|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
04-12-2009, 03:48 PM
|
#1 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 9
OS: XP
|
unable to update antivirus/ search redirect
hello there!
I started having problems with my p.c yesterday ( i run XP ), first of all i couldnt update AVG 8.0 antivirus it always failed, then every time I did a google search and clicked on a resultant address i would get redirected to other random pages. I then notice an "a.exe" file on my desktop. My IE keeps closing, saying it needs to report an error. I have since removed AVG and downloaded Avast which does the same thing (doesnt update). Any help would be greatly appreciated! Glen DDS (Ver_09-03-16.01) - NTFSx86 Run by glen at 21:57:44.40 on 12/04/2009 Internet Explorer: 7.0.5730.11 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.612 [GMT 1:00] AV: Webroot Internet Security Essentials *On-access scanning disabled* (Updated) AV: avast! antivirus 4.8.1335 [VPS 090319-0] *On-access scanning enabled* (Outdated) FW: Webroot Internet Security Essentials *disabled* ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe svchost.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\explorer.exe C:\DOCUME~1\glen\LOCALS~1\Temp\Temporary Directory 1 for gmer.zip\gmer.exe C:\Documents and Settings\glen\Desktop\dds.pif ============== Pseudo HJT Report =============== uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://www.google.com/ uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter uRun: [Uniblue RegistryBooster 2] c:\program files\uniblue\registrybooster 2\RegistryBooster.exe /S uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized mRun: [ehTray] "c:\windows\ehome\ehtray.exe" mRun: [igfxtray] "c:\windows\system32\igfxtray.exe" mRun: [igfxhkcmd] "c:\windows\system32\hkcmd.exe" mRun: [igfxpers] "c:\windows\system32\igfxpers.exe" mRun: [SigmatelSysTrayApp] "stsystra.exe" mRun: [SynTPEnh] "c:\program files\synaptics\syntp\SynTPEnh.exe" mRun: [ShowLOMControl] 1 (0x1) mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe" mRun: [dla] "c:\windows\system32\dla\tfswctrl.exe" mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [<NO NAME>] mRun: [RealTray] "c:\program files\real\realplayer\RealPlay.exe" SYSTEMBOOTHIDEPLAYER mRun: [Corel Photo Downloader] "c:\program files\corel\corel photo album 6\MediaDetect.exe" mRun: [tsnp2std] "c:\windows\tsnp2std.exe" mRun: [snp2std] c:\windows\vsnp2std.exe mRun: [MSKDetectorExe] "c:\program files\mcafee\spamkiller\MSKDetct.exe" /uninstall mRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\isuspm.exe" -scheduler mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe" mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter mRun: [RemoteControl8] "c:\program files\cyberlink\powerdvd8\PDVD8Serv.exe" mRun: [PDVD8LanguageShortcut] "c:\program files\cyberlink\powerdvd8\language\Language.exe" mRun: [BDRegion] "c:\program files\cyberlink\shared files\brs.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nkvmon~1.lnk - c:\program files\nikon\nkview6\NkvMon.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} - hxxp://www.pcpitstop.com/internet/pcpConnCheck.cab DPF: {40BF816B-D862-41B9-9445-ECA36D5F67F9} - hxxp://www.flatcast.com/de/download/NpFv412.dll DPF: {66D393D5-4D80-497C-9F4F-F3839E090202} - hxxp://www.pysoft.com/Downloads/WebCamPlayerOCX.cab DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1159731537843 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://www.adobe.com/products/acrobat/nos/gp.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://81.149.77.2:8085/activex/AMC.cab DPF: {E55FD215-A32E-43FE-A777-A7E8F165F557} - hxxp://data.myflatcast.com/data/objects/NpFv501.dll DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - hxxp://fdl.msn.com/public/chat/msnchat45.cab Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ============= SERVICES / DRIVERS =============== R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-4-12 114768] R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\cyberlink\powerdvd8\000.fcl [2008-5-15 61424] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-4-12 20560] R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-4-12 138680] R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328] R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\drivers\ousbehci.sys [2007-1-1 46080] R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-4-12 254040] R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-4-12 352920] R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\drivers\ousb2hub.sys [2007-1-1 56960] S2 WRConsumerService;Webroot Client Service;"c:\program files\webroot\webrootsecurity\wrconsumerservice.exe" --> c:\program files\webroot\webrootsecurity\WRConsumerService.exe [?] =============== Created Last 30 ================ 2009-04-12 21:36 <DIR> --d----- C:\gmer 2009-04-12 21:35 278,161 a------- C:\gmer.zip 2009-04-12 18:59 32,793,088 a------- c:\program files\avt.exe 2009-04-12 14:21 <DIR> --d----- c:\program files\CCleaner 2009-04-12 13:20 <DIR> --d----- c:\windows\pss ==================== Find3M ==================== 2009-02-28 11:44 410,984 a------- c:\windows\system32\deploytk.dll 2009-02-28 11:20 16,278,936 a------- c:\program files\jre-6u12-windows-i586-p.exe 2009-02-09 11:19 1,846,272 a------- c:\windows\system32\win32k.sys 2009-02-09 11:19 1,846,272 -------- c:\windows\system32\dllcache\win32k.sys 2009-01-16 22:35 3,594,752 a------- c:\windows\system32\dllcache\mshtml.dll 2008-04-05 22:41 32 a------- c:\docume~1\alluse~1\applic~1\ezsid.dat 2006-12-16 18:51 251 a------- c:\program files\wt3d.ini 2009-01-09 16:22 88 ---shr-- c:\windows\system32\2FF817F2BF.sys 2007-02-12 13:52 56 ---shr-- c:\windows\system32\BFF217F82F.sys 2009-01-09 16:22 6,580 a--sh--- c:\windows\system32\KGyGaAvL.sys ============= FINISH: 21:58:24.57 =============== |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
04-15-2009, 08:56 AM
|
#2 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,489
OS: XP SP3
|
Re: unable to update antivirus/ search redirect
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ It appears that you have two antivirus programs installed and running, avast! and Webroot. While this may seem like better protection, they can actually conflict with one another and cause system instability or even system hangs. Please choose one to keep and uninstall the other via Add or Remove Programs in your Control Panel. ------------------------------------------------------ Please visit this webpage for download links, and instructions for running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix. Get help here Please post the C:\ComboFix.txt in your next reply for further review. ------------------------------------------------------ |
|
|
|
|
04-15-2009, 12:25 PM
|
#3 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 9
OS: XP
|
Re: unable to update antivirus/ search redirect
hello chemist
thanks for the help!!! Firtly i cant find webroot antivirus anywhere on my p.c (not in add/remove programs,or program file,or using search ), but i see it in the log any ideas? any way it says its disabled at the moment! The combifix log! ComboFix 09-04-15.08 - glen 15/04/2009 18:48.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.591 [GMT 1:00] Running from: c:\documents and settings\glen\Desktop\ComboFix.exe AV: Webroot Internet Security Essentials *On-access scanning disabled* (Updated) FW: Webroot Internet Security Essentials *disabled* * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\QTWMCI32.DLL c:\windows\system32\wmvlk0SCGPS.dll . ((((((((((((((((((((((((( Files Created from 2009-03-15 to 2009-04-15 ))))))))))))))))))))))))))))))) . 2009-04-12 20:36 . 2009-04-12 20:36 -------- d-----w C:\gmer 2009-04-12 20:35 . 2009-04-12 20:35 278161 ----a-w C:\gmer.zip 2009-04-12 18:11 . 2009-04-12 18:11 -------- d-----w c:\program files\Alwil Software 2009-04-12 17:59 . 2009-04-12 17:59 32793088 ----a-w c:\program files\avt.exe 2009-04-12 13:21 . 2009-04-12 13:21 -------- d-----w c:\program files\CCleaner 2009-04-01 16:57 . 2009-04-01 16:57 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\SupportSoft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-15 17:42 . 2006-12-27 18:47 -------- d-----w c:\documents and settings\glen\Application Data\Lavasoft 2009-04-15 17:29 . 2007-03-12 21:50 -------- d-----w c:\documents and settings\glen\Application Data\Skype 2009-04-12 19:31 . 2006-05-01 17:19 -------- d-----w c:\program files\LimeWire 2009-04-12 16:14 . 2008-10-25 16:30 0 ----a-w c:\documents and settings\Guest\Local Settings\Application Data\prvlcl.dat 2009-04-05 12:39 . 