoft Games\\Rise of Nations\\thrones.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\FrostWire\\FrostWire.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 19:20] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 19:16] R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-10-09 19:56] S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;C:\WINDOWS\system32\Drivers\BrSerIf.sys [2004-06-12 05:27] S3 BrUsbSer;Brother MFC USB Serial WDM Driver;C:\WINDOWS\system32\Drivers\BrUsbSer.sys [2004-01-10 04:28] *Newly Created Service* - GUSVC . Contents of the 'Scheduled Tasks' folder "2008-05-26 22:24:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-02 10:10:42 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-02 10:13:08 ComboFix-quarantined-files.txt 2008-06-02 14:12:09 ComboFix2.txt 2008-06-01 20:42:14 ComboFix3.txt 2008-05-17 18:27:51 ComboFix4.txt 2008-05-15 00:22:43 Pre-Run: 8,222,621,696 bytes free Post-Run: 8,215,748,608 bytes free 136 --- E O F --- 2008-05-28 07:01:09 hijackthis log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:17:50 AM, on 6/2/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\brss01a.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Brother\ControlCenter2\brctrcen.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\WINDOWS\Logi_MwX.Exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Dell Support Center\bin\sprtcmd.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe C:\Program Files\DellSupport\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\FinePixViewer\QuickDCF.exe C:\WINDOWS\system32\winlogon.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\explorer.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Dad\My Documents\hijackthis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sports.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing) O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O4 - HKLM\..\Run: [OSCD_Creator] c:\Dell\PreODM.EXE O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter O4 - HKUS\S-1-5-21-4050051114-845005537-3285333941-1006\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'Momma') O4 - HKUS\S-1-5-21-4050051114-845005537-3285333941-1006\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Momma') O4 - HKUS\S-1-5-21-4050051114-845005537-3285333941-1006\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1 (User 'Momma') O4 - HKUS\S-1-5-21-4050051114-845005537-3285333941-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Momma') O4 - HKUS\S-1-5-21-4050051114-845005537-3285333941-1006\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter (User 'Momma') O4 - HKUS\S-1-5-21-4050051114-845005537-3285333941-1006\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (User 'Momma') O4 - HKUS\S-1-5-21-4050051114-845005537-3285333941-1006\..\Run: [Army 64] C:\DOCUME~1\Momma\APPLIC~1\OOZEAB~1\Drv for axis.exe (User 'Momma') O4 - HKUS\S-1-5-21-4050051114-845005537-3285333941-1006\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Momma') O4 - Global Startup: Exif Launcher.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - http://www.stonyfield.com/coupons/scriptX/smsx.cab O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- End of file - 9433 bytes |
|
|
|
|
06-02-2008, 10:37 AM
|
#15 (permalink) |
|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: Warning! Your're in danger - need help
Delete SDFix from your desktop, also delete this folder C:\SDFix.
You can keep ATF-Cleaner if you wish. ======== Well done Kevin, your logs are clean. Click start>run>type(or copy/paste command into run box): ComboFix /u Click ok. ======= Clear IE7 cookies *On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab. *On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too]. *Click OK, and then click OK again. Clear Firefox cookies/cache • Select "Tools" • Select "Options". • Select "Privacy". • In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want. • Click OK. • In Private area click "Clear Now". ------------------------------------------------------------------------------------------- MICROSOFT UPDATES 1.Click Start,Run, type sysdm.cpl, and then press OK. 2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended). Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday". ------------------------------------------------------------------------------------------ Useful Information and Programs to keep you safe. TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages: * Content category * Phishing scam detection * Site reputation * Page reputation WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites. WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites. Note:Only compatible with Firefox 1.5 and higher. -------------------------------------------------------------------------------------- Alternate Browsers Try the following free alternate browsers rather than Internet Explorer Avant Firefox Opera K-Meleon ------------------------------------------------------------------------------------------ Free Antispyware Products SuperAntiSpyware Ad-Aware Spybot S&D Download SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items. Download Spyware Guard to catch and block spyware before it can execute. ------------------------------------------------------------------ IE-Spyad™ is a freeware utility that places more than 4000 dubious websites and domains in the Internet Explorer Restricted List. Download and installation instructions for IE-Spyad™ Here ----------------------------------------- The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file. If your having trouble downloading & extracting,see link below for guidance: http://www.mvps.org/winhelp2002/hosts2.htm Once you have extracted the host file,double click on it and a new window will open. Double-click on mvps.batand follow the prompts --------------------------------------------------------------- Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here: Using Winpatrol to protect your computer. ---------------------------------------- SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users. Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released. ============================================== Also, please take a look at these well written articles: PC Safety and Security--What Do I Need? HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein THE ANTI-SPYWARE TUTORIAL MAKING INTERNET EXPLORER SAFER Understanding and Using Firewalls **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. Please reply to this thread once more, as we may mark this as resolved, thanks. |
|
|
|
|
06-03-2008, 04:44 PM
|
#16 (permalink) |
|
Registered User
Join Date: Oct 2007
Location: ohio
Posts: 12
OS: xp
|
Re: Warning! Your're in danger - need help
Thanks very much!
Fabulous response time, excellent help. Being the resident expert of the house, I have used the info on tsf to fix several other folks problems. The panic that sets in when I have no idea what to do next on my own pc is painful. You really did a great job! I'm considering the "appropriate" donation level to thank you for your efforts! |
|
|
|
| Thread Tools | |
|
|
