Need help, some various problems

dispixie3 · 06-03-2009, 04:39 PM

I have been getting a lot of "Secure Connection Failed" messages and I have been clicking "exception" and I'm thinking I shouldn't be doing that all the time. ALso, when my computer starts up McAfee gives me a message that something is wrong, but when I go into McAfee it says everything is okay, even if I do a scan. Finally, stupid me ran a free scan (intelinet) and now I can't get rid of them. DDS Report follows and 2zip files are added through management attachments.

Thanking you in advance,
Kimberly

DDS (Ver_09-05-14.01) - NTFSx86
Run by Mark Moore at 22:03:13.05 on Wed 01/02/2002
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1006.424 [GMT -5:00]

AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\bmwebcfg.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\xtras\mssysmgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Adobe\Adobe Acrobat 6.0 CE\Distillr\acrotray.exe
C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Nikon\NkView6\NkvMon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Mark Moore\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = <local>;*.local
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\adobe acrobat 6.0 ce\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\adobe acrobat 6.0 ce\acrobat\AcroIEFavClient.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {724D43A0-0D85-11D4-9908-00400523E39A} - No File
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\adobe acrobat 6.0 ce\acrobat\AcroIEFavClient.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [MoneyAgent] "c:\program files\microsoft money\system\mnyexpr.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [PhotoShow Deluxe Media Manager] c:\progra~1\simple~1\photos~1\data\xtras\mssysmgr.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [Intelinet] c:\program files\intelinet\Intelinet.exe
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [mmtask] c:\program files\musicmatch\musicmatch jukebox\mmtask.exe
mRun: [MMTray] c:\program files\musicmatch\musicmatch jukebox\mm_tray.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe"
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Verizon_McciTrayApp] c:\program files\verizon\McciTrayApp.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\adobe acrobat 6.0 ce\distillr\acrotray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\datavi~1.lnk - c:\program files\common files\dataviz\DvzIncMsgr.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hotsyn~1.lnk - c:\program files\palmone\Hotsync.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpimag~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nkvmon~1.lnk - c:\program files\nikon\nkview6\NkvMon.exe
uPolicies-system: RunStartupScriptSync = 1 (0x1)
mPolicies-system: RunStartupScriptSync = 1 (0x1)
IE: RemindU. - file://c:\program files\upromise_remind_u\upromisesremindu\upromisetremindu\uproC0.htm
IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
LSP: bmnet.dll
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {B1647320-9EC8-4B0F-BF53-93D4A43FA614} - hxxps://mydesk-pi01.morganstanley.com/prx/000/http/rc-na.ms.com:8180/mydesk/common/htdocs/SPX/1.6.2.0/TerminalSvcsTCS.cab
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Notify: igfxcui - igfxdev.dll
SSODL: VolumeComponent - {b1aed209-5cf2-4013-9235-999f7ff1ae4a} - No File

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\markmo~1\applic~1\mozilla\firefox\profiles\0xs7t934.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-9-8 28544]
R1 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2006-10-14 214024]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-9-18 210216]
R2 McProxy;McAfee Proxy Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2007-11-5 359952]
R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2006-10-14 144704]
R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2006-10-14 606736]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2006-10-14 79880]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2006-10-14 35272]
R3 mfesmfk;McAfee Inc. mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2006-10-14 40552]
S2 gupdate1c9b574f47a2d4c;Google Update Service (gupdate1c9b574f47a2d4c);c:\program files\google\update\GoogleUpdate.exe [2009-4-4 133104]
S3 ACGPRS;Sierra Wireless 3G Adapter;c:\windows\system32\drivers\acgprs.sys [2005-9-19 88192]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2008-9-16 33752]
S3 mferkdk;McAfee Inc. mferkdk;c:\windows\system32\drivers\mferkdk.sys [2006-10-14 34216]
S3 Nikon1394;Nikon1394Driver;c:\windows\system32\drivers\NikonDx.sys [2006-7-4 106172]
S3 SDTHOOK;SDTHOOK;c:\windows\system32\drivers\SDTHOOK.SYS [2008-3-13 44928]
S3 SQTECH907B;EZCam(PID_907B_00);c:\windows\system32\drivers\Capt907B.sys [2007-1-27 61643]