2007-01-01 14:52 -------- d-----r c:\program files\Skype 2009-04-05 12:39 . 2007-01-01 14:53 -------- d-----w c:\documents and settings\All Users\Application Data\Skype 2009-03-22 08:07 . 2008-04-05 21:41 -------- d-----w c:\documents and settings\glen\Application Data\skypePM 2009-03-17 19:25 . 2006-04-25 23:59 -------- d-----w c:\program files\Dell 2009-03-17 19:25 . 2009-03-17 19:25 22729 ----a-w C:\newkey 2009-03-17 19:25 . 2009-03-17 19:25 22729 ----a-w C:\newfile.enc 2009-03-17 19:25 . 2009-03-17 19:25 -------- d-----w c:\documents and settings\glen\Application Data\InstallShield 2009-02-28 17:22 . 2007-07-03 19:01 -------- d-----w c:\program files\Sky Broadband 2009-02-28 17:21 . 2009-02-23 01:07 -------- d-----w c:\program files\Panda Security 2009-02-28 17:16 . 2009-02-28 16:11 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2009-02-28 10:44 . 2008-12-05 19:10 410984 ----a-w c:\windows\system32\deploytk.dll 2009-02-28 10:37 . 2006-04-25 23:53 -------- d-----w c:\program files\Java 2009-02-28 10:20 . 2009-02-28 10:20 16278936 ----a-w c:\program files\jre-6u12-windows-i586-p.exe 2009-02-23 19:16 . 2009-02-23 19:16 -------- d-----w c:\program files\MSSOAP 2009-02-23 19:12 . 2005-08-16 19:58 -------- d-----w c:\program files\RGB 2009-02-23 19:12 . 2009-02-22 08:59 -------- d-----w c:\program files\Rightdown Software SearchBar 2009-02-23 18:11 . 2006-04-25 23:33 -------- d-----w c:\program files\i386 2009-02-23 01:18 . 2009-02-23 01:18 -------- d-----w c:\documents and settings\glen\Application Data\Malwarebytes 2009-02-23 01:18 . 2009-02-23 01:18 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes 2009-02-18 02:27 . 2007-04-06 10:34 230424 ----a-w C:\snp2sxp-001.raw 2009-02-09 10:19 . 2007-03-08 13:47 1846272 ------w c:\windows\system32\dllcache\win32k.sys 2009-02-09 10:19 . 2005-08-16 03:18 1846272 ----a-w c:\windows\system32\win32k.sys 2009-01-16 21:35 . 2006-05-19 15:06 3594752 ----a-w c:\windows\system32\dllcache\mshtml.dll 2008-04-05 21:41 . 2008-04-05 21:41 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat 2008-01-23 21:24 . 2008-01-23 21:24 32400 ----a-w c:\documents and settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2006-12-16 17:51 . 2006-12-16 17:51 251 ----a-w c:\program files\wt3d.ini 2006-07-12 19:37 . 2006-04-28 21:48 32400 ----a-w c:\documents and settings\glen\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2006-04-30 08:20 . 2006-04-28 21:27 127 ----a-w c:\documents and settings\glen\Local Settings\Application Data\fusioncache.dat 2005-08-16 19:52 . 2008-01-23 18:08 136 ----a-w c:\documents and settings\Guest\Local Settings\Application Data\fusioncache.dat 2005-08-16 19:52 . 2005-08-16 19:52 136 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-27 24103720] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ShowLOMControl"="1 (0x1)" [X] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 761947] "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 49152] "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035] "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-05-16 213936] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 86960] "RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2006-04-26 26112] "Corel Photo Downloader"="c:\program files\Corel\Corel Photo Album 6\MediaDetect.exe" [2006-02-09 106496] "tsnp2std"="c:\windows\tsnp2std.exe" [2005-11-14 110592] "snp2std"="c:\windows\vsnp2std.exe" [2005-11-16 344064] "MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792] "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-05-16 213936] "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064] "RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240] "PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472] "BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-05-19 91432] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-28 148888] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-10-09 2183168] "SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-11-16 397312] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-4-26 24576] NkvMon.exe.lnk - c:\program files\Nikon\NkView6\NkvMon.exe [2006-8-30 241664] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\StubInstaller.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\V-Gear BEE\\VBService.exe"= "c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"= "c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R2 WRConsumerService;Webroot Client Service; [x] S2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [2008-05-15 11:07 61424] S2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\Drivers\ousbehci.sys [2006-03-01 46080] S3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\DRIVERS\ousb2hub.sys [2006-03-01 56960] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] \Shell\AutoRun\command - E:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e3e33bd8-9566-11dd-8b83-0015c510eef3}] \Shell\AutoRun\command - E:\autorunner.EXE "Protect Your Stick Against Viruses.pdf" . Contents of the 'Scheduled Tasks' folder 2009-04-15 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 12:34] 2009-04-15 c:\windows\Tasks\User_Feed_Synchronization-{6DB095C5-5389-436C-B609-35D82726116E}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 12:58] . - - - - ORPHANS REMOVED - - - - HKCU-Run-Uniblue RegistryBooster 2 - c:\program files\Uniblue\RegistryBooster 2\RegistryBooster.exe . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://www.google.com/ uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab DPF: {40BF816B-D862-41B9-9445-ECA36D5F67F9} - hxxp://www.flatcast.com/de/download/NpFv412.dll DPF: {66D393D5-4D80-497C-9F4F-F3839E090202} - hxxp://www.pysoft.com/Downloads/WebCamPlayerOCX.cab DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://81.149.77.2:8085/activex/AMC.cab DPF: {E55FD215-A32E-43FE-A777-A7E8F165F557} - hxxp://data.myflatcast.com/data/objects/NpFv501.dll . ************************************************************************** catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-15 18:52 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}] "ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(2724) c:\progra~1\WINDOW~3\wmpband.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\WLTRYSVC.EXE c:\windows\system32\BCMWLTRY.EXE c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\ehome\ehrecvr.exe c:\windows\ehome\ehSched.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe c:\windows\system32\igfxsrvc.exe c:\program files\Dell Support Center\bin\sprtsvc.exe c:\windows\ehome\mcrdsvc.exe c:\windows\system32\dllhost.exe c:\windows\system32\wscntfy.exe c:\windows\ehome\ehmsas.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2009-04-15 18:57 - machine was rebooted ComboFix-quarantined-files.txt 2009-04-15 17:57 Pre-Run: 12,781,191,168 bytes free Post-Run: 13,213,057,024 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect 200 --- E O F --- 2009-03-15 11:15 thanks again G |
|
|
|
|
04-15-2009, 01:30 PM
|
#4 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,489
OS: XP SP3
|
Re: unable to update antivirus/ search redirect
Hello blesbok. Please tell us how your system is behaving.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ You did leave avast installed, correct? It appears Webroot is still registered with your WMI. We can fix that. Please follow these instructions for de-registering Webroot Internet Security Essentials: **Note: Make sure you only delete Webroot products.
Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Viewpoint Media Player<<This is considered foistware instead of malware since it is installed without users approval, but doesn't spy or do anything "bad". Please read here and here ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the quotebox below into Notepad: Quote:
 Referring to the picture above, drag CFScript onto ComboFix If you are prompted to update ComboFix, please choose Yes Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. Note: Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall. ------------------------------------------------------ Your Java is out of date. Java(TM) 6 Update 12 can be updated from the Java Control Panel. Go Start > Control Panel(Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now. An update should begin; follow the prompts. Make sure you untick the box next to Yahoo Toolbar for Firefox/Mozilla or MSN Toolbar unless you want it. ------------------------------------------------------ Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions.
