|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
01-16-2009, 11:18 PM
|
#1 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 8
OS: xp sp2
|
antivirus updater and antivirus sites blocked
hi,
i am running xp sp2 on and intel centrino notebook. since the last week i am unable to update my trendmicro virus pattern files. i am also unable to access any antivirus websites. another annoying thing that i would like to add is that i once had eset antivirus installed and although i have installed it, some parts of it still seem to be running. the add remove programmes doesnt show this eset file. i am copy pasting the dds.txt below DDS (Ver_09-01-07.01) - NTFSx86 Run by Kashikar at 11:26:17.96 on Sat 01/17/2009 Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_07 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.767.306 [GMT 5.5:30] AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) ============== Running Processes =============== C:\WINDOWS\system32\ibmpmsvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\TpShocks.exe C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe D:\software\LClock\lclock.exe svchost.exe C:\Program Files\NUS-VPN\cvpnd.exe C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\ISS\issSensors\DesktopProtection\RapApp.exe D:\software\KbStart\KbStart.exe D:\software\ObjectDock\ObjectDock.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\system32\TpKmpSVC.exe C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe C:\WINDOWS\System32\urtclsvc.exe C:\Program Files\ISS\issSensors\DesktopProtection\vpatch.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Trend Micro\OfficeScan Client\PccNTMon.exe C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe C:\WINDOWS\TEMP\LT7655.EXE C:\Program Files\Trend Micro\OfficeScan Client\ofcpfwsvc.exe C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe C:\Documents and Settings\Kashikar\Desktop\dds.com ============== Pseudo HJT Report =============== uInternet Connection Wizard,ShellNext = iexplore BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [amva] c:\windows\system32\amvo.exe uRun: [LClock] d:\software\lclock\lclock.exe uRun: [MsServer] msfir80.exe uRun: [TPKMAPMN] c:\program files\thinkpad\utilities\TpKmapMn.exe uRun: [QuickGammaLoader] d:\software\quickgamma\QuickGammaLoader.exe uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [OfficeScanNT Monitor] "c:\program files\trend micro\officescan client\pccntmon.exe" -HideWindow mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe" mRun: [TPHOTKEY] c:\progra~1\thinkpad\pkgmgr\hotkey\TPHKMGR.exe mRun: [TpShocks] TpShocks.exe mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless dRun: [Nokia.PCSync] d:\software\nokia\nokia pc suite 6\PcSync2.exe /NoDialog StartupFolder: c:\documents and settings\kashikar\start menu\programs\startup\cleantemp.bat StartupFolder: c:\docume~1\kashikar\startm~1\programs\startup\kbstar~1.lnk - d:\software\kbstart\KbStart.exe StartupFolder: c:\docume~1\kashikar\startm~1\programs\startup\stardo~1.lnk - d:\software\objectdock\ObjectDock.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobea~1.lnk - c:\windows\installer\{ac76ba86-1033-0000-7760-000000000002}\SC_Acrobat.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Download with GetRight - d:\software\getright\GRdownload.htm IE: E&xport to Microsoft Excel - d:\software\office\office11\EXCEL.EXE/3000 IE: Open with GetRight Browser - d:\software\getright\GRbrowse.htm IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\software\office\office11\REFIEBAR.DLL LSP: c:\program files\iss\isssensors\desktopprotection\ibe\ICELSP_8.0.614.2.dll TCP: {1D63A41E-DF9D-4E8A-8A76-24E9B107375D} = 192.169.1.1,203.77.200.10 Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: AtiExtEvent - Ati2evxx.dll Notify: igfxcui - igfxsrvc.dll Notify: MCPClient - c:\progra~1\common~1\stardock\mcpstub.dll SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - c:\progra~1\common~1\stardock\MCPCore.dll LSA: Notification Packages = scecli pwdmon ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\kashikar\applic~1\mozilla\firefox\profiles\zqmpbm6u.default\ FF - prefs.js: browser.startup.homepage - hxxp://vkashi.googlepages.com/home FF - prefs.js: network.proxy.ftp - 202.97.149.167 FF - prefs.js: network.proxy.ftp_port - 80 FF - prefs.js: network.proxy.gopher - 202.97.149.167 FF - prefs.js: network.proxy.gopher_port - 80 FF - prefs.js: network.proxy.http - 202.97.149.167 FF - prefs.js: network.proxy.http_port - 80 FF - prefs.js: network.proxy.socks - 202.97.149.167 FF - prefs.js: network.proxy.socks_port - 80 FF - prefs.js: network.proxy.ssl - 202.97.149.167 FF - prefs.js: network.proxy.ssl_port - 80 FF - prefs.js: network.proxy.type - 4 FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll FF - plugin: d:\software\adobereader\reader\browser\nppdf32.dll FF - plugin: d:\software\realplayer\netscape6\nppl3260.dll FF - plugin: d:\software\realplayer\netscape6\nprjplug.dll FF - plugin: d:\software\realplayer\netscape6\nprpjplug.dll ============= SERVICES / DRIVERS =============== R0 Shockprf;Shockprf;c:\windows\system32\drivers\shockprf.sys [2004-7-30 58568] R1 CDAWDM;CDAWDM;c:\windows\system32\drivers\cdawdm.sys [2006-4-4 46735] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2007-12-21 33800] R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [2004-7-30 15360] R3 MakoNT;MakoNT;c:\windows\system32\drivers\makont.sys [2005-11-15 76913] R3 rap;rap;c:\windows\system32\drivers\RapDrv.sys [2004-10-12 46001] R4 ibmfilter;ibmfilter;c:\windows\system32\drivers\ibmfilter.sys [2004-3-20 63872] R4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-12-24 206096] R4 ofcpfwsvc;OfficeScanNT Personal Firewall;c:\program files\trend micro\officescan client\OfcPfwSvc.exe [2005-2-8 225360] R4 ShockMgr;ShockMgr;c:\windows\system32\drivers\ShockMgr.sys [2004-7-30 4433] R4 TmFilter;Trend Micro Filter;c:\program files\trend micro\officescan client\tmxpflt.sys [2003-9-3 205328] R4 TmPreFilter;Trend Micro PreFilter;c:\program files\trend micro\officescan client\tmpreflt.sys [2003-9-3 36368] R4 urtclientservice;URT Client Service;c:\windows\system32\urtclsvc.exe [2005-11-15 118784] R4 VPatch;ISS Buffer Overflow Exploit Prevention;c:\program files\iss\isssensors\desktopprotection\vpatch.exe [2005-11-15 422237] S3 BlackICE;BlackICE;c:\program files\iss\isssensors\desktopprotection\blackd.exe [2004-10-12 1994828] S3 lrphpzcs;lrphpzcs;\??\c:\windows\system32\02.tmp --> c:\windows\system32\02.tmp [?] S3 RapFile;RapFile;c:\windows\system32\drivers\RapFile.sys [2004-10-12 36676] S3 RapNet;RapNet;c:\windows\system32\drivers\RapNet.sys [2004-10-12 24344] S3 sxyynd;sxyynd;c:\windows\system32\01.tmp [2009-1-8 4096] S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-11-19 280344] S4 black;black;c:\windows\system32\drivers\blackcat.sys [2005-11-15 234219] S4 ekrn;Eset Service;d:\software\eset\ekrn.exe --> d:\software\eset\ekrn.exe [?] S4 nrsinfnz;Installer Driver;c:\windows\system32\svchost.exe -k netsvcs [1980-1-1 14336] =============== Created Last 30 ================ 2009-01-17 04:48 54,156 a---h--- c:\windows\QTFont.qfn 2009-01-17 04:48 1,409 a------- c:\windows\QTFont.for 2009-01-12 09:29 <DIR> --d----- c:\docume~1\alluse~1\applic~1\DesignBuilder 2009-01-12 09:28 115,920 a------- c:\windows\system32\MSINET.OCX 2009-01-12 09:28 2,903,023 a------- c:\windows\system32\pdfnet.res 2009-01-12 09:28 4,608 a------- c:\windows\system32\Rsrc32.dll 2009-01-12 09:28 2,544 a------- c:\windows\system32\pdf2image.lib 2009-01-12 09:28 1,312 a------- c:\windows\system32\rsrc16.dll 2009-01-12 09:28 2,899,968 a------- c:\windows\system32\pdf2image.dll 2009-01-12 09:28 1,937,408 a------- c:\windows\system32\FreeImage.dll 2009-01-12 09:28 434,252 a------- c:\windows\system32\MSVCRTD.DLL 2009-01-08 08:29 4,096 a------- c:\windows\system32\01.tmp 2009-01-06 14:30 0 a------- c:\windows\system32\09.tmp 2009-01-06 14:30 171,376 a--shr-- c:\windows\system32\rubuqzc.dll 2009-01-05 13:29 <DIR> --dshr-- C:\resycled 2009-01-05 13:29 <DIR> --d----- c:\program files\videosoft 2008-12-24 14:24 <DIR> --d----- c:\program files\common files\McAfee 2008-12-24 14:23 <DIR> --d----- c:\program files\McAfee 2008-12-23 09:03 <DIR> --d----- c:\program files\Autodesk Revit 7.0 ==================== Find3M ==================== 2005-12-24 11:30 20 ----h--- c:\docume~1\alluse~1\applic~1\PKP_DLea.DAT 2007-03-03 10:32 8 a--shr-- c:\windows\neoqaz2.dll 2008-02-17 11:20 429,069 a--shr-- c:\windows\system\svc.exe 2007-11-08 20:05 155,884 a--sh--- c:\windows\system32\fiber_c58.VIR 2007-11-08 20:05 41,598 a--sh--- c:\windows\system32\imapdb_c58.VIR 2007-11-08 20:05 438,398 a--sh--- c:\windows\system32\imapdc_c58.VIR 2007-11-08 20:05 36,478 a--sh--- c:\windows\system32\imapdd_c58.VIR 2007-11-08 20:05 99,840 a--sh--- c:\windows\system32\imapde.dll 2007-11-08 20:05 958,588 a--sh--- c:\windows\system32\imapd_c58.VIR ============= FINISH: 11:26:39.58 =============== |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
01-18-2009, 07:30 PM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,636
OS: XP SP3
|
Re: antivirus updater and antivirus sites blocked