=============== Created Last 30 ================

2002-01-02 22:02 <DIR> --d-h--- c:\windows\PIF
2001-12-07 13:40 22,486 a------- c:\windows\system32\LRNXP.ICO

==================== Find3M ====================

2008-09-18 22:07 61,224 a------- c:\documents and settings\mark moore\GoToAssistDownloadHelper.exe
2002-05-28 12:21 556,034 a----r-- c:\program files\DATA1.CAB
2001-11-14 23:00 47,104 a------- c:\windows\system32\escimgd.dll
2001-11-07 12:28 49,152 -------- c:\windows\help\sbsi\training\usersid.exe
2001-11-06 14:57 10,000,712 a------- c:\windows\system32\MSO.DLL
2001-10-31 16:50 53,248 a------- c:\windows\system32\makename.dll
2001-10-26 16:16 16,384 a------- c:\windows\system32\FileOps.exe
2010-04-09 17:48 1,537 a--sh--- c:\windows\page files\maxmeg.sys
2006-10-31 11:37 1,056 a--sh--- c:\windows\system32\KGyGaAvL.sys
2008-09-09 05:57 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090920080910\index.dat
2009-05-13 15:28 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat
2008-09-18 10:18 32,768 a--sh--- c:\windows\temp\cookies\index.dat
2008-09-18 10:18 32,768 a--sh--- c:\windows\temp\history\history.ie5\index.dat
2008-09-18 10:18 49,152 a--sh--- c:\windows\temp\temporary internet files\content.ie5\index.dat

============= FINISH: 22:05:07.60 ===============

**chemist** · 06-04-2009, 02:27 PM

Hello and Welcome to TSF.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper.

------------------------------------------------------

Please visit this webpage for download links, and instructions for running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

* Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix.

Get help here

Please post the C:\ComboFix.txt in your next reply for further review.

------------------------------------------------------

**chemist** · 06-06-2009, 10:57 PM

Due to lack of response, this topic will now be closed. If you need continued support, please begin a new thread, and provide a link to this topic. This applies only to the original topic starter. Everyone else please begin a New Topic, after following the steps outlined here:

IMPORTANT - Read This Before Posting For Malware Removal Help

------------------------------------------------------

dispixie3 · 06-07-2009, 09:52 PM

I got tossed out, sorry. I've tried to post a link below, I hope it works.

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/hijackthis-log-help-inactive/382095-need-help-some-various-problems.html

**chemist** · 06-08-2009, 04:22 AM

Hello dispixie3. Did you carry out the instructions in post #2 above? Please post the log.

dispixie3 · 06-08-2009, 09:09 AM

Combo fix:

ComboFix 09-06-07.07 - Mark Moore 01/07/2002 22:34.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1006.592 [GMT -5:00]
Running from: c:\documents and settings\Mark Moore\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((( Files Created from 2001-12-08 to 2002-01-08 )))))))))))))))))))))))))))))))
.