 **Note** To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Please post the following in your next reply: ComboFix.txt Kaspersky report report on system behavior |
|
|
|
|
|
04-17-2009, 03:10 PM
|
#5 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 9
OS: XP
|
Re: unable to update antivirus/ search redirect
hello there!
The p.c has been behaving itself, no problems with google search ect, and avast has been updating!!! until today i still had that a.exe file on my desktop, but avast found it today out of the blue and sent it to the avast virus chest ( win32:Vupa[crypt]) when i drag and drop CFScript.txt to combofix, it starts but then it just seems to hang/stall, tried about 3 times. left it for a couple of hours and it just froze.???? anyideas where to from here?? cheers glen |
|
|
|
|
04-17-2009, 03:24 PM
|
#6 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,489
OS: XP SP3
|
Re: unable to update antivirus/ search redirect
Restart your machine and then try dragging and dropping again.
Remember to disable your antivirus and re-enable it after the run. Let me know if it still won't run. ------------------------------------------------------ |
|
|
|
|
04-17-2009, 04:49 PM
|
#8 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,489
OS: XP SP3
|
Re: unable to update antivirus/ search redirect
Go into Task Manager(Ctrl+Alt+Del) and under Processes there should be a CF#####.exe process. Right-click it and select 'End Process'.
Now try dragging and dropping again. If that doesn't work, try dragging and dropping in Safe Mode. Let me know. ------------------------------------------------------ |
|
|
|
|
04-17-2009, 06:57 PM
|
#10 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,489
OS: XP SP3
|
Re: unable to update antivirus/ search redirect
Hello again, blesbok. This problem is occurring with other users as well, although it runs on my test machine if I restart my computer. We might have to wait for an updated version of ComboFix. Try this for me:
Go Start > Run and copy/paste the following single-line command into the Run box and click OK: Code:
"C:\Documents and Settings\glen\Desktop\ComboFix.exe" "C:\Documents and Settings\glen\Desktop\CFScript.txt" |
|
|
|
|
04-18-2009, 08:05 AM
|
#12 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,489
OS: XP SP3
|
Re: unable to update antivirus/ search redirect
Hello blesbok. ComboFix has been updated. Delete ComboFix.exe from your desktop.
Please download ComboFix and Save it to your Desktop. Please follow the instructions for running ComboFix. ------------------------------------------------------ |
|
|
|
|
04-18-2009, 10:57 AM
|
#13 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 9
OS: XP
|
Re: unable to update antivirus/ search redirect
Hello chemist!
hope allso good wit you! my systems seems to be behaving, no problems! only thing is i dont have a firewall at the moment, can u recomend any? here are the logs ComboFix 09-04-18.05 - glen 18/04/2009 15:22.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.499 [GMT 1:00] Running from: c:\documents and settings\glen\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\glen\Desktop\CFScript.txt AV: avast! antivirus 4.8.1335 [VPS 090417-0] *On-access scanning disabled* (Updated) AV: Webroot Internet Security Essentials *On-access scanning disabled* (Updated) FW: Webroot Internet Security Essentials *disabled* * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\LimeWire c:\program files\LimeWire\jdic.dll c:\program files\LimeWire\lib\commons-httpclient.jar c:\program files\LimeWire\lib\commons-net.jar c:\program files\LimeWire\lib\commons-pool.jar c:\program files\LimeWire\lib\forms.jar c:\program files\LimeWire\lib\foxtrot.jar c:\program files\LimeWire\lib\guice-1.0.jar c:\program files\LimeWire\lib\httpcore-nio.jar c:\program files\LimeWire\lib\httpcore.jar c:\program files\LimeWire\lib\id3v2.jar c:\program files\LimeWire\lib\looks.jar c:\program files\LimeWire\lib\ProgressTabs.jar c:\program files\LimeWire\lib\swt.jar c:\program files\LimeWire\lib\themes.jar c:\program files\LimeWire\lib\tray.dll c:\program files\LimeWire\SystemUtilities.dll c:\program files\LimeWire\tray.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_WRCONSUMERSERVICE -------\Service_WRConsumerService ((((((((((((((((((((((((( Files Created from 2009-03-18 to 2009-04-18 ))))))))))))))))))))))))))))))) . 2009-04-17 01:49 . 2009-04-17 01:53 1374 ----a-w c:\windows\imsins.BAK 2009-04-17 01:23 . 2009-03-06 14:00 284160 ------w c:\windows\system32\dllcache\pdh.dll 2009-04-17 01:23 . 2009-02-09 10:01 473088 ------w c:\windows\system32\dllcache\fastprox.dll 2009-04-17 01:23 . 2009-02-06 10:22 110592 ------w c:\windows\system32\dllcache\services.exe 2009-04-17 01:23 . 2009-02-06 09:54 35328 ------w c:\windows\system32\dllcache\sc.exe 2009-04-17 01:23 . 2009-02-06 09:41 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe 2009-04-17 01:23 . 2005-07-26 04:20 60416 ------w c:\windows\system32\dllcache\colbact.dll 2009-04-17 01:23 . 2009-02-09 10:01 715264 ------w c:\windows\system32\dllcache\ntdll.dll 2009-04-17 01:22 . 2008-04-21 10:02 215552 ------w c:\windows\system32\dllcache\wordpad.exe 2009-04-12 20:36 . 2009-04-12 20:36 -------- d-----w C:\gmer 2009-04-12 20:35 . 2009-04-12 20:35 278161 ----a-w C:\gmer.zip 2009-04-12 18:11 . 2009-04-12 18:11 -------- d-----w c:\program files\Alwil Software 2009-04-12 17:59 . 2009-04-12 17:59 32793088 ----a-w c:\program files\avt.exe 2009-04-12 13:21 . 2009-04-12 13:21 -------- d-----w c:\program files\CCleaner 2009-04-01 16:57 . 2009-04-01 16:57 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\SupportSoft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-18 14:39 . 2007-03-12 21:50 -------- d-----w c:\documents and settings\glen\Application Data\Skype 2009-04-15 17:42 . 2006-12-27 18:47 -------- d-----w c:\documents and settings\glen\Application Data\Lavasoft 2009-04-12 16:14 . 2008-10-25 16:30 0 ----a-w c:\documents and settings\Guest\Local Settings\Application Data\prvlcl.dat 2009-04-05 12:39 . 2007-01-01 14:52 -------- d-----r c:\program files\Skype 2009-04-05 12:39 . 2007-01-01 14:53 -------- d-----w c:\documents and settings\All Users\Application Data\Skype 2009-03-22 08:07 . 2008-04-05 21:41 -------- d-----w c:\documents and settings\glen\Application Data\skypePM 2009-03-21 14:18 . 2005-08-16 03:18 986112 ----a-w c:\windows\system32\dllcache\kernel32.dll 2009-03-17 19:25 . 