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ Please visit this webpage for download links, and instructions for running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix. Please post the C:\ComboFix.txt in your next reply for further review. ------------------------------------------------------ |
|
|
|
|
01-24-2009, 06:21 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 8
OS: xp sp2
|
Re: antivirus updater and antivirus sites blocked
sorry for the delay in posting this
ComboFix 09-01-21.04 - Kashikar 2009-01-24 18:36:38.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.767.434 [GMT 5.5:30] Running from: c:\documents and settings\Kashikar\Desktop\ComboFix.exe AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat c:\documents and settings\All Users\Documents\_desktop.ini c:\documents and settings\All Users\Documents\Adobe PDF\_desktop.ini c:\documents and settings\All Users\Documents\Adobe PDF\Data\_desktop.ini c:\documents and settings\All Users\Documents\Adobe PDF\Data\Desktop_.ini c:\documents and settings\All Users\Documents\Adobe PDF\Desktop_.ini c:\documents and settings\All Users\Documents\Adobe PDF\Example Files\_desktop.ini c:\documents and settings\All Users\Documents\Adobe PDF\Example Files\Desktop_.ini c:\documents and settings\All Users\Documents\Adobe PDF\Extras\_desktop.ini c:\documents and settings\All Users\Documents\Adobe PDF\Extras\Desktop_.ini c:\documents and settings\All Users\Documents\Adobe PDF\Settings\_desktop.ini c:\documents and settings\All Users\Documents\Adobe PDF\Settings\Desktop_.ini c:\documents and settings\All Users\Documents\Adobe PDF\Startup\_desktop.ini c:\documents and settings\All Users\Documents\Adobe PDF\Startup\Desktop_.ini c:\documents and settings\All Users\Documents\My Music\_desktop.ini c:\documents and settings\All Users\Documents\My Music\Desktop_.ini c:\documents and settings\All Users\Documents\My Music\My Playlists\_desktop.ini c:\documents and settings\All Users\Documents\My Music\My Playlists\Desktop_.ini c:\documents and settings\All Users\Documents\My Music\Sample Music\_desktop.ini c:\documents and settings\All Users\Documents\My Music\Sample Music\Desktop_.ini c:\documents and settings\All Users\Documents\My Music\Sample Playlists\_desktop.ini c:\documents and settings\All Users\Documents\My Music\Sample Playlists\000777CF\_desktop.ini c:\documents and settings\All Users\Documents\My Music\Sample Playlists\000777CF\Desktop_.ini c:\documents and settings\All Users\Documents\My Music\Sample Playlists\Desktop_.ini c:\documents and settings\All Users\Documents\My Music\Sync Playlists\_desktop.ini c:\documents and settings\All Users\Documents\My Music\Sync Playlists\000C0976\_desktop.ini c:\documents and settings\All Users\Documents\My Music\Sync Playlists\000C0976\Desktop_.ini c:\documents and settings\All Users\Documents\My Music\Sync Playlists\Desktop_.ini c:\documents and settings\All Users\Documents\My Pictures\_desktop.ini c:\documents and settings\All Users\Documents\My Pictures\Desktop_.ini c:\documents and settings\All Users\Documents\My Pictures\Sample Pictures\_desktop.ini c:\documents and settings\All Users\Documents\My Pictures\Sample Pictures\Desktop_.ini c:\documents and settings\All Users\Documents\My Videos\_desktop.ini c:\documents and settings\All Users\Documents\My Videos\Desktop_.ini c:\documents and settings\All Users\documents\setup.exe c:\documents and settings\All Users\Documents\Stardock\_desktop.ini c:\program files\videosoft c:\program files\videosoft\Uninstall.exe C:\resycled c:\windows\IE4 Error Log.txt c:\windows\pi.exe c:\windows\system32\drivers\msqpdxduybwwxy.sys c:\windows\system32\msqpdxqmqsipfa.dll c:\windows\ufdata2000.log D:\resycled ----- BITS: Possible infected sites ----- hxxp://windowsupdate.nus.edu.sg . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_MSQPDXSERV.SYS ((((((((((((((((((((((((( Files Created from 2008-12-24 to 2009-01-24 ))))))))))))))))))))))))))))))) . 2009-01-17 12:09 . 2008-12-07 14:51 23,992 --a------ c:\windows\system32\drivers\rspSanity32.sys 2009-01-17 11:27 . 2009-01-17 11:27 250 --a------ c:\windows\gmer.ini 2009-01-17 04:48 . 2009-01-17 04:48 54,156 --ah----- c:\windows\QTFont.qfn 2009-01-17 04:48 . 2009-01-17 04:48 1,409 --a------ c:\windows\QTFont.for 2009-01-12 09:29 . 2009-01-12 09:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\DesignBuilder 2009-01-12 09:28 . 2009-01-12 09:28 <DIR> d-------- c:\documents and settings\Kashikar\Application Data\InstallShield Installation Information 2009-01-12 09:28 . 2007-06-15 15:22 2,903,023 --a------ c:\windows\system32\pdfnet.res 2009-01-12 09:28 . 2008-07-24 10:46 2,899,968 --a------ c:\windows\system32\pdf2image.dll 2009-01-12 09:28 . 2007-11-19 20:10 1,937,408 --a------ c:\windows\system32\FreeImage.dll 2009-01-12 09:28 . 2000-03-07 00:00 434,252 --a------ c:\windows\system32\MSVCRTD.DLL 2009-01-12 09:28 . 2000-05-21 23:00 115,920 --a------ c:\windows\system32\MSINET.OCX 2009-01-12 09:28 . 1996-08-24 11:11 4,608 --a------ c:\windows\system32\Rsrc32.dll 2009-01-12 09:28 . 2008-07-24 10:46 2,544 --a------ c:\windows\system32\pdf2image.lib 2009-01-12 09:28 . 1999-04-23 22:22 1,312 --a------ c:\windows\system32\rsrc16.dll 2009-01-06 14:30 . 2009-01-06 14:30 0 --a------ c:\windows\system32\09.tmp 2008-12-24 18:18 . 2008-12-24 18:18 <DIR> d-------- c:\documents and settings\LocalService\Application Data\SACore 2008-12-24 14:24 . 2008-12-24 14:24 <DIR> d-------- c:\program files\Common Files\McAfee 2008-12-24 14:23 . 2008-12-26 09:21 <DIR> d-------- c:\program files\McAfee . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-17 06:26 --------- d-----w c:\program files\PC-Doctor for Windows 2009-01-16 11:08 --------- d-----w c:\documents and settings\All Users\Application Data\pdf995 2009-01-15 04:32 --------- d-----w c:\documents and settings\Kashikar\Application Data\wsInspector 2009-01-09 04:48 --------- d-----w c:\documents and settings\All Users\Application Data\Autodesk 2009-01-09 04:47 --------- d-----w c:\program files\Common Files\Autodesk Shared 2009-01-09 04:40 --------- d-----w c:\program files\Java 2009-01-09 04:09 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-24 09:49 --------- d-----w c:\documents and settings\Kashikar\Application Data\SiteAdvisor 2008-12-24 08:54 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee 2008-12-23 03:33 --------- d-----w c:\program files\Autodesk Revit 7.0 2008-12-17 11:06 --------- d-----w c:\documents and settings\All Users\Application Data\IESLink 2008-12-17 03:01 --------- d-----w c:\program files\AutoCAD 2008 2008-12-17 02:56 --------- d-----w c:\program files\Hewlett-Packard 2008-12-10 12:18 --------- d-----w c:\documents and settings\All Users\Application Data\Viper 2005-12-24 06:00 20 ---h--w c:\documents and settings\All Users\Application Data\PKP_DLea.DAT 2007-03-03 05:02 8 --sha-r c:\windows\neoqaz2.dll 2008-02-17 05:50 429,069 --sha-r c:\windows\system\svc.exe 2007-11-08 14:35 99,840 --sha-w c:\windows\system32\imapde.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LClock"="d:\software\LClock\lclock.exe" [2004-09-19 65536] "TPKMAPMN"="c:\program files\ThinkPad\Utilities\TpKmapMn.exe" [2003-10-23 32768] "QuickGammaLoader"="d:\software\QuickGamma\QuickGammaLoader.exe" [2005-03-27 68096] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OfficeScanNT Monitor"="c:\program files\Trend Micro\OfficeScan Client\pccntmon.exe" [2004-07-07 335872] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-11-15 180269] "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-09-15 110592] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-09-15 512000] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-11-15 155648] "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-07-02 802816] "TPHOTKEY"="c:\progra~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [2004-03-10 94208] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-07-02 700416] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 c:\windows\system32\bthprops.cpl] "TpShocks"="TpShocks.exe" [2003-12-17 c:\windows\system32\TpShocks.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Nokia.PCSync"="d:\software\nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088] c:\documents and settings\Kashikar\Start Menu\Programs\Startup\ cleantemp.bat [2009-01-12 30] KbStart.exe.lnk - d:\software\KbStart\KbStart.exe [2008-04-22 228864] Stardock ObjectDock.lnk - d:\software\ObjectDock\ObjectDock.exe [2008-01-20 3450608] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-05-31 25214] Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-11-17 110592] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient] 2005-01-31 15:13 49152 c:\progra~1\COMMON~1\Stardock\MCPStub.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli pwdmon [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] --a--c--- 2004-02-11 09:40 335872 c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMMLREF] --a------ 2003-12-25 14:06 20480 c:\program files\ThinkPad\Utilities\BMMLREF.