2009-05-12 01:39 . 2009-05-12 01:39 390664 ----a-w- c:\documents and settings\Mark Moore\Application Data\Real\RealPlayer\Update\RealPlayer11.exe
2009-04-19 22:43 . 2009-04-19 22:44 -------- d-----w- c:\program files\iTunes
2009-04-19 22:43 . 2009-04-19 22:44 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-19 22:36 . 2009-04-19 22:36 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-04-15 11:05 . 2009-03-06 14:22 284160 ------w- c:\windows\system32\dllcache\pdh.dll
2009-04-15 11:05 . 2009-02-06 10:39 35328 ------w- c:\windows\system32\dllcache\sc.exe
2009-04-15 11:05 . 2009-02-09 12:10 401408 ------w- c:\windows\system32\dllcache\rpcss.dll
2009-04-15 11:05 . 2009-02-06 11:11 110592 ------w- c:\windows\system32\dllcache\services.exe
2009-04-15 11:05 . 2009-02-09 12:10 473600 ------w- c:\windows\system32\dllcache\fastprox.dll
2009-04-15 11:05 . 2009-02-06 10:10 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 11:05 . 2009-02-09 12:10 453120 ------w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 11:05 . 2009-02-09 12:10 729088 ------w- c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 11:05 . 2009-02-09 12:10 617472 ------w- c:\windows\system32\dllcache\advapi32.dll
2009-04-15 11:05 . 2009-02-09 12:10 714752 ------w- c:\windows\system32\dllcache\ntdll.dll
2009-04-15 11:03 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll
2009-04-15 11:03 . 2008-04-21 12:08 215552 ------w- c:\windows\system32\dllcache\wordpad.exe
2009-04-15 04:12 . 2009-04-15 04:12 -------- d-----w- c:\program files\TweetDeck
2009-04-10 00:32 . 2009-04-10 00:32 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\SACore
2009-04-08 04:33 . 2009-04-08 04:33 292878 ----a-r- c:\documents and settings\Mark Moore\Application Data\Microsoft\Installer\{A212E6C2-20F7-4A8E-BD8E-DC3EE7483FA2}\ARPPRODUCTICON.exe
2009-04-08 04:33 . 2009-04-08 04:33 -------- d-----w- c:\program files\Common Files\Sony Shared
2009-04-04 22:30 . 2009-04-04 22:30 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-04-04 22:26 . 2002-01-04 12:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-04-01 14:32 . 2009-04-01 14:32 152576 ----a-w- c:\documents and settings\Mark Moore\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-21 14:06 . 2009-03-21 14:06 989696 ------w- c:\windows\system32\dllcache\kernel32.dll
2009-03-19 20:32 . 2009-03-19 20:32 23400 ----a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-13 13:07 . 2009-03-13 13:08 -------- d-----w- c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-13 13:02 . 2009-03-06 03:59 1900544 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-03-13 12:55 . 2009-03-13 12:56 -------- d-----w- c:\program files\Safari
2009-02-22 15:35 . 2009-02-22 15:35 -------- d-----w- c:\documents and settings\Mark Moore\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
2009-02-22 15:34 . 2009-04-04 21:47 38208 ----a-w- c:\documents and settings\Mark Moore\Application Data\Macromedia\Flash Player\http://www.macromedia.com\bin\airapp...pinstaller.exe
2009-02-22 15:34 . 2009-04-04 21:48 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-02-20 18:09 . 2009-02-20 18:09 78336 ------w- c:\windows\system32\dllcache\ieencode.dll
2009-02-06 16:23 . 2009-04-24 04:53 -------- d-----w- c:\program files\QuickTime
2009-02-06 16:18 . 2009-02-06 16:18 -------- d-----w- c:\program files\Sun
2009-02-04 17:56 . 2009-02-04 17:56 75112 ----a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\DifXInstall32.exe
2009-02-03 19:59 . 2009-02-03 19:59 56832 ------w- c:\windows\system32\dllcache\secur32.dll
2009-01-07 01:00 . 2009-01-07 01:00 -------- d-----w- c:\program files\Bonjour