2006-04-25 23:59 -------- d-----w c:\program files\Dell 2009-03-17 19:25 . 2009-03-17 19:25 22729 ----a-w C:\newkey 2009-03-17 19:25 . 2009-03-17 19:25 22729 ----a-w C:\newfile.enc 2009-03-17 19:25 . 2009-03-17 19:25 -------- d-----w c:\documents and settings\glen\Application Data\InstallShield 2009-03-06 14:00 . 2005-08-16 03:18 284160 ----a-w c:\windows\system32\pdh.dll 2009-03-03 00:18 . 2005-08-16 03:18 826368 ----a-w c:\windows\system32\wininet.dll 2009-03-03 00:18 . 2005-08-16 03:18 826368 ----a-w c:\windows\system32\dllcache\wininet.dll 2009-02-28 17:22 . 2007-07-03 19:01 -------- d-----w c:\program files\Sky Broadband 2009-02-28 17:21 . 2009-02-23 01:07 -------- d-----w c:\program files\Panda Security 2009-02-28 17:16 . 2009-02-28 16:11 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2009-02-28 10:44 . 2008-12-05 19:10 410984 ----a-w c:\windows\system32\deploytk.dll 2009-02-28 10:37 . 2006-04-25 23:53 -------- d-----w c:\program files\Java 2009-02-28 10:20 . 2009-02-28 10:20 16278936 ----a-w c:\program files\jre-6u12-windows-i586-p.exe 2009-02-28 04:54 . 2006-10-17 13:04 636072 ------w c:\windows\system32\dllcache\iexplore.exe 2009-02-23 19:16 . 2009-02-23 19:16 -------- d-----w c:\program files\MSSOAP 2009-02-23 19:12 . 2005-08-16 19:58 -------- d-----w c:\program files\RGB 2009-02-23 19:12 . 2009-02-22 08:59 -------- d-----w c:\program files\Rightdown Software SearchBar 2009-02-23 18:11 . 2006-04-25 23:33 -------- d-----w c:\program files\i386 2009-02-23 01:18 . 2009-02-23 01:18 -------- d-----w c:\documents and settings\glen\Application Data\Malwarebytes 2009-02-23 01:18 . 2009-02-23 01:18 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes 2009-02-20 10:20 . 2007-05-29 09:07 13824 ------w c:\windows\system32\dllcache\ieudinit.exe 2009-02-20 10:20 . 2006-10-27 02:44 70656 ------w c:\windows\system32\dllcache\ie4uinit.exe 2009-02-20 05:14 . 2006-10-27 02:42 161792 ------w c:\windows\system32\dllcache\ieakui.dll 2009-02-18 02:27 . 2007-04-06 10:34 230424 ----a-w C:\snp2sxp-001.raw 2009-02-10 17:31 . 2009-02-10 17:31 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll 2009-02-09 10:19 . 2007-03-08 13:47 1846272 ------w c:\windows\system32\dllcache\win32k.sys 2009-02-09 10:19 . 2005-08-16 03:18 1846272 ----a-w c:\windows\system32\win32k.sys 2009-02-09 10:01 . 2006-08-17 12:28 728576 ------w c:\windows\system32\dllcache\lsasrv.dll 2009-02-09 10:01 . 2005-08-16 03:18 401408 ----a-w c:\windows\system32\rpcss.dll 2009-02-09 10:01 . 2005-08-16 03:18 401408 ----a-w c:\windows\system32\dllcache\rpcss.dll 2009-02-09 10:01 . 2005-08-16 03:18 728576 ----a-w c:\windows\system32\lsasrv.dll 2009-02-09 10:01 . 2005-08-16 03:18 617984 ----a-w c:\windows\system32\dllcache\advapi32.dll 2009-02-09 10:01 . 2005-08-16 03:18 617984 ----a-w c:\windows\system32\advapi32.dll 2009-02-09 10:01 . 2005-08-16 03:18 715264 ----a-w c:\windows\system32\ntdll.dll 2009-02-06 10:32 . 2006-12-19 16:51 2186112 ------w c:\windows\system32\dllcache\ntoskrnl.exe 2009-02-06 10:29 . 2006-12-19 16:49 2142720 ------w c:\windows\system32\dllcache\ntkrnlmp.exe 2009-02-06 10:29 . 2005-08-16 03:18 2142720 ----a-w c:\windows\system32\ntoskrnl.exe 2009-02-06 10:22 . 2005-08-16 03:18 110592 ----a-w c:\windows\system32\services.exe 2009-02-06 09:54 . 2005-08-16 03:18 35328 ----a-w c:\windows\system32\sc.exe 2009-02-06 09:49 . 2006-12-19 16:12 2020864 ------w c:\windows\system32\dllcache\ntkrpamp.exe 2009-02-06 09:49 . 2004-08-03 21:59 2020864 ----a-w c:\windows\system32\ntkrnlpa.exe 2009-02-06 09:49 . 2006-12-19 16:12 2062976 ------w c:\windows\system32\dllcache\ntkrnlpa.exe 2009-02-03 20:08 . 2005-08-16 03:18 55808 ----a-w c:\windows\system32\secur32.dll 2009-02-03 20:08 . 2005-08-16 03:18 55808 ----a-w c:\windows\system32\dllcache\secur32.dll 2008-04-05 21:41 . 2008-04-05 21:41 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat 2008-01-23 21:24 . 2008-01-23 21:24 32400 ----a-w c:\documents and settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2006-12-16 17:51 . 2006-12-16 17:51 251 ----a-w c:\program files\wt3d.ini 2006-07-12 19:37 . 2006-04-28 21:48 32400 ----a-w c:\documents and settings\glen\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2006-04-30 08:20 . 2006-04-28 21:27 127 ----a-w c:\documents and settings\glen\Local Settings\Application Data\fusioncache.dat 2005-08-16 19:52 . 2008-01-23 18:08 136 ----a-w c:\documents and settings\Guest\Local Settings\Application Data\fusioncache.dat 2005-08-16 19:52 . 2005-08-16 19:52 136 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat 2009-01-09 15:22 . 2006-04-28 21:47 88 --sh--r c:\windows\system32\2FF817F2BF.sys 2007-02-12 12:52 . 2006-09-20 16:53 56 --sh--r c:\windows\system32\BFF217F82F.sys 2009-01-09 15:22 . 2006-04-28 21:47 6580 --sha-w c:\windows\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( SnapShot@2009-04-15_17.52.53 ))))))))))))))))))))))))))))))))))))))))) . + 2009-04-18 14:37 . 2009-04-18 14:37 16384 c:\windows\Temp\Perflib_Perfdata_688.dat + 2009-04-18 14:37 . 2009-04-18 14:37 16384 c:\windows\Temp\Perflib_Perfdata_338.dat + 2005-08-16 20:06 . 2008-07-09 07:38 26488 c:\windows\system32\spupdsvc.exe - 2005-08-16 20:06 . 2007-07-27 09:41 26488 c:\windows\system32\spupdsvc.exe + 2007-01-31 13:39 . 2007-11-30 12:39 17272 c:\windows\system32\spmsg.dll - 2007-01-31 13:39 . 2007-11-30 11:18 17272 c:\windows\system32\spmsg.dll + 2005-08-16 03:18 . 2009-02-20 18:09 44544 c:\windows\system32\pngfilt.dll - 2005-08-16 03:18 . 2008-12-20 23:15 44544 c:\windows\system32\pngfilt.dll - 2005-08-16 03:18 . 2009-04-15 16:55 53838 c:\windows\system32\perfc009.dat + 2005-08-16 03:18 . 2009-04-18 06:30 53838 c:\windows\system32\perfc009.dat + 2005-08-16 03:37 . 2008-06-12 14:16 91648 c:\windows\system32\mtxoci.dll - 2005-08-16 03:18 . 2006-03-01 19:42 66560 c:\windows\system32\mtxclu.dll + 2005-08-16 03:18 . 2008-06-12 14:16 66560 c:\windows\system32\mtxclu.dll - 2006-10-27 15:09 . 2008-12-20 23:15 52224 c:\windows\system32\msfeedsbs.dll + 2006-10-27 15:09 . 2009-02-20 18:09 52224 c:\windows\system32\msfeedsbs.dll + 2005-08-16 03:37 . 2008-06-12 14:16 58880 c:\windows\system32\msdtclog.dll - 2005-08-16 03:37 . 2004-08-10 04:00 58880 c:\windows\system32\msdtclog.dll - 2005-08-16 03:18 . 2008-12-20 23:15 27648 c:\windows\system32\jsproxy.dll + 2005-08-16 03:18 . 2009-02-20 18:09 27648 c:\windows\system32\jsproxy.dll + 2006-10-27 02:44 . 2009-02-20 10:20 13824 c:\windows\system32\ieudinit.exe - 2006-10-27 02:44 . 