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMMMONWND] --a------ 2003-12-25 14:06 394752 c:\progra~1\ThinkPad\UTILIT~1\BATINFEX.DLL [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] --a------ 2004-08-22 14:35 81920 d:\software\daemon\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] --a--c--- 2003-10-22 13:34 114741 c:\windows\system32\dla\tfswctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EZEJMNAP] --a------ 2003-12-25 14:34 208896 c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] --a------ 2003-12-16 05:37 118784 c:\windows\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IBMPRC] --a------ 2004-03-20 00:42 90112 c:\ibmtools\utils\ibmprc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] --a------ 2003-12-16 05:50 155648 c:\windows\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1] --a------ 2001-08-18 14:30 44032 c:\windows\ime\imkr6_1\imekrmig.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1] --a------ 2004-08-04 11:02 208952 c:\windows\ime\imjp8_1\imjpmig.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless] --a------ 2006-07-02 19:20 700416 c:\program files\Intel\Wireless\Bin\iFrmewrk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2004-10-13 21:54 1694208 c:\program files\messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002] --a------ 2002-08-29 10:09 59392 c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeScanNT Monitor] --a------ 2004-07-07 10:41 335872 c:\program files\Trend Micro\OfficeScan Client\PccNTMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A] --a------ 2002-08-29 10:09 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync] --a------ 2002-08-29 10:09 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2005-11-15 08:27 155648 c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh] --a------ 2005-09-15 11:27 512000 c:\program files\Synaptics\SynTP\SynTPEnh.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr] --a------ 2005-09-15 11:27 110592 c:\program files\Synaptics\SynTP\SynTPLpr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2005-11-15 09:47 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPKMAPHELPER] --a------ 2003-10-24 12:09 897024 c:\program files\ThinkPad\Utilities\TpKmapAp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UC_Start] --a------ 2003-10-01 04:09 36864 c:\program files\IBM\Updater\ucstartup.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager] --a------ 2003-08-19 13:31 110592 c:\program files\Common Files\Sonic\Update Manager\sgtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange] --a------ 2004-11-30 16:37 65536 c:\windows\system32\Ati2mdxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] --a------ 2004-08-04 13:26 380416 c:\windows\system32\irprops.cpl [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\S3TRAY2] --a--c--- 2001-10-12 12:02 69632 c:\windows\system32\S3Tray2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TP4EX] --a--c--- 2002-09-04 13:35 53248 c:\windows\system32\TP4EX.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "d:\\software\\yahoo\\Messenger\\YahooMessenger.exe"= "d:\\software\\yahoo\\Messenger\\YServer.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3088:TCP"= 3088:TCP:opgqru R0 Shockprf;Shockprf;c:\windows\system32\drivers\shockprf.sys [2004-07-30 58568] R1 CDAWDM;CDAWDM;c:\windows\system32\drivers\cdawdm.sys [2006-04-04 46735] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2007-12-21 33800] R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [2004-07-30 15360] R3 MakoNT;MakoNT;c:\windows\system32\drivers\makont.sys [2005-11-15 76913] R3 rap;rap;c:\windows\system32\drivers\RapDrv.sys [2004-10-12 46001] R4 ibmfilter;ibmfilter;c:\windows\system32\drivers\ibmfilter.sys [2004-03-20 63872] R4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-12-24 206096] R4 ShockMgr;ShockMgr;c:\windows\system32\drivers\ShockMgr.sys [2004-07-30 4433] R4 TmFilter;Trend Micro Filter;c:\program files\Trend Micro\OfficeScan Client\tmxpflt.sys [2003-09-03 205328] R4 TmPreFilter;Trend Micro PreFilter;c:\program files\Trend Micro\OfficeScan Client\tmpreflt.sys [2003-09-03 36368] R4 urtclientservice;URT Client Service;c:\windows\system32\urtclsvc.exe [2005-11-15 118784] R4 VPatch;ISS Buffer Overflow Exploit Prevention;c:\program files\ISS\issSensors\DesktopProtection\vpatch.exe [2005-11-15 422237] S3 BlackICE;BlackICE;c:\program files\ISS\issSensors\DesktopProtection\blackd.exe [2004-10-12 1994828] S3 RapFile;RapFile;c:\windows\system32\drivers\RapFile.sys [2004-10-12 36676] S3 RapNet;RapNet;c:\windows\system32\drivers\RapNet.sys [2004-10-12 24344] S3 rspSanity;rspSanity;c:\windows\system32\drivers\rspSanity32.sys [2009-01-17 23992] S4 black;black;c:\windows\system32\drivers\blackcat.sys [2005-11-15 234219] S4 ekrn;Eset Service;d:\software\eset\ekrn.exe --> d:\software\eset\ekrn.exe [?] S4 nrsinfnz;Installer Driver;c:\windows\system32\svchost.exe -k netsvcs [1980-01-01 14336] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs nrsinfnz [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0158a2dd-1d79-11dc-a72c-000e3537e43b}] \Shell\Auto\command - G:\sal.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{024c7f20-6985-11db-a5dd-000d6075fc18}] \Shell\Auto\command - G:\sal.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13d01106-bbfb-11dc-a8ad-000d6075fc18}] \Shell\AutoRun\command - G:\semo2x.exe \Shell\explore\Command - G:\semo2x.exe \Shell\open\Command - G:\semo2x.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15bfea10-c4c8-11dc-a8ca-000d6075fc18}] \Shell\AutoRun\command - G:\xn1i9x.com \Shell\explore\Command - G:\xn1i9x.com \Shell\open\Command - G:\xn1i9x.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1adb4040-8d84-11db-a609-a3ce676856d1}] \Shell\Auto\command - G:\sal.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b59c1f3-990a-11da-a498-000d6075fc18}] \Shell\AutoRun\command - Iexplores.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bb22aa0-6115-11dc-a7e8-000e3537e43b}] \Shell\AutoRun\command - G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bb22aa6-6115-11dc-a7e8-000e3537e43b}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bb22aa8-6115-11dc-a7e8-000e3537e43b}] \Shell\Open(&O)\command - RECYCLED\appmgmt.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bb22aa9-6115-11dc-a7e8-000e3537e43b}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bb22aad-6115-11dc-a7e8-000e3537e43b}] \Shell\AutoRun\command - G:\ntde1ect.com \Shell\explore\Command - G:\ntde1ect.com \Shell\open\Command - G:\ntde1ect.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2cc88c64-59f6-11dc-a7d5-000d6075fc18}] \Shell\AutoRun\command - G:\ntde1ect.com \Shell\explore\Command - G:\ntde1ect.com \Shell\open\Command - G:\ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ccba32f-0ea0-11dd-a943-000d6075fc18}] \Shell\AutoRun\command - G:\svc.exe \Shell\explore\Command - G:\svc.exe \Shell\open\Command - G:\svc.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41997600-a1ac-11dc-a86b-000e3537e43b}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL exiplorer.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{61079cf1-da3d-11dc-a8ec-000d6075fc18}] \Shell\AutoRun\command - h:\system\DriveGuard\DriveProtect.exe -run* \Shell\Explore\Command - h:\system\DriveGuard\DriveProtect.exe -run** \Shell\Open\Command - h:\system\DriveGuard\DriveProtect.exe -run* [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6636a9c0-5ac0-11dc-a7d8-000e3537e43b}] \Shell\AutoRun\command - g:\system\Security\DriveGuard.exe -run \Shell\Explore\Command - g:\system\Security\DriveGuard.exe -run \Shell\Open\Command - g:\system\Security\DriveGuard.exe -run [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6aa6db97-bda3-11dc-a8b3-000d6075fc18}] \Shell\AutoRun\command - G:\nideiect.com \Shell\explore\Command - G:\nideiect.com \Shell\open\Command - G:\nideiect.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{74293580-3992-11dc-a783-000d6075fc18}] \Shell\Auto\command - G:\sal.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{817fbac1-44a7-11dc-a799-000d6075fc18}] \Shell\AutoRun\command - G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{87dc8811-e06c-11dc-a8f4-000d6075fc18}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL exiplorer.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8956c240-d71d-11dd-aad8-000e3537e43b}] \Shell\Auto\command - G:\WINDOWS \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL WINDOWS [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{898faf30-10cd-11dc-a6fd-000e3537e43b}] \Shell\Auto\command - sal.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{898faf31-10cd-11dc-a6fd-000e3537e43b}] \Shell\Auto\command - sal.xls.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sal.xls.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d5cbeed-601d-11dc-a7e7-000e3537e43b}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8dab18b1-5d06-11dc-a7e2-000e3537e43b}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97828f94-592e-11dd-a9f4-000d6075fc18}] \Shell\AutoRun\command - G:\e.cmd \Shell\explore\Command - G:\e.cmd \Shell\open\Command - G:\e.cmd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97828f97-592e-11dd-a9f4-000d6075fc18}] \Shell\AutoRun\command - v.cmd \Shell\explore\Command - v.cmd \Shell\open\Command - v.cmd [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9edc76a0-6cd5-11dc-a80c-000e3537e43b}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a422295b-0aaf-11dd-a936-000d6075fc18}] \Shell\AutoRun\command - svc.exe \Shell\explore\Command - svc.exe \Shell\open\Command - svc.