2008-12-16 12:30 . 2008-12-16 12:30 354304 ------w- c:\windows\system32\dllcache\winhttp.dll
2008-12-12 16:18 . 2008-12-12 16:18 87336 ----a-w- c:\windows\system32\dns-sd.exe
2008-12-12 16:11 . 2008-12-12 16:11 61440 ----a-w- c:\windows\system32\dnssd.dll
2008-12-05 06:54 . 2008-12-05 06:54 144896 ------w- c:\windows\system32\dllcache\schannel.dll
2008-12-03 18:51 . 2009-02-06 16:15 152576 ----a-w- c:\documents and settings\Mark Moore\Application Data\Sun\Java\jre1.6.0_11\lzma.dll
2008-11-14 17:19 . 2009-03-09 09:19 410984 ----a-w- c:\windows\system32\deploytk.dll
2008-11-14 17:17 . 2008-11-14 17:17 152576 ----a-w- c:\documents and settings\Mark Moore\Application Data\Sun\Java\jre1.6.0_10\lzma.dll
2008-11-12 14:36 . 2008-10-24 11:21 455296 ------w- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-12 14:35 . 2008-09-04 17:15 1106944 ------w- c:\windows\system32\dllcache\msxml3.dll
2008-11-09 14:04 . 2008-11-09 14:04 -------- d-----w- c:\program files\PhotoViewer
2008-11-03 00:36 . 2008-11-03 00:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Marlin
2008-11-02 20:43 . 2009-04-08 04:33 -------- d-----w- c:\program files\Sony
2008-11-02 20:40 . 2008-11-02 20:40 -------- d-----w- c:\documents and settings\Mark Moore\Local Settings\Application Data\Sony Corporation
2008-11-02 20:40 . 2008-11-02 20:40 -------- d-----w- c:\documents and settings\Mark Moore\Local Settings\Application Data\kinoma
2008-11-02 20:40 . 2008-11-02 20:40 -------- d-----w- c:\documents and settings\All Users\Application Data\kinoma
2008-11-02 20:40 . 2008-11-02 20:40 -------- d-----w- c:\program files\DIFX
2008-11-01 22:58 . 2008-12-11 10:57 333952 ------w- c:\windows\system32\dllcache\srv.sys
2008-11-01 22:57 . 2009-02-09 11:13 1846784 ------w- c:\windows\system32\dllcache\win32k.sys
2008-11-01 22:57 . 2009-02-06 11:06 2145280 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-11-01 22:57 . 2009-02-06 11:08 2189056 ------w- c:\windows\system32\dllcache\ntoskrnl.exe
2008-11-01 22:57 . 2009-02-06 10:32 2023936 ------w- c:\windows\system32\dllcache\ntkrpamp.exe
2008-11-01 22:57 . 2009-02-07 23:02 2066048 ------w- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-11-01 22:57 . 2008-10-15 16:34 337408 ------w- c:\windows\system32\dllcache\netapi32.dll
2008-10-23 12:36 . 2008-10-23 12:36 286720 ------w- c:\windows\system32\dllcache\gdi32.dll
2008-09-30 21:43 . 2008-09-30 21:43 1286152 ----a-w- c:\windows\system32\msxml4.dll
2008-09-20 02:45 . 2008-09-20 02:45 -------- d-----w- c:\documents and settings\Mark Moore\Application Data\Motive
2008-09-20 02:45 . 2008-09-20 02:45 -------- d-----w- c:\documents and settings\All Users\Application Data\SiteAdvisor
2008-09-19 17:52 . 2008-09-19 17:52 -------- d-----w- c:\documents and settings\LocalService\Application Data\SiteAdvisor
2008-09-19 03:07 . 2008-09-19 03:07 -------- d-----w- c:\documents and settings\Mark Moore\Local Settings\Application Data\Citrix
2008-09-19 03:07 . 2008-09-19 03:07 61224 ----a-w- c:\documents and settings\Mark Moore\GoToAssistDownloadHelper.exe
2008-09-19 02:36 . 2008-09-19 02:36 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore
2008-09-18 20:49 . 2008-11-14 22:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive
2008-09-18 20:49 . 2008-09-18 20:49 -------- d-----w- c:\program files\Common Files\Motive
2008-09-18 20:49 . 2008-09-24 14:00 -------- d-----w- c:\program files\Verizon
2008-09-17 04:54 . 2008-09-17 05:09 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2008-09-17 04:54 . 2008-09-17 04:54 -------- d-----w- c:\program files\NOS
2008-09-11 03:23 . 2008-09-11 03:23 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2008-09-11 03:22 . 2008-09-11 03:22 -------- d-----w- c:\documents and settings\Mark Moore\Local Settings\Application Data\Downloaded Installations