2008-12-19 09:10 13824 c:\windows\system32\ieudinit.exe - 2005-08-16 03:18 . 2008-12-20 23:15 44544 c:\windows\system32\iernonce.dll + 2005-08-16 03:18 . 2009-02-20 18:09 44544 c:\windows\system32\iernonce.dll + 2005-08-16 03:18 . 2009-02-20 18:09 78336 c:\windows\system32\ieencode.dll - 2005-08-16 03:18 . 2006-10-17 13:06 78336 c:\windows\system32\ieencode.dll - 2005-08-16 03:18 . 2008-12-19 09:10 70656 c:\windows\system32\ie4uinit.exe + 2005-08-16 03:18 . 2009-02-20 10:20 70656 c:\windows\system32\ie4uinit.exe - 2006-10-17 12:58 . 2008-12-20 23:15 63488 c:\windows\system32\icardie.dll + 2006-10-17 12:58 . 2009-02-20 18:09 63488 c:\windows\system32\icardie.dll + 2009-04-15 18:39 . 2009-02-05 20:06 51376 c:\windows\system32\drivers\aswTdi.sys + 2009-04-15 18:39 . 2009-02-05 20:06 23152 c:\windows\system32\drivers\aswRdr.sys + 2009-04-15 18:39 . 2009-02-05 20:08 94032 c:\windows\system32\drivers\aswmon2.sys + 2009-04-15 18:39 . 2009-02-05 20:08 93296 c:\windows\system32\drivers\aswmon.sys + 2009-04-15 18:39 . 2009-02-05 20:07 20560 c:\windows\system32\drivers\aswFsBlk.sys + 2009-04-15 18:39 . 2009-02-05 20:05 26944 c:\windows\system32\drivers\aavmker4.sys - 2006-05-10 05:25 . 2008-12-20 23:15 44544 c:\windows\system32\dllcache\pngfilt.dll + 2006-05-10 05:25 . 2009-02-20 18:09 44544 c:\windows\system32\dllcache\pngfilt.dll + 2008-06-12 14:16 . 2008-06-12 14:16 91648 c:\windows\system32\dllcache\mtxoci.dll + 2008-06-12 14:16 . 2008-06-12 14:16 66560 c:\windows\system32\dllcache\mtxclu.dll + 2007-05-29 09:07 . 2009-02-20 18:09 52224 c:\windows\system32\dllcache\msfeedsbs.dll - 2007-05-29 09:07 . 2008-12-20 23:15 52224 c:\windows\system32\dllcache\msfeedsbs.dll + 2008-06-12 14:16 . 2008-06-12 14:16 58880 c:\windows\system32\dllcache\msdtclog.dll + 2006-05-10 05:25 . 2009-02-20 18:09 27648 c:\windows\system32\dllcache\jsproxy.dll - 2006-05-10 05:25 . 2008-12-20 23:15 27648 c:\windows\system32\dllcache\jsproxy.dll + 2006-10-27 02:44 . 2009-02-20 18:09 44544 c:\windows\system32\dllcache\iernonce.dll - 2006-10-27 02:44 . 2008-12-20 23:15 44544 c:\windows\system32\dllcache\iernonce.dll + 2006-10-17 13:06 . 2009-02-20 18:09 78336 c:\windows\system32\dllcache\ieencode.dll - 2006-10-17 13:06 . 2006-10-17 13:06 78336 c:\windows\system32\dllcache\ieencode.dll + 2007-08-20 10:04 . 2009-02-20 18:09 63488 c:\windows\system32\dllcache\icardie.dll - 2007-08-20 10:04 . 2008-12-20 23:15 63488 c:\windows\system32\dllcache\icardie.dll - 2005-08-16 03:37 . 2005-07-26 04:39 60416 c:\windows\system32\colbact.dll + 2005-08-16 03:37 . 2005-07-26 04:20 60416 c:\windows\system32\colbact.dll + 2009-04-15 18:39 . 2009-02-05 20:04 97480 c:\windows\system32\AvastSS.scr + 2009-04-17 01:52 . 2008-12-20 23:15 44544 c:\windows\ie7updates\KB963027-IE7\pngfilt.dll + 2009-04-17 01:52 . 2008-12-20 23:15 52224 c:\windows\ie7updates\KB963027-IE7\msfeedsbs.dll + 2009-04-17 01:52 . 2008-12-20 23:15 27648 c:\windows\ie7updates\KB963027-IE7\jsproxy.dll + 2009-04-17 01:52 . 2008-12-19 09:10 13824 c:\windows\ie7updates\KB963027-IE7\ieudinit.exe + 2009-04-17 01:52 . 2008-12-20 23:15 44544 c:\windows\ie7updates\KB963027-IE7\iernonce.dll + 2009-04-17 01:52 . 2006-10-17 13:06 78336 c:\windows\ie7updates\KB963027-IE7\ieencode.dll + 2009-04-17 01:52 . 2008-12-19 09:10 70656 c:\windows\ie7updates\KB963027-IE7\ie4uinit.exe + 2009-04-17 01:52 . 2008-12-20 23:15 63488 c:\windows\ie7updates\KB963027-IE7\icardie.dll + 2005-08-16 03:18 . 2008-12-16 12:47 351232 c:\windows\system32\winhttp.dll - 2005-08-16 03:18 . 2004-08-10 04:00 351232 c:\windows\system32\winhttp.dll - 2005-08-16 03:18 . 2008-12-20 23:15 233472 c:\windows\system32\webcheck.dll + 2005-08-16 03:18 . 2009-02-20 18:09 233472 c:\windows\system32\webcheck.dll + 2005-08-16 03:37 . 2009-02-06 09:41 227840 c:\windows\system32\wbem\wmiprvse.exe + 2005-08-16 03:37 . 2009-02-10 17:31 453120 c:\windows\system32\wbem\wmiprvsd.dll + 2005-08-16 03:37 . 2009-02-09 10:01 473088 c:\windows\system32\wbem\fastprox.dll + 2005-08-16 03:18 . 2009-02-20 18:09 105984 c:\windows\system32\url.dll - 2005-08-16 03:18 . 2008-12-20 23:15 105984 c:\windows\system32\url.dll - 2005-08-16 03:18 . 2009-04-15 16:55 382260 c:\windows\system32\perfh009.dat + 2005-08-16 03:18 . 2009-04-18 06:30 382260 c:\windows\system32\perfh009.dat - 2005-08-16 03:18 . 2008-12-20 23:15 102912 c:\windows\system32\occache.dll + 2005-08-16 03:18 . 2009-02-20 18:09 102912 c:\windows\system32\occache.dll - 2005-08-16 03:18 . 2008-12-20 23:15 671232 c:\windows\system32\mstime.dll + 2005-08-16 03:18 . 2009-02-20 18:09 671232 c:\windows\system32\mstime.dll - 2005-08-16 03:18 . 2008-12-20 23:15 193024 c:\windows\system32\msrating.dll + 2005-08-16 03:18 . 2009-02-20 18:09 193024 c:\windows\system32\msrating.dll + 2005-08-16 03:18 . 2009-02-20 18:09 477696 c:\windows\system32\mshtmled.dll - 2005-08-16 03:18 . 2008-12-20 23:15 477696 c:\windows\system32\mshtmled.dll + 2006-10-27 15:09 . 2009-02-20 18:09 459264 c:\windows\system32\msfeeds.dll - 2006-10-27 15:09 . 2008-12-20 23:15 459264 c:\windows\system32\msfeeds.dll + 2005-08-16 03:37 . 2008-06-12 14:16 161792 c:\windows\system32\msdtcuiu.dll + 2005-08-16 03:37 . 2008-06-12 14:16 956928 c:\windows\system32\msdtctm.dll + 2005-08-16 03:37 . 2008-06-12 14:16 428032 c:\windows\system32\msdtcprx.dll + 2005-08-16 03:18 . 2009-03-21 14:18 986112 c:\windows\system32\kernel32.dll + 2006-10-17 12:57 . 2009-02-20 18:09 268288 c:\windows\system32\iertutil.dll + 2005-08-16 03:18 . 2009-02-20 18:09 385024 c:\windows\system32\iedkcs32.dll + 2006-10-17 12:27 . 2009-02-20 18:09 383488 c:\windows\system32\ieapfltr.dll - 2006-10-17 12:27 . 2008-12-20 23:15 383488 c:\windows\system32\ieapfltr.dll - 2005-08-16 03:18 . 2008-12-19 05:23 161792 c:\windows\system32\ieakui.dll + 2005-08-16 03:18 . 2009-02-20 05:14 161792 c:\windows\system32\ieakui.dll + 2005-08-16 03:18 . 2009-02-20 18:09 230400 c:\windows\system32\ieaksie.dll - 2005-08-16 03:18 . 2008-12-20 23:15 230400 c:\windows\system32\ieaksie.dll - 2005-08-16 03:18 . 2008-12-20 23:15 153088 c:\windows\system32\ieakeng.dll + 2005-08-16 03:18 . 2009-02-20 18:09 153088 c:\windows\system32\ieakeng.dll + 2005-08-16 03:18 . 2009-02-20 18:09 133120 c:\windows\system32\extmgr.dll - 2005-08-16 03:18 . 2008-12-20 23:15 133120 c:\windows\system32\extmgr.dll - 2005-08-16 03:18 . 2008-12-20 23:15 214528 c:\windows\system32\dxtrans.dll + 2005-08-16 03:18 . 2009-02-20 18:09 214528 c:\windows\system32\dxtrans.dll - 2005-08-16 03:18 . 