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a422295c-0aaf-11dd-a936-000d6075fc18}] \Shell\AutoRun\command - svc.exe \Shell\explore\Command - svc.exe \Shell\open\Command - svc.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b6e837b6-10e3-11dd-a94b-000d6075fc18}] \Shell\AutoRun\command - sxs.exe \Shell\explore\Command - sxs.exe \Shell\open\Command - sxs.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbcae952-e1d8-11db-a69b-000d6075fc18}] \Shell\AutoRun\command - G:\xyw9tmdj.com \Shell\explore\Command - G:\xyw9tmdj.com \Shell\open\Command - G:\xyw9tmdj.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c710d8f0-00dd-11dd-a926-000e3537e43b}] \Shell\AutoRun\command - G:\svc.exe \Shell\explore\Command - G:\svc.exe \Shell\open\Command - G:\svc.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc5c8808-7fae-11dc-a83e-000e3537e43b}] \Shell\Open(&O)\command - RECYCLED\appmgmt.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db739169-b819-11dc-a8a8-000d6075fc18}] \Shell\Autoplay\Command - G:\xmss.exe \Shell\AutoRun\command - G:\xmss.exe \Shell\Explore\Command - G:\xmss.exe \Shell\Open\Command - G:\xmss.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db73916c-b819-11dc-a8a8-000d6075fc18}] \Shell\AutoRun\command - G:\80avp08.com \Shell\explore\Command - G:\80avp08.com \Shell\open\Command - G:\80avp08.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e238ccda-0cee-11dd-a93c-000d6075fc18}] \Shell\AutoRun\command - t.com \Shell\explore\Command - t.com \Shell\open\Command - t.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e3a94ba0-77a2-11dc-a82e-000d6075fc18}] \Shell\AutoRun\command - g:\system\DriveGuard\DriveProtect.exe -run* \Shell\Explore\Command - g:\system\DriveGuard\DriveProtect.exe -run** \Shell\Open\Command - g:\system\DriveGuard\DriveProtect.exe -run* [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e51c63ad-cb21-11dd-aac9-000d6075fc18}] \Shell\Auto\command - WINDOWS \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL WINDOWS [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f936a7e5-cfe7-11dc-a8e5-000d6075fc18}] \Shell\Auto\command - sky.exe \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sky.exe . Contents of the 'Scheduled Tasks' folder 2009-01-24 c:\windows\Tasks\BMMTask.job - c:\progra~1\ThinkPad\UTILIT~1\BMMTASK.EXE [2003-12-25 14:06] . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-Ashampoo PopUpBlocker - d:\software\ASHAMP~1\PopUpKiller.exe MSConfigStartUp-EOUApp - c:\program files\Intel\Wireless\Bin\EOUWiz.exe MSConfigStartUp-ibmmessages - c:\program files\IBM\Messages By IBM\ibmmessages.exe MSConfigStartUp-QCTRAY - c:\program files\ThinkPad\ConnectUtilities\QCTRAY.EXE MSConfigStartUp-QCWLICON - c:\program files\ThinkPad\ConnectUtilities\QCWLICON.EXE MSConfigStartUp-RealTray - c:\program files\Real\RealPlayer\RealPlay.exe MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.5.0_01\bin\jusched.exe MSConfigStartUp-ZCfgSvc - c:\windows\System32\ZCfgSvc.exe . ------- Supplementary Scan ------- . uInternet Connection Wizard,ShellNext = iexplore IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Download with GetRight - d:\software\GetRight\GRdownload.htm IE: E&xport to Microsoft Excel - d:\software\office\OFFICE11\EXCEL.EXE/3000 IE: Open with GetRight Browser - d:\software\GetRight\GRbrowse.htm LSP: c:\program files\ISS\issSensors\DesktopProtection\IBE\ICELSP_8.0.614.2.dll FF - ProfilePath - c:\documents and settings\Kashikar\Application Data\Mozilla\Firefox\Profiles\zqmpbm6u.default\ FF - prefs.js: browser.startup.homepage - hxxp://vkashi.googlepages.com/home FF - prefs.js: network.proxy.ftp - 202.97.149.167 FF - prefs.js: network.proxy.ftp_port - 80 FF - prefs.js: network.proxy.gopher - 202.97.149.167 FF - prefs.js: network.proxy.gopher_port - 80 FF - prefs.js: network.proxy.http - 202.97.149.167 FF - prefs.js: network.proxy.http_port - 80 FF - prefs.js: network.proxy.socks - 202.97.149.167 FF - prefs.js: network.proxy.socks_port - 80 FF - prefs.js: network.proxy.ssl - 202.97.149.167 FF - prefs.js: network.proxy.ssl_port - 80 FF - prefs.js: network.proxy.type - 4 FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: d:\software\adobereader\Reader\browser\nppdf32.dll FF - plugin: d:\software\realplayer\Netscape6\nppl3260.dll FF - plugin: d:\software\realplayer\Netscape6\nprjplug.dll FF - plugin: d:\software\realplayer\Netscape6\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-24 18:44:17 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nrsinfnz] "ServiceDll"="c:\windows\system32\rubuqzc.dll" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1140) c:\windows\system32\Ati2evxx.dll c:\progra~1\COMMON~1\Stardock\mcpstub.dll - - - - - - - > 'lsass.exe'(1196) c:\windows\system32\pwdmon.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ibmpmsvc.exe c:\windows\system32\ati2evxx.exe c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\program files\Intel\Wireless\Bin\WLKEEPER.exe c:\program files\NUS-VPN\cvpnd.exe c:\program files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\Trend Micro\OfficeScan Client\ntrtscan.exe c:\program files\ISS\issSensors\DesktopProtection\RapApp.exe c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\program files\Trend Micro\OfficeScan Client\tmlisten.exe c:\windows\system32\TpKmpSvc.exe c:\windows\system32\wdfmgr.exe c:\program files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe c:\windows\Temp\VA59F2.EXE c:\progra~1\COMMON~1\Stardock\SDMCP.exe c:\windows\system32\ati2evxx.exe c:\windows\system32\rundll32.exe c:\program files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe c:\program files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe c:\program files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe c:\windows\system32\wscntfy.exe c:\program files\Trend Micro\OfficeScan Client\POP3Trap.exe . ************************************************************************** . Completion time: 2009-01-24 18:47:29 - machine was rebooted ComboFix-quarantined-files.txt 2009-01-24 13:17:16 Pre-Run: 5,381,365,760 bytes free Post-Run: 5,272,543,232 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn 474 |
|
|
|
|
01-24-2009, 12:11 PM
|
#6 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,636
OS: XP SP3
|
Re: antivirus updater and antivirus sites blocked
Hello vkashi.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ You are using an outdated version of HijackThis. Please uninstall HijackThis 1.99.1 in the Add or Remove Programs section of your Control Panel and delete your current version. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here If you decide to uninstall it, also delete the following Folders if they still exist: C:\Program Files\Viewpoint C:\Documents and Settings\All Users\Application Data\Viewpoint ------------------------------------------------------ Quote:
We suggest uninstalling them via Add or Remove Programs in your Control Panel. ------------------------------------------------------ Ensure all external and/or USB drives are connected/inserted for the duration of this fix. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the codebox below into Notepad: Code:
File::
c:\windows\system32\09.tmp
c:\windows\neoqaz2.dll
c:\windows\system\svc.exe
c:\windows\system32\imapde.dll
G:\sal.xls.exe
G:\semo2x.exe
G:\xn1i9x.com
c:\RECYCLED\appmgmt.exe
G:\ntde1ect.com
G:\svc.exe
h:\system\DriveGuard\DriveProtect.exe
g:\system\Security\DriveGuard.exe
G:\nideiect.com
G:\e.cmd
G:\WINDOWS
G:\xyw9tmdj.com
G:\xmss.exe
G:\80avp08.com
g:\system\DriveGuard\DriveProtect.exe
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000000
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3088:TCP"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0158a2dd-1d79-11dc-a72c-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{024c7f20-6985-11db-a5dd-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13d01106-bbfb-11dc-a8ad-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{15bfea10-c4c8-11dc-a8ca-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1adb4040-8d84-11db-a609-a3ce676856d1}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1b59c1f3-990a-11da-a498-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bb22aa0-6115-11dc-a7e8-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bb22aa6-6115-11dc-a7e8-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bb22aa8-6115-11dc-a7e8-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bb22aa9-6115-11dc-a7e8-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bb22aad-6115-11dc-a7e8-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2cc88c64-59f6-11dc-a7d5-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ccba32f-0ea0-11dd-a943-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41997600-a1ac-11dc-a86b-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{61079cf1-da3d-11dc-a8ec-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6636a9c0-5ac0-11dc-a7d8-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6aa6db97-bda3-11dc-a8b3-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{74293580-3992-11dc-a783-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{817fbac1-44a7-11dc-a799-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{87dc8811-e06c-11dc-a8f4-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8956c240-d71d-11dd-aad8-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{898faf30-10cd-11dc-a6fd-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{898faf31-10cd-11dc-a6fd-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d5cbeed-601d-11dc-a7e7-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8dab18b1-5d06-11dc-a7e2-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97828f94-592e-11dd-a9f4-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97828f97-592e-11dd-a9f4-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9edc76a0-6cd5-11dc-a80c-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a422295b-0aaf-11dd-a936-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a422295c-0aaf-11dd-a936-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b6e837b6-10e3-11dd-a94b-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bbcae952-e1d8-11db-a69b-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c710d8f0-00dd-11dd-a926-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cc5c8808-7fae-11dc-a83e-000e3537e43b}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db739169-b819-11dc-a8a8-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db73916c-b819-11dc-a8a8-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e238ccda-0cee-11dd-a93c-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e3a94ba0-77a2-11dc-a82e-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e51c63ad-cb21-11dd-aac9-000d6075fc18}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f936a7e5-cfe7-11dc-a8e5-000d6075fc18}]
Driver::
nrsinfnz
ekrn
NetSvc::
nrsinfnz
 Referring to the picture above, drag CFScript onto ComboFix Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ Download Flash_Disinfector.exe and Save it to your Desktop.
Open Notepad and copy/paste the entire contents of the codebox below into Notepad: Code:
vfind -ltf "%systemdrive%\Iexplores.exe" "%systemdrive%\antihost.exe" "%systemdrive%\exiplorer.exe" "%systemdrive%\v.cmd" "%systemdrive%\sxs.exe" "%systemdrive%\t.com" "%systemdrive%\sky.exe" "%systemdrive%\appmgmt.exe" >log.txt notepad log.txt del peek.bat It should look like this:  Double-click on peek.bat and allow it to run. A Notepad file will open. Post the contents of that file in your next reply. ------------------------------------------------------ |
|
|
|
|
|
01-24-2009, 07:28 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 8
OS: xp sp2
|
Re: antivirus updater and antivirus sites blocked
thanks for the prompt reply. the results are as follows-
combofix- ComboFix 09-01-21.04 - Kashikar 2009-01-25 7:33:54.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.767.381 [GMT 5.5:30] Running from: c:\documents and settings\Kashikar\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Kashikar\Desktop\CFScript.txt AV: ESET NOD32 Antivirus 3.0 *On-access scanning enabled* (Updated) * Created a new restore point FILE :: c:\recycled\appmgmt.exe c:\windows\neoqaz2.dll c:\windows\system\svc.exe c:\windows\system32\09.tmp c:\windows\system32\imapde.dll G:\80avp08.com G:\e.cmd G:\nideiect.com G:\ntde1ect.com G:\sal.xls.exe G:\semo2x.exe G:\svc.exe g:\system\DriveGuard\DriveProtect.exe g:\system\Security\DriveGuard.exe G:\WINDOWS G:\xmss.exe G:\xn1i9x.com G:\xyw9tmdj.com h:\system\DriveGuard\DriveProtect.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\neoqaz2.dll c:\windows\system\svc.exe c:\windows\system32\09.tmp c:\windows\system32\imapde.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_EKRN -------\Legacy_NRSINFNZ -------\Service_ekrn -------\Service_nrsinfnz ((((((((((((((((((((((((( Files Created from 2008-12-25 to 2009-01-25 ))))))))))))))))))))))))))))))) . 2009-01-17 12:09 . 2008-12-07 14:51 23,992 --a------ c:\windows\system32\drivers\rspSanity32.sys 2009-01-17 11:27 . 2009-01-17 11:27 250 --a------ c:\windows\gmer.ini 2009-01-17 04:48 . 2009-01-17 04:48 54,156 --ah----- c:\windows\QTFont.qfn 2009-01-17 04:48 . 2009-01-17 04:48 1,409 --a------ c:\windows\QTFont.for 2009-01-12 09:29 . 2009-01-12 09:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\DesignBuilder 2009-01-12 09:28 . 2009-01-12 09:28 <DIR> d-------- c:\documents and settings\Kashikar\Application Data\InstallShield Installation Information 2009-01-12 09:28 . 2007-06-15 15:22 2,903,023 --a------ c:\windows\system32\pdfnet.res 2009-01-12 09:28 . 2008-07-24 10:46 2,899,968 --a------ c:\windows\system32\pdf2image.dll 2009-01-12 09:28 . 2007-11-19 20:10 1,937,408 --a------ c:\windows\system32\FreeImage.dll 2009-01-12 09:28 . 2000-03-07 00:00 434,252 --a------ c:\windows\system32\MSVCRTD.DLL 2009-01-12 09:28 . 2000-05-21 23:00 115,920 --a------ c:\windows\system32\MSINET.OCX 2009-01-12 09:28 . 1996-08-24 11:11 4,608 --a------ c:\windows\system32\Rsrc32.dll 2009-01-12 09:28 . 2008-07-24 10:46 2,544 --a------ c:\windows\system32\pdf2image.lib 2009-01-12 09:28 . 1999-04-23 22:22 1,312 --a------ c:\windows\system32\rsrc16.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-17 06:26 --------- d-----w c:\program files\PC-Doctor for Windows 2009-01-16 11:08 --------- d-----w c:\documents and settings\All Users\Application Data\pdf995 2009-01-15 04:32 --------- d-----w c:\documents and settings\Kashikar\Application Data\wsInspector 2009-01-09 04:48 --------- d-----w c:\documents and settings\All Users\Application Data\Autodesk 2009-01-09 04:47 --------- d-----w c:\program files\Common Files\Autodesk Shared 2009-01-09 04:40 --------- d-----w c:\program files\Java 2009-01-09 04:09 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-26 03:51 --------- d-----w c:\program files\McAfee 2008-12-24 12:48 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore 2008-12-24 09:49 --------- d-----w c:\documents and settings\Kashikar\Application Data\SiteAdvisor 2008-12-24 08:54 --------- d-----w c:\program files\Common Files\McAfee 2008-12-24 08:54 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee 2008-12-23 03:33 --------- d-----w c:\program files\Autodesk Revit 7.0 2008-12-17 11:06 --------- d-----w c:\documents and settings\All Users\Application Data\IESLink 2008-12-17 03:01 --------- d-----w c:\program files\AutoCAD 2008 2008-12-17 02:56 --------- d-----w c:\program files\Hewlett-Packard 2008-12-10 12:18 --------- d-----w c:\documents and settings\All Users\Application Data\Viper 2005-12-24 06:00 20 ---h--w c:\documents and settings\All Users\Application Data\PKP_DLea.DAT . ((((((((((((((((((((((((((((( snapshot@2009-01-24_18.46.06.43 ))))))))))))))))))))))))))))))))))))))))) . + 2008-10-16 08:39:44 92,696 ------w c:\windows\SoftwareDistribution\WebSetup\cdm.dll + 2008-10-16 08:42:20 561,688 ------w c:\windows\SoftwareDistribution\WebSetup\wuapi.dll + 2008-10-16 08:39:44 51,224 ------w c:\windows\SoftwareDistribution\WebSetup\wuauclt.exe + 2008-10-16 08:43:40 1,809,944 ------w c:\windows\SoftwareDistribution\WebSetup\wuaueng.dll + 2008-10-16 08:42:22 323,608 ------w c:\windows\SoftwareDistribution\WebSetup\wucltui.dll + 2008-10-16 08:38:58 34,328 ------w c:\windows\SoftwareDistribution\WebSetup\wups.dll + 2008-10-16 08:39:44 43,544 ------w c:\windows\SoftwareDistribution\WebSetup\wups2.dll - 2005-05-26 12:16:30 173,536 ----a-w c:\windows\system32\dllcache\wuweb.dll + 2008-10-16 08:42:24 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll - 2005-05-26 12:16:30 173,536 -c--a-w c:\windows\system32\wuweb.dll + 2008-10-16 08:42:24 202,776 ----a-w c:\windows\system32\wuweb.dll + 2004-07-07 05:07:14 172,099 ----a-w c:\windows\Temp\ACDDA2.EXE . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LClock"="d:\software\LClock\lclock.exe" [2004-09-19 65536] "TPKMAPMN"="c:\program files\ThinkPad\Utilities\TpKmapMn.exe" [2003-10-23 32768] "QuickGammaLoader"="d:\software\QuickGamma\QuickGammaLoader.exe" [2005-03-27 68096] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OfficeScanNT Monitor"="c:\program files\Trend Micro\OfficeScan Client\pccntmon.exe" [2004-07-07 335872] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-11-15 180269] "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-09-15 110592] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-09-15 512000] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-11-15 155648] "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-07-02 802816] "TPHOTKEY"="c:\progra~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [2004-03-10 94208] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-07-02 700416] "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 c:\windows\system32\bthprops.cpl] "TpShocks"="TpShocks.exe" [2003-12-17 c:\windows\system32\TpShocks.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Nokia.PCSync"="d:\software\nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088] c:\documents and settings\Kashikar\Start Menu\Programs\Startup\ cleantemp.bat [2009-01-12 30] KbStart.exe.lnk - d:\software\KbStart\KbStart.exe [2008-04-22 228864] Stardock ObjectDock.lnk - d:\software\ObjectDock\ObjectDock.exe [2008-01-20 3450608] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-05-31 25214] Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-11-17 110592] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient] 2005-01-31 15:13 49152 c:\progra~1\COMMON~1\Stardock\MCPStub.