2008-12-20 23:15 347136 c:\windows\system32\dxtmsft.dll + 2005-08-16 03:18 . 2009-02-20 18:09 347136 c:\windows\system32\dxtmsft.dll + 2009-04-15 18:39 . 2009-02-05 20:07 114768 c:\windows\system32\drivers\aswSP.sys + 2005-08-16 03:18 . 2008-12-16 12:47 351232 c:\windows\system32\dllcache\winhttp.dll - 2005-08-16 03:18 . 2004-08-10 04:00 351232 c:\windows\system32\dllcache\winhttp.dll - 2006-10-27 15:09 . 2008-12-20 23:15 233472 c:\windows\system32\dllcache\webcheck.dll + 2006-10-27 15:09 . 2009-02-20 18:09 233472 c:\windows\system32\dllcache\webcheck.dll + 2006-10-17 13:05 . 2009-02-20 18:09 105984 c:\windows\system32\dllcache\url.dll - 2006-10-17 13:05 . 2008-12-20 23:15 105984 c:\windows\system32\dllcache\url.dll - 2006-10-17 13:04 . 2008-12-20 23:15 102912 c:\windows\system32\dllcache\occache.dll + 2006-10-17 13:04 . 2009-02-20 18:09 102912 c:\windows\system32\dllcache\occache.dll - 2006-05-10 05:25 . 2008-12-20 23:15 671232 c:\windows\system32\dllcache\mstime.dll + 2006-05-10 05:25 . 2009-02-20 18:09 671232 c:\windows\system32\dllcache\mstime.dll + 2006-05-10 05:25 . 2009-02-20 18:09 193024 c:\windows\system32\dllcache\msrating.dll - 2006-05-10 05:25 . 2008-12-20 23:15 193024 c:\windows\system32\dllcache\msrating.dll + 2005-08-16 03:18 . 2009-02-20 18:09 477696 c:\windows\system32\dllcache\mshtmled.dll - 2005-08-16 03:18 . 2008-12-20 23:15 477696 c:\windows\system32\dllcache\mshtmled.dll + 2007-05-29 09:07 . 2009-02-20 18:09 459264 c:\windows\system32\dllcache\msfeeds.dll - 2007-05-29 09:07 . 2008-12-20 23:15 459264 c:\windows\system32\dllcache\msfeeds.dll + 2008-06-12 14:16 . 2008-06-12 14:16 161792 c:\windows\system32\dllcache\msdtcuiu.dll + 2008-06-12 14:16 . 2008-06-12 14:16 956928 c:\windows\system32\dllcache\msdtctm.dll + 2008-06-12 14:16 . 2008-06-12 14:16 428032 c:\windows\system32\dllcache\msdtcprx.dll + 2007-05-29 09:07 . 2009-02-20 18:09 268288 c:\windows\system32\dllcache\iertutil.dll + 2006-10-27 02:44 . 2009-02-20 18:09 385024 c:\windows\system32\dllcache\iedkcs32.dll + 2007-05-29 09:07 . 2009-02-20 18:09 383488 c:\windows\system32\dllcache\ieapfltr.dll - 2007-05-29 09:07 . 2008-12-20 23:15 383488 c:\windows\system32\dllcache\ieapfltr.dll + 2006-10-27 02:44 . 2009-02-20 18:09 230400 c:\windows\system32\dllcache\ieaksie.dll - 2006-10-27 02:44 . 2008-12-20 23:15 230400 c:\windows\system32\dllcache\ieaksie.dll + 2006-10-27 02:44 . 2009-02-20 18:09 153088 c:\windows\system32\dllcache\ieakeng.dll - 2006-10-27 02:44 . 2008-12-20 23:15 153088 c:\windows\system32\dllcache\ieakeng.dll - 2006-05-10 05:25 . 2008-12-20 23:15 133120 c:\windows\system32\dllcache\extmgr.dll + 2006-05-10 05:25 . 2009-02-20 18:09 133120 c:\windows\system32\dllcache\extmgr.dll + 2006-05-10 05:25 . 2009-02-20 18:09 214528 c:\windows\system32\dllcache\dxtrans.dll - 2006-05-10 05:25 . 2008-12-20 23:15 214528 c:\windows\system32\dllcache\dxtrans.dll - 2006-05-10 05:25 . 2008-12-20 23:15 347136 c:\windows\system32\dllcache\dxtmsft.dll + 2006-05-10 05:25 . 2009-02-20 18:09 347136 c:\windows\system32\dllcache\dxtmsft.dll + 2005-08-16 03:18 . 2009-02-20 18:09 124928 c:\windows\system32\dllcache\advpack.dll - 2005-08-16 03:18 . 2008-12-20 23:15 124928 c:\windows\system32\dllcache\advpack.dll - 2005-08-16 03:18 . 2008-12-20 23:15 124928 c:\windows\system32\advpack.dll + 2005-08-16 03:18 . 2009-02-20 18:09 124928 c:\windows\system32\advpack.dll + 2009-04-17 01:52 . 2008-12-20 23:15 826368 c:\windows\ie7updates\KB963027-IE7\wininet.dll + 2009-04-17 01:52 . 2008-12-20 23:15 233472 c:\windows\ie7updates\KB963027-IE7\webcheck.dll + 2009-04-17 01:52 . 2008-12-20 23:15 105984 c:\windows\ie7updates\KB963027-IE7\url.dll + 2009-04-17 01:52 . 2008-07-09 07:38 382840 c:\windows\ie7updates\KB963027-IE7\spuninst\updspapi.dll + 2009-04-17 01:52 . 2008-07-08 13:02 231288 c:\windows\ie7updates\KB963027-IE7\spuninst\spuninst.exe + 2009-04-17 01:52 . 2008-12-20 23:15 102912 c:\windows\ie7updates\KB963027-IE7\occache.dll + 2009-04-17 01:52 . 2008-12-20 23:15 671232 c:\windows\ie7updates\KB963027-IE7\mstime.dll + 2009-04-17 01:52 . 2008-12-20 23:15 193024 c:\windows\ie7updates\KB963027-IE7\msrating.dll + 2009-04-17 01:52 . 2008-12-20 23:15 477696 c:\windows\ie7updates\KB963027-IE7\mshtmled.dll + 2009-04-17 01:52 . 2008-12-20 23:15 459264 c:\windows\ie7updates\KB963027-IE7\msfeeds.dll + 2009-04-17 01:52 . 2008-12-19 05:25 634024 c:\windows\ie7updates\KB963027-IE7\iexplore.exe + 2009-04-17 01:52 . 2008-12-20 23:15 267776 c:\windows\ie7updates\KB963027-IE7\iertutil.dll + 2009-04-17 01:52 . 2008-12-20 23:15 384512 c:\windows\ie7updates\KB963027-IE7\iedkcs32.dll + 2009-04-17 01:52 . 2008-12-20 23:15 383488 c:\windows\ie7updates\KB963027-IE7\ieapfltr.dll + 2009-04-17 01:52 . 2008-12-19 05:23 161792 c:\windows\ie7updates\KB963027-IE7\ieakui.dll + 2009-04-17 01:52 . 2008-12-20 23:15 230400 c:\windows\ie7updates\KB963027-IE7\ieaksie.dll + 2009-04-17 01:52 . 2008-12-20 23:15 153088 c:\windows\ie7updates\KB963027-IE7\ieakeng.dll + 2009-04-17 01:52 . 2008-12-20 23:15 133120 c:\windows\ie7updates\KB963027-IE7\extmgr.dll + 2009-04-17 01:52 . 2008-12-20 23:15 214528 c:\windows\ie7updates\KB963027-IE7\dxtrans.dll + 2009-04-17 01:52 . 2008-12-20 23:15 347136 c:\windows\ie7updates\KB963027-IE7\dxtmsft.dll + 2009-04-17 01:52 . 2008-12-20 23:15 124928 c:\windows\ie7updates\KB963027-IE7\advpack.dll - 2005-08-16 03:18 . 2008-12-20 23:15 1160192 c:\windows\system32\urlmon.dll + 2005-08-16 03:18 . 2009-02-20 18:09 1160192 c:\windows\system32\urlmon.dll + 2005-08-16 03:18 . 2008-12-20 22:59 1288192 c:\windows\system32\quartz.dll - 2005-08-16 03:18 . 2008-05-07 04:55 1288192 c:\windows\system32\quartz.dll + 2005-08-16 03:18 . 2009-02-20 18:09 3595264 c:\windows\system32\mshtml.dll + 2006-10-27 15:09 . 2009-02-20 18:09 6066176 c:\windows\system32\ieframe.dll + 2006-09-06 00:01 . 2008-07-09 14:25 2455488 c:\windows\system32\ieapfltr.dat - 2006-09-06 00:01 . 2007-04-17 09:28 2455488 c:\windows\system32\ieapfltr.dat - 2005-08-16 03:18 . 2008-12-20 23:15 1160192 c:\windows\system32\dllcache\urlmon.dll + 2005-08-16 03:18 . 2009-02-20 18:09 1160192 c:\windows\system32\dllcache\urlmon.dll - 2007-10-29 22:35 . 2008-05-07 04:55 1288192 c:\windows\system32\dllcache\quartz.dll + 2007-10-29 22:35 . 2008-12-20 22:59 1288192 c:\windows\system32\dllcache\quartz.dll + 2006-05-19 15:06 . 2009-02-20 18:09 3595264 c:\windows\system32\dllcache\mshtml.dll + 2007-05-29 09:07 . 2009-02-20 18:09 6066176 c:\windows\system32\dllcache\ieframe.dll + 2007-05-29 09:07 . 