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Notification Packages REG_MULTI_SZ scecli pwdmon [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] --a--c--- 2004-02-11 09:40 335872 c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMMLREF] --a------ 2003-12-25 14:06 20480 c:\program files\ThinkPad\Utilities\BMMLREF.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMMMONWND] --a------ 2003-12-25 14:06 394752 c:\progra~1\ThinkPad\UTILIT~1\BATINFEX.DLL [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] --a------ 2004-08-22 14:35 81920 d:\software\daemon\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] --a--c--- 2003-10-22 13:34 114741 c:\windows\system32\dla\tfswctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EZEJMNAP] --a------ 2003-12-25 14:34 208896 c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds] --a------ 2003-12-16 05:37 118784 c:\windows\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IBMPRC] --a------ 2004-03-20 00:42 90112 c:\ibmtools\utils\ibmprc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray] --a------ 2003-12-16 05:50 155648 c:\windows\system32\igfxtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1] --a------ 2001-08-18 14:30 44032 c:\windows\ime\imkr6_1\imekrmig.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1] --a------ 2004-08-04 11:02 208952 c:\windows\ime\imjp8_1\imjpmig.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless] --a------ 2006-07-02 19:20 700416 c:\program files\Intel\Wireless\Bin\iFrmewrk.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2004-10-13 21:54 1694208 c:\program files\messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002] --a------ 2002-08-29 10:09 59392 c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeScanNT Monitor] --a------ 2004-07-07 10:41 335872 c:\program files\Trend Micro\OfficeScan Client\PccNTMon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A] --a------ 2002-08-29 10:09 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync] --a------ 2002-08-29 10:09 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2005-11-15 08:27 155648 c:\program files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh] --a------ 2005-09-15 11:27 512000 c:\program files\Synaptics\SynTP\SynTPEnh.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr] --a------ 2005-09-15 11:27 110592 c:\program files\Synaptics\SynTP\SynTPLpr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2005-11-15 09:47 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPKMAPHELPER] --a------ 2003-10-24 12:09 897024 c:\program files\ThinkPad\Utilities\TpKmapAp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UC_Start] --a------ 2003-10-01 04:09 36864 c:\program files\IBM\Updater\ucstartup.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager] --a------ 2003-08-19 13:31 110592 c:\program files\Common Files\Sonic\Update Manager\sgtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange] --a------ 2004-11-30 16:37 65536 c:\windows\system32\Ati2mdxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent] --a------ 2004-08-04 13:26 380416 c:\windows\system32\irprops.cpl [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\S3TRAY2] --a--c--- 2001-10-12 12:02 69632 c:\windows\system32\S3Tray2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TP4EX] --a--c--- 2002-09-04 13:35 53248 c:\windows\system32\TP4EX.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"= "d:\\software\\yahoo\\Messenger\\YahooMessenger.exe"= "d:\\software\\yahoo\\Messenger\\YServer.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 Shockprf;Shockprf;c:\windows\system32\drivers\shockprf.sys [2004-07-30 58568] R1 CDAWDM;CDAWDM;c:\windows\system32\drivers\cdawdm.sys [2006-04-04 46735] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2007-12-21 33800] R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [2004-07-30 15360] R3 MakoNT;MakoNT;c:\windows\system32\drivers\makont.sys [2005-11-15 76913] R3 rap;rap;c:\windows\system32\drivers\RapDrv.sys [2004-10-12 46001] R4 ibmfilter;ibmfilter;c:\windows\system32\drivers\ibmfilter.sys [2004-03-20 63872] R4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-12-24 206096] R4 ShockMgr;ShockMgr;c:\windows\system32\drivers\ShockMgr.sys [2004-07-30 4433] R4 TmPreFilter;Trend Micro PreFilter;c:\program files\Trend Micro\OfficeScan Client\tmpreflt.sys [2003-09-03 36368] R4 urtclientservice;URT Client Service;c:\windows\system32\urtclsvc.exe [2005-11-15 118784] R4 VPatch;ISS Buffer Overflow Exploit Prevention;c:\program files\ISS\issSensors\DesktopProtection\vpatch.exe [2005-11-15 422237] S3 BlackICE;BlackICE;c:\program files\ISS\issSensors\DesktopProtection\blackd.exe [2004-10-12 1994828] S3 RapFile;RapFile;c:\windows\system32\drivers\RapFile.sys [2004-10-12 36676] S3 RapNet;RapNet;c:\windows\system32\drivers\RapNet.sys [2004-10-12 24344] S3 rspSanity;rspSanity;c:\windows\system32\drivers\rspSanity32.sys [2009-01-17 23992] S4 black;black;c:\windows\system32\drivers\blackcat.sys [2005-11-15 234219] S4 TmFilter;Trend Micro Filter;c:\program files\Trend Micro\OfficeScan Client\tmxpflt.sys [2003-09-03 205328] . Contents of the 'Scheduled Tasks' folder 2009-01-25 c:\windows\Tasks\BMMTask.job - c:\progra~1\ThinkPad\UTILIT~1\BMMTASK.EXE [2003-12-25 14:06] . . ------- Supplementary Scan ------- . uInternet Connection Wizard,ShellNext = iexplore IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Download with GetRight - d:\software\GetRight\GRdownload.htm IE: E&xport to Microsoft Excel - d:\software\office\OFFICE11\EXCEL.EXE/3000 IE: Open with GetRight Browser - d:\software\GetRight\GRbrowse.htm LSP: c:\program files\ISS\issSensors\DesktopProtection\IBE\ICELSP_8.0.614.2.dll FF - ProfilePath - c:\documents and settings\Kashikar\Application Data\Mozilla\Firefox\Profiles\zqmpbm6u.default\ FF - prefs.js: browser.startup.homepage - hxxp://vkashi.googlepages.com/home FF - prefs.js: network.proxy.ftp - 202.97.149.167 FF - prefs.js: network.proxy.ftp_port - 80 FF - prefs.js: network.proxy.gopher - 202.97.149.167 FF - prefs.js: network.proxy.gopher_port - 80 FF - prefs.js: network.proxy.http - 202.97.149.167 FF - prefs.js: network.proxy.http_port - 80 FF - prefs.js: network.proxy.socks - 202.97.149.167 FF - prefs.js: network.proxy.socks_port - 80 FF - prefs.js: network.proxy.ssl - 202.97.149.167 FF - prefs.js: network.proxy.ssl_port - 80 FF - prefs.js: network.proxy.type - 4 FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: d:\software\adobereader\Reader\browser\nppdf32.dll FF - plugin: d:\software\realplayer\Netscape6\nppl3260.dll FF - plugin: d:\software\realplayer\Netscape6\nprjplug.dll FF - plugin: d:\software\realplayer\Netscape6\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-25 07:39:26 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1136) c:\windows\system32\Ati2evxx.dll c:\progra~1\COMMON~1\Stardock\mcpstub.dll - - - - - - - > 'lsass.exe'(1192) c:\windows\system32\pwdmon.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ibmpmsvc.exe c:\windows\system32\ati2evxx.exe c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\program files\Intel\Wireless\Bin\WLKEEPER.exe c:\program files\NUS-VPN\cvpnd.exe c:\program files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\program files\ISS\issSensors\DesktopProtection\RapApp.exe c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\windows\system32\TpKmpSvc.exe c:\windows\system32\wdfmgr.exe c:\progra~1\COMMON~1\Stardock\SDMCP.exe c:\windows\system32\ati2evxx.exe c:\windows\system32\rundll32.exe c:\program files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe c:\program files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe c:\program files\Adobe\Acrobat 7.0\Acrobat\Acrobat_sl.exe c:\program files\Trend Micro\OfficeScan Client\PccNTUpd.exe c:\program files\Trend Micro\OfficeScan Client\Misc\xpupg.exe c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe . ************************************************************************** . Completion time: 2009-01-25 7:42:25 - machine was rebooted ComboFix-quarantined-files.txt 2009-01-25 02:12:15 ComboFix2.txt 2009-01-24 13:17:30 Pre-Run: 5,540,954,112 bytes free Post-Run: 5,524,824,064 bytes free 306 peek.bat- Entries: 0 (0) Directories: 0 Files: 0 Bytes: 0 Blocks: 0 Entries: 0 (0) Directories: 0 Files: 0 Bytes: 0 Blocks: 0 Entries: 0 (0) Directories: 0 Files: 0 Bytes: 0 Blocks: 0 Entries: 0 (0) Directories: 0 Files: 0 Bytes: 0 Blocks: 0 Entries: 0 (0) Directories: 0 Files: 0 Bytes: 0 Blocks: 0 Entries: 0 (0) Directories: 0 Files: 0 Bytes: 0 Blocks: 0 Entries: 0 (0) Directories: 0 Files: 0 Bytes: 0 Blocks: 0 Entries: 0 (0) Directories: 0 Files: 0 Bytes: 0 Blocks: 0 Total Entries: 0 (0) Total Directories: 0 Files: 0 Total Bytes: 0 Blocks: 0 |
|
|
|
|
01-24-2009, 08:28 PM
|
#8 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,636
OS: XP SP3
|
Re: antivirus updater and antivirus sites blocked
Hello again, vkashi. Please tell us how your system is behaving.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ I am puzzled as to your current antivirus situation. TrendMicro seems to be installed and running, but your computer only sees ESET installed. Was ESET a previous install? ------------------------------------------------------ Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions.