2008-07-09 14:25 2455488 c:\windows\system32\dllcache\ieapfltr.dat - 2007-05-29 09:07 . 2007-04-17 09:28 2455488 c:\windows\system32\dllcache\ieapfltr.dat + 2009-04-15 18:39 . 2009-02-05 20:11 1256296 c:\windows\system32\aswBoot.exe + 2009-04-17 01:52 . 2008-12-20 23:15 1160192 c:\windows\ie7updates\KB963027-IE7\urlmon.dll + 2009-04-17 01:52 . 2009-01-16 21:35 3594752 c:\windows\ie7updates\KB963027-IE7\mshtml.dll + 2009-04-17 01:52 . 2008-12-20 23:15 6066688 c:\windows\ie7updates\KB963027-IE7\ieframe.dll + 2009-04-17 01:52 . 2007-04-17 09:28 2455488 c:\windows\ie7updates\KB963027-IE7\ieapfltr.dat + 2005-03-02 00:59 . 2009-02-06 10:32 2186112 c:\windows\Driver Cache\i386\ntoskrnl.exe - 2006-04-25 23:55 . 2008-08-14 09:18 2020864 c:\windows\Driver Cache\i386\ntkrpamp.exe + 2006-04-25 23:55 . 2009-02-06 09:49 2020864 c:\windows\Driver Cache\i386\ntkrpamp.exe - 2005-03-02 00:34 . 2008-08-14 09:18 2062976 c:\windows\Driver Cache\i386\ntkrnlpa.exe + 2005-03-02 00:34 . 2009-02-06 09:49 2062976 c:\windows\Driver Cache\i386\ntkrnlpa.exe + 2006-04-25 23:55 . 2009-02-06 10:29 2142720 c:\windows\Driver Cache\i386\ntkrnlmp.exe - 2006-04-25 23:55 . 2008-08-14 09:55 2142720 c:\windows\Driver Cache\i386\ntkrnlmp.exe + 2006-05-06 17:24 . 2009-04-06 14:57 24921544 c:\windows\system32\MRT.exe . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-03-27 24103720] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ShowLOMControl"="1 (0x1)" [X] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 761947] "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 49152] "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035] "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-05-16 213936] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-05-16 86960] "RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2006-04-26 26112] "Corel Photo Downloader"="c:\program files\Corel\Corel Photo Album 6\MediaDetect.exe" [2006-02-09 106496] "tsnp2std"="c:\windows\tsnp2std.exe" [2005-11-14 110592] "snp2std"="c:\windows\vsnp2std.exe" [2005-11-16 344064] "MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 1121792] "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-05-16 213936] "dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384] "DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064] "RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-20 83240] "PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472] "BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-05-19 91432] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-28 148888] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-10-09 2183168] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000] "SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-11-16 397312] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-4-26 24576] NkvMon.exe.lnk - c:\program files\Nikon\NkView6\NkvMon.exe [2006-8-30 241664] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\StubInstaller.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= "c:\\Program Files\\V-Gear BEE\\VBService.exe"= "c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"= "c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= S1 aswSP;avast! Self Protection; [x] S2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [2008-05-15 11:07 61424] S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560] S2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\Drivers\ousbehci.sys [2006-03-01 46080] S3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\DRIVERS\ousb2hub.sys [2006-03-01 56960] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] \Shell\AutoRun\command - E:\setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e3e33bd8-9566-11dd-8b83-0015c510eef3}] \Shell\AutoRun\command - E:\autorunner.EXE "Protect Your Stick Against Viruses.pdf" . Contents of the 'Scheduled Tasks' folder 2009-04-15 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 12:34] 2009-04-18 c:\windows\Tasks\User_Feed_Synchronization-{6DB095C5-5389-436C-B609-35D82726116E}.job - c:\windows\system32\msfeedssync.exe [2006-10-17 12:58] . . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = hxxp://www.google.com/ uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab DPF: {40BF816B-D862-41B9-9445-ECA36D5F67F9} - hxxp://www.flatcast.com/de/download/NpFv412.dll DPF: {66D393D5-4D80-497C-9F4F-F3839E090202} - hxxp://www.pysoft.com/Downloads/WebCamPlayerOCX.cab DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://81.149.77.2:8085/activex/AMC.cab DPF: {E55FD215-A32E-43FE-A777-A7E8F165F557} - hxxp://data.myflatcast.com/data/objects/NpFv501.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-18 15:39 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\WRConsumerService] "ImagePath"="\"c:\program files\Webroot\WebrootSecurity\WRConsumerService.exe\"" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}] "ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'explorer.exe'(608) c:\progra~1\WINDOW~3\wmpband.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\WLTRYSVC.EXE c:\windows\system32\BCMWLTRY.EXE c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\ehome\ehrecvr.exe c:\windows\ehome\ehSched.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe c:\program files\Dell Support Center\bin\sprtsvc.exe c:\windows\ehome\mcrdsvc.exe c:\windows\system32\dllhost.exe c:\windows\system32\wscntfy.exe c:\windows\system32\igfxsrvc.exe c:\windows\ehome\ehmsas.exe c:\program files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2009-04-18 15:43 - machine was rebooted ComboFix-quarantined-files.txt 2009-04-18 14:43 ComboFix2.txt 2009-04-15 17:57 Pre-Run: 12,359,278,592 bytes free Post-Run: 12,673,069,056 bytes free 448 --- E O F --- 2009-04-17 01:53 KASPERSKY Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 71594 Threat name: 1 Infected objects: 1 Suspicious objects: 0 Duration of the scan: 01:31:42 File name / Threat name / Threats count C:\Program Files\Dell Support Center\HWDiag\bin\pcd5srvc.pkms Infected: Trojan.Win32.DNSChanger.ojr 1 The selected area was scanned. Thanks agin G |
|
|
|
|
04-18-2009, 12:16 PM
|
#14 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,489
OS: XP SP3
|
Re: unable to update antivirus/ search redirect
Hello again, blesbok. Unless this is a laptop, you really don't need a firewall. If you want one, you can find references for free ones in some articles you will read when we are done.
It appears you didn't de-register Webroot from your WMI. Did you follow the instructions for doing so in post #4 above? Not sure why Kaspersky is flagging that pcd5srvc.pkms file. It's on my computer. Please go to: VirusTotal
|
|
|
|
|
04-18-2009, 02:20 PM
|
#15 (permalink) |
|
Registered User
Join Date: Apr 2009
Posts: 9
OS: XP
|
Re: unable to update antivirus/ search redirect
hello chemist
yes 100 percent I had missed a step! i have now deleted webroot. yes this is a laptop so i will lookout for a firewall when we done. thanks results from virus total File pcd5srvc.pkms received on 04.18.2009 21:58:25 (CET)Antivirus Version Last Update Result a-squared 4.0.0.101 2009.04.18 - AhnLab-V3 5.0.0.2 2009.04.18 - AntiVir 7.9.0.148 2009.04.18 - Antiy-AVL 2.0.3.1 2009.04.17 - Authentium 5.1.2.4 2009.04.18 - Avast 4.8.1335.0 2009.04.18 - AVG 8.5.0.287 2009.04.18 - BitDefender 7.2 2009.04.18 - CAT-QuickHeal 10.00 2009.04.18 - ClamAV 0.94.1 2009.04.18 - Comodo 1120 2009.04.18 - DrWeb 4.44.0.09170 2009.04.18 - eSafe 7.0.17.0 2009.04.13 - eTrust-Vet 31.6.6455 2009.04.14 - F-Prot 4.4.4.56 2009.04.17 - F-Secure 8.0.14470.0 2009.04.18 - Fortinet 3.117.0.0 2009.04.18 - GData 19 2009.04.18 - Ikarus T3.1.1.49.0 2009.04.18 - K7AntiVirus 7.10.707 2009.04.17 - Kaspersky 7.0.0.125 2009.04.18 Trojan.Win32.DNSChanger.ojr McAfee 5588 2009.04.18 - McAfee+Artemis 5588 2009.04.18 - McAfee-GW-Edition 6.7.6 2009.04.18 - Microsoft 1.4502 2009.04.18 - NOD32 4019 2009.04.18 - Norman 6.00.06 2009.04.17 - nProtect 2009.1.8.0 2009.04.18 - Panda 10.0.0.14 2009.04.18 - PCTools 4.4.2.0 2009.04.17 - Prevx1 V2 2009.04.18 - Rising 21.25.52.00 2009.04.18 - Sophos 4.40.0 2009.04.18 - Sunbelt 3.2.1858.2 2009.04.18 - Symantec 1.4.4.12 2009.04.18 - TheHacker 6.3.4.0.309 2009.04.16 - TrendMicro 8.700.0.1004 2009.04.17 - VBA32 3.12.10.2 2009.04.12 suspected of Win32.BrokenEmbeddedSignature (paranoid heuristics) ViRobot 2009.4.18.1685 2009.04.18 - VirusBuster 4.6.5.0 2009.04.18 - Additional information File size: 20640 bytes MD5...: fe11b610ea44101ef9dcba7f38340f64 SHA1..: 1bb6925872a66083137bc724ac08dbb4cd81d8ca SHA256: ba28b5a70dfff682418265936749901aff53eb90400dfd7ad9ceda40c3862f09 SHA512: 9d337481114b52fd81bdf6aaf475e3ab6333c22d2b299770ccb261f02636ade9<BR>0c69f2bc47b4b83306e0bb2e58ff2ff3ab769b1425d7ea2eef0d15c40dc7a322 ssdeep: 384:LVoYw0itPUV7g4acQ4Y+AV0pQieqmVDonRUSlWVw2SUledpXTbO6j+:L8pnP<BR>cA+AV0pPkluDbOm+<BR> PEiD..: - TrID..: File type identification<BR>Win32 Executable Generic (51.1%)<BR>Win16/32 Executable Delphi generic (12.4%)<BR>Clipper DOS Executable (12.1%)<BR>Generic Win/DOS Executable (12.0%)<BR>DOS Executable Generic (12.0%) PEInfo: PE Structure information<BR><BR>( base data )<BR>entrypointaddress.: 0x3405<BR>timedatestamp.....: 0x47571fe5 (Wed Dec 05 22:02:13 2007)<BR>machinetype.......: 0x14c (I386)<BR><BR>( 8 sections )<BR>name viradd virsiz rawdsiz ntrpy md5<BR>page 0x500 0x16a4 0x1700 6.18 cb5426fc5b4f01069436933485a39b6a<BR>.text 0x1c00 0x1444 0x1480 6.16 c947d476ede4e798aaf4fe73b8779138<BR>init 0x3080 0x75 0x80 4.83 0678c7145a7e86e1b0407bc31822a4b0<BR>.rdata 0x3100 0x234 0x280 3.89 de0f15920e9d8dfedeec6461f9465a7e<BR>.data 0x3380 0x50 0x80 0.38 0c41a08c90a7d5e81bf065649ebabedc<BR>INIT 0x3400 0x56a 0x580 5.49 b3ad787a16f9b5ba6e759550a3f9955d<BR>.rsrc 0x3980 0x2f8 0x300 3.17 9e9b9b5eeaa028259ea7919cc7d9ad56<BR>.reloc 0x3c80 0x2dc 0x300 5.60 4a59d8ef65a68dc8da431729806784e5<BR><BR>( 2 imports ) <BR>> ntoskrnl.exe: ObfDereferenceObject, IoGetDeviceObjectPointer, RtlAnsiStringToUnicodeString, RtlInitAnsiString, KeWaitForSingleObject, IofCallDriver, IoBuildDeviceIoControlRequest, KeInitializeEvent, MmUnmapIoSpace, READ_REGISTER_UCHAR, MmMapIoSpace, WRITE_REGISTER_UCHAR, ExFreePool, WRITE_REGISTER_USHORT, READ_REGISTER_ULONG, WRITE_REGISTER_ULONG, IoFreeMdl, MmUnlockPages, MmProbeAndLockPages, IoAllocateMdl, KeDelayExecutionThread, _allmul, IoGetAttachedDeviceReference, KeTickCount, KeBugCheckEx, IofCompleteRequest, _except_handler3, RtlInitUnicodeString, ExAllocatePoolWithTag, RtlAppendUnicodeStringToString, IoCreateDevice, RtlFreeUnicodeString, RtlCopyUnicodeString, IoDeleteDevice, InterlockedDecrement, READ_REGISTER_USHORT, InterlockedIncrement<BR>> HAL.dll: HalSetBusData, HalGetBusData, WRITE_PORT_ULONG, READ_PORT_ULONG, WRITE_PORT_USHORT, READ_PORT_USHORT, WRITE_PORT_UCHAR, READ_PORT_UCHAR, HalSetBusDataByOffset, HalGetBusDataByOffset, KeStallExecutionProcessor<BR><BR>( 0 exports ) <BR> RDS...: NSRL Reference Data Set |
|
|
|
|
04-18-2009, 02:49 PM
|
#16 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,489
OS: XP SP3
|
Re: unable to update antivirus/ search redirect
Hello again, blesbok. I don't think that file is malicious, so we will leave it.
------------------------------------------------------ Congratulations. Well done! Your logs appear clean. You should be good to go. Please disable avast! before uninstalling ComboFix and then re-enable it after doing so. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:
Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
| Thread Tools | |
|
|