 **Note** To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Please post the following in your next reply: Kaspersky report report on system behavior |
|
|
|
|
01-25-2009, 07:26 AM
|
#9 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 8
OS: xp sp2
|
Re: antivirus updater and antivirus sites blocked
hi,
thanks for the prompt and continued support. i noticed the same thing about the eset antivirus. i had eset installed long back but later shifted to trendmicro. i have uninstalled eset and it doesnt appear on add remove programmes so i am surprised that it appears as eset. i am not noticing any erratic system behaviour since i ran the combofix. i am now able to access antivirus sites as well as the windows update site. however i must add that apart from this i had not noticed any odd behaviour right from teh beginning. i am attaching the online scan report- -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Sunday, January 25, 2009 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Sunday, January 25, 2009 10:54:00 Records in database: 1693487 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ Scan statistics: Files scanned: 101227 Threat name: 12 Infected objects: 21 Suspicious objects: 0 Duration of the scan: 02:01:11 File name / Threat name / Threats count D:\software\KbStart\KbStart.exe/D:\software\KbStart\KbStart.exe Infected: Backdoor.Win32.Netbus.160.f 1 C:\Program Files\Trend Micro\OfficeScan Client\Backup\EXCEL.EXE.RB0 Infected: Worm.Win32.Fujack.aa 1 C:\Program Files\Trend Micro\OfficeScan Client\Backup\java.jar-bae16f0-5134eb17.RB0 Infected: Trojan-Downloader.Java.OpenConnection.aj 2 C:\Program Files\Trend Micro\OfficeScan Client\Backup\java.jar-bae16f0-5134eb17.RB0 Infected: Exploit.Java.ByteVerify 2 C:\Program Files\Trend Micro\OfficeScan Client\Backup\loaderadv661.jar-897c2ff-1dbfd913.RB0 Infected: Trojan-Downloader.Java.OpenStream.c 1 C:\Program Files\Trend Micro\OfficeScan Client\Backup\loaderadv661.jar-897c2ff-1dbfd913.RB0 Infected: Trojan.Java.ClassLoader.h 1 C:\Program Files\Trend Micro\OfficeScan Client\Backup\loaderadv661.jar-897c2ff-1dbfd913.RB0 Infected: Trojan.Java.ClassLoader.d 1 C:\Qoobox\Quarantine\C\WINDOWS\system\svc.exe.vir Infected: Backdoor.Win32.Shark.aoo 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\msqpdxqmqsipfa.dll.vir Infected: not-a-virus:AdWare.Win32.Agent.ivf 1 C:\System Volume Information\_restore{DAAD8284-5896-4B40-A753-8454BDC2E5A5}\RP2\A0000002.dll Infected: not-a-virus:AdWare.Win32.Agent.ivf 1 C:\System Volume Information\_restore{DAAD8284-5896-4B40-A753-8454BDC2E5A5}\RP2\A0000010.dll Infected: Trojan.Win32.Agent.bcjv 1 C:\System Volume Information\_restore{DAAD8284-5896-4B40-A753-8454BDC2E5A5}\RP5\A0001127.exe Infected: Backdoor.Win32.Shark.aoo 1 C:\WINDOWS\system32\fiber_c58.VIR Infected: not-a-virus:Monitor.Win32.ActMon.511 1 C:\WINDOWS\system32\imapdb_c58.VI0 Infected: not-a-virus:Monitor.Win32.ActMon.511 1 C:\WINDOWS\system32\imapd_c58.VIR Infected: not-a-virus:Monitor.Win32.ActMon.511 1 C:\WINDOWS\system32\msfir80_9a4.VIR Infected: Worm.Win32.VB.el 1 C:\WINDOWS\system32\msime80_9a4.VIR Infected: Worm.Win32.VB.el 1 D:\software\KbStart\KbStart.exe Infected: Backdoor.Win32.Netbus.160.f 1 D:\software\KbStart\KbStart_v1.7.0.483.zip Infected: Backdoor.Win32.Netbus.160.f 1 The selected area was scanned. |
|
|
|
|
01-25-2009, 08:59 AM
|
#10 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,636
OS: XP SP3
|
Re: antivirus updater and antivirus sites blocked
Kaspersky is flagging KbStart as malicious. Are you familiar with KbStart?
Please follow these instructions for de-registering ESET: **Note: Make sure you only delete ESET products.
Please run dds again and post DDS.txt in your next reply. ------------------------------------------------------ Open Notepad and copy/paste the entire contents of the codebox below into Notepad: Code:
@echo off if exist "%temp%\log.txt" del "%temp%\log.txt" for %%g in ( "C:\Program Files\Trend Micro\OfficeScan Client\Backup\EXCEL.EXE.RB0" "C:\Program Files\Trend Micro\OfficeScan Client\Backup\java.jar-bae16f0-5134eb17.RB0" "C:\Program Files\Trend Micro\OfficeScan Client\Backup\loaderadv661.jar-897c2ff-1dbfd913.RB0" "C:\WINDOWS\system32\fiber_c58.VIR" "C:\WINDOWS\system32\imapdb_c58.VI0" "C:\WINDOWS\system32\imapd_c58.VIR" "C:\WINDOWS\system32\msfir80_9a4.VIR" "C:\WINDOWS\system32\msime80_9a4.VIR" ) do ( del /a/f/q %%g >nul 2>&1 if exist %%g echo.%%~g>>"%temp%\log.txt" ) if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt" ) else echo.Deleted Successfully !! pause del %0 It should look like this: Double-click on fix.bat to run it. Tell me what it says in your next reply. Press any key to continue. ------------------------------------------------------ |
|
|
|
|
01-25-2009, 05:54 PM
|
#11 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 8
OS: xp sp2
|
Re: antivirus updater and antivirus sites blocked
hi again
kbstart is a small application which allows me to open softwares using keyboard shortcuts. i have it installed since 1 year or so and it is not giving me any issues. however, if you think that any part of that software is vulnerable to attacks i can always uninstall it. although i use it often, i dont think it is worth taking a risk if it exists. i went by your instructions for checking the status of eset, and sure enough i found eset and deleted it. hopefully that solves that issue. trend micro continues to run. dds text is as follows DDS (Ver_09-01-07.01) - NTFSx86 Run by Kashikar at 6:15:58.50 on Mon 01/26/2009 Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_11 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.767.243 [GMT 5.5:30] ============== Running Processes =============== C:\WINDOWS\system32\ibmpmsvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe svchost.exe svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\NUS-VPN\cvpnd.exe C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe C:\WINDOWS\TEMP\OEE07C.EXE C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe C:\WINDOWS\system32\TpKmpSVC.exe C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe C:\WINDOWS\System32\urtclsvc.exe C:\Program Files\ISS\issSensors\DesktopProtection\vpatch.exe C:\Program Files\Trend Micro\OfficeScan Client\ofcpfwsvc.exe C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe C:\WINDOWS\system32\TpShocks.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe D:\software\LClock\lclock.exe C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe C:\WINDOWS\system32\ctfmon.exe D:\software\KbStart\KbStart.exe D:\software\ObjectDock\ObjectDock.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\program files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\OfficeScan Client\Pop3Trap.exe C:\Documents and Settings\Kashikar\Desktop\antivirus\dds.com ============== Pseudo HJT Report =============== uInternet Connection Wizard,ShellNext = iexplore BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [LClock] d:\software\lclock\lclock.exe uRun: [TPKMAPMN] c:\program files\thinkpad\utilities\TpKmapMn.exe uRun: [QuickGammaLoader] d:\software\quickgamma\QuickGammaLoader.exe uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [OfficeScanNT Monitor] "c:\program files\trend micro\officescan client\pccntmon.exe" -HideWindow mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe" mRun: [TPHOTKEY] c:\progra~1\thinkpad\pkgmgr\hotkey\TPHKMGR.exe mRun: [TpShocks] TpShocks.exe mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" dRun: [Nokia.PCSync] d:\software\nokia\nokia pc suite 6\PcSync2.exe /NoDialog StartupFolder: c:\documents and settings\kashikar\start menu\programs\startup\cleantemp.bat StartupFolder: c:\docume~1\kashikar\startm~1\programs\startup\kbstar~1.lnk - d:\software\kbstart\KbStart.exe StartupFolder: c:\docume~1\kashikar\startm~1\programs\startup\stardo~1.lnk - d:\software\objectdock\ObjectDock.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobea~1.lnk - c:\windows\installer\{ac76ba86-1033-0000-7760-000000000002}\SC_Acrobat.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Download with GetRight - d:\software\getright\GRdownload.htm IE: E&xport to Microsoft Excel - d:\software\office\office11\EXCEL.EXE/3000 IE: Open with GetRight Browser - d:\software\getright\GRbrowse.htm IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\software\office\office11\REFIEBAR.DLL LSP: c:\program files\iss\isssensors\desktopprotection\ibe\ICELSP_8.0.614.2.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: AtiExtEvent - Ati2evxx.dll Notify: igfxcui - igfxsrvc.dll Notify: MCPClient - c:\progra~1\common~1\stardock\mcpstub.dll SSODL: 0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC} - c:\progra~1\common~1\stardock\MCPCore.dll LSA: Notification Packages = scecli pwdmon ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\kashikar\applic~1\mozilla\firefox\profiles\zqmpbm6u.default\ FF - prefs.js: browser.startup.homepage - hxxp://vkashi.googlepages.com/home FF - prefs.js: network.proxy.ftp - 202.97.149.167 FF - prefs.js: network.proxy.ftp_port - 80 FF - prefs.js: network.proxy.gopher - 202.97.149.167 FF - prefs.js: network.proxy.gopher_port - 80 FF - prefs.js: network.proxy.http - 202.97.149.167 FF - prefs.js: network.proxy.http_port - 80 FF - prefs.js: network.proxy.socks - 202.97.149.167 FF - prefs.js: network.proxy.socks_port - 80 FF - prefs.js: network.proxy.ssl - 202.97.149.167 FF - prefs.js: network.proxy.ssl_port - 80 FF - prefs.js: network.proxy.type - 4 FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll FF - plugin: d:\software\adobereader\reader\browser\nppdf32.dll FF - plugin: d:\software\realplayer\netscape6\nppl3260.dll FF - plugin: d:\software\realplayer\netscape6\nprjplug.dll FF - plugin: d:\software\realplayer\netscape6\nprpjplug.dll ============= SERVICES / DRIVERS =============== R0 Shockprf;Shockprf;c:\windows\system32\drivers\shockprf.sys [2004-7-30 58568] R1 CDAWDM;CDAWDM;c:\windows\system32\drivers\cdawdm.sys [2006-4-4 46735] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2007-12-21 33800] R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [2004-7-30 15360] R3 MakoNT;MakoNT;c:\windows\system32\drivers\makont.sys [2005-11-15 76913] R4 ibmfilter;ibmfilter;c:\windows\system32\drivers\ibmfilter.sys [2004-3-20 63872] R4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-12-24 206096] R4 ofcpfwsvc;OfficeScanNT Personal Firewall;c:\program files\trend micro\officescan client\OfcPfwSvc.exe [2005-2-8 225360] R4 ShockMgr;ShockMgr;c:\windows\system32\drivers\ShockMgr.sys [2004-7-30 4433] R4 TmFilter;Trend Micro Filter;c:\program files\trend micro\officescan client\tmxpflt.sys [2003-9-3 205328] R4 TmPreFilter;Trend Micro PreFilter;c:\program files\trend micro\officescan client\tmpreflt.sys [2003-9-3 36368] R4 urtclientservice;URT Client Service;c:\windows\system32\urtclsvc.exe [2005-11-15 118784] R4 VPatch;ISS Buffer Overflow Exploit Prevention;c:\program files\iss\isssensors\desktopprotection\vpatch.exe [2005-11-15 422237] S3 BlackICE;BlackICE;c:\program files\iss\isssensors\desktopprotection\blackd.exe [2004-10-12 1994828] S3 rap;rap;c:\windows\system32\drivers\RapDrv.sys [2004-10-12 46001] S3 RapFile;RapFile;c:\windows\system32\drivers\RapFile.sys [2004-10-12 36676] S3 RapNet;RapNet;c:\windows\system32\drivers\RapNet.sys [2004-10-12 24344] S3 rspSanity;rspSanity;c:\windows\system32\drivers\rspSanity32.sys [2009-1-17 23992] S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-11-19 280344] S4 black;black;c:\windows\system32\drivers\blackcat.sys [2005-11-15 234219] =============== Created Last 30 ================ 2009-01-25 16:32 73,728 a------- c:\windows\system32\javacpl.cpl 2009-01-25 16:32 410,984 a------- c:\windows\system32\deploytk.dll 2009-01-25 07:48 <DIR> a-dshr-- C:\autorun.inf 2009-01-24 18:27 <DIR> a-dshr-- C:\cmdcons 2009-01-24 18:17 161,792 a------- c:\windows\SWREG.exe 2009-01-24 18:17 98,816 a------- c:\windows\sed.exe 2009-01-17 12:09 23,992 a------- c:\windows\system32\drivers\rspSanity32.sys 2009-01-17 11:27 250 a------- c:\windows\gmer.ini 2009-01-17 04:48 54,156 a---h--- c:\windows\QTFont.qfn 2009-01-17 04:48 1,409 a------- c:\windows\QTFont.for 2009-01-12 09:29 <DIR> --d----- c:\docume~1\alluse~1\applic~1\DesignBuilder 2009-01-12 09:28 115,920 a------- c:\windows\system32\MSINET.OCX 2009-01-12 09:28 2,903,023 a------- c:\windows\system32\pdfnet.res 2009-01-12 09:28 4,608 a------- c:\windows\system32\Rsrc32.dll 2009-01-12 09:28 2,544 a------- c:\windows\system32\pdf2image.lib 2009-01-12 09:28 1,312 a------- c:\windows\system32\rsrc16.dll 2009-01-12 09:28 2,899,968 a------- c:\windows\system32\pdf2image.dll 2009-01-12 09:28 1,937,408 a------- c:\windows\system32\FreeImage.dll 2009-01-12 09:28 434,252 a------- c:\windows\system32\MSVCRTD.DLL ==================== Find3M ==================== 2005-12-24 11:30 20 ----h--- c:\docume~1\alluse~1\applic~1\PKP_DLea.DAT 2007-11-08 20:05 155,884 a--sh--- c:\windows\system32\fiber_c58.VIR 2007-11-08 20:05 41,598 a--sh--- c:\windows\system32\imapdb_c58.VIR 2007-11-08 20:05 438,398 a--sh--- c:\windows\system32\imapdc_c58.VIR 2007-11-08 20:05 36,478 a--sh--- c:\windows\system32\imapdd_c58.VIR 2007-11-08 20:05 958,588 a--sh--- c:\windows\system32\imapd_c58.VIR ============= FINISH: 6:16:38.53 =============== fix.bat says deleted successfully!! (i love the exclamation bit :) ) thanks for all the time you are spending on this |
|
|
|
|
01-25-2009, 06:54 PM
|
#12 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,636
OS: XP SP3
|
Re: antivirus updater and antivirus sites blocked
KbStart is OK, just wanted to know if you installed it.
------------------------------------------------------ Congratulations. Well done! Your logs appear clean. You should be good to go. As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
|
01-26-2009, 02:49 AM
|
#13 (permalink) |
|
Registered User
Join Date: Jan 2009
Posts: 8
OS: xp sp2
|
Re: antivirus updater and antivirus sites blocked
thanks a lot for all the help. i read through the articles you gave me and have downloaded some of the recommmended softwares. all issues are resolved as of now.
thanks once again kashi |
|
|
|
| Thread Tools | |
|
|