2008-09-10 23:45 . 2008-07-31 14:41 68616 ----a-w- c:\windows\system32\XAPOFX1_1.dll
2008-09-10 23:45 . 2008-07-31 14:40 509448 ----a-w- c:\windows\system32\XAudio2_2.dll
2008-09-10 23:45 . 2008-07-31 14:41 238088 ----a-w- c:\windows\system32\xactengine3_2.dll
2008-09-10 23:45 . 2008-07-12 12:18 467984 ----a-w- c:\windows\system32\d3dx10_39.dll
2008-09-10 23:45 . 2008-07-12 12:18 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll
2008-09-10 23:45 . 2008-07-12 12:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll
2008-09-10 23:35 . 2008-09-10 23:43 -------- d--h--w- c:\windows\msdownld.tmp
2008-09-10 23:35 . 2008-09-10 23:35 -------- d-----w- c:\windows\Logs
2008-09-10 15:22 . 2008-09-10 15:22 -------- d-----w- c:\program files\Three Rings Design
2008-09-10 14:02 . 2002-01-03 13:37 -------- d-----w- c:\program files\SpywareBlaster
2008-09-10 01:47 . 2008-09-10 01:47 -------- d-----w- c:\documents and settings\Mark Moore\Local Settings\Application Data\Mozilla
2008-09-09 05:24 . 2008-09-09 05:24 -------- d-----w- c:\windows\system32\scripting
2008-09-09 05:24 . 2008-09-09 05:24 -------- d-----w- c:\windows\l2schemas
2008-09-09 05:24 . 2008-09-09 05:24 -------- d-----w- c:\windows\system32\en
2008-09-09 02:53 . 2008-06-19 21:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
2008-09-09 02:53 . 2008-09-09 02:53 -------- d-----w- c:\program files\Panda Security
2008-09-09 00:02 . 2008-04-14 00:12 152064 ------w- c:\windows\system32\dllcache\shmedia.dll
2008-09-09 00:01 . 2008-04-14 00:12 259072 ------w- c:\windows\system32\dllcache\msnetobj.dll
2008-09-09 00:00 . 2008-04-13 16:36 144384 ------w- c:\windows\system32\drivers\hdaudbus.sys
2008-09-08 18:31 . 2006-11-01 16:48 33664 ----a-w- c:\windows\system32\drivers\BCMWLNPF.SYS
2008-09-08 18:31 . 2006-11-01 16:48 86016 ----a-w- c:\windows\system32\preflib.dll
2008-09-08 18:31 . 2006-11-01 16:48 44032 ----a-w- c:\windows\system32\wltrynt.dll
2008-09-08 18:31 . 2006-11-01 16:48 69632 ----a-w- c:\windows\system32\bcmwlpkt.dll
2008-09-08 18:31 . 2006-11-01 16:48 1392640 ----a-w- c:\windows\system32\WLTRAY.EXE
2008-09-08 18:31 . 2006-11-01 16:48 2129920 ----a-w- c:\windows\system32\WLBCGCBPRO731.DLL
2008-09-08 18:31 . 2006-11-01 16:48 757760 ----a-w- c:\windows\system32\bcm1xsup.dll
2008-09-08 17:51 . 2008-04-11 19:04 691712 ------w- c:\windows\system32\dllcache\inetcomm.dll
2008-09-05 13:40 . 2008-05-01 14:33 331776 ------w- c:\windows\system32\dllcache\msadce.dll
2008-07-07 20:26 . 2008-07-07 20:26 253952 ------w- c:\windows\system32\dllcache\es.dll
2008-06-24 16:43 . 2008-06-24 16:43 74240 ------w- c:\windows\system32\dllcache\mscms.dll
2008-06-20 17:46 . 2008-06-20 17:46 245248 ------w- c:\windows\system32\dllcache\mswsock.dll
2008-06-20 17:46 . 2008-06-20 17:46 147968 ------w- c:\windows\system32\dllcache\dnsapi.dll
2008-06-20 11:51 . 2008-06-20 11:51 361600 ------w- c:\windows\system32\dllcache\tcpip.sys
2008-06-20 11:40 . 2008-08-14 10:04 138496 ------w- c:\windows\system32\dllcache\afd.sys
2008-06-20 11:08 . 2008-06-20 11:08 225856 ------w- c:\windows\system32\dllcache\tcpip6.sys
2008-06-17 19:02 . 2008-06-17 19:02 8461312 ------w- c:\windows\system32\dllcache\shell32.dll
2008-06-12 14:23 . 2008-06-12 14:23 956928 ------w- c:\windows\system32\dllcache\msdtctm.dll
2008-06-12 14:23 . 2008-06-12 14:23 91648 ------w- c:\windows\system32\dllcache\mtxoci.dll
2008-06-12 14:23 . 2008-06-12 14:23 66560 ------w- c:\windows\system32\dllcache\mtxclu.dll
2008-06-12 14:23 . 2008-06-12 14:23 58880 ------w- c:\windows\system32\dllcache\msdtclog.dll
2008-06-12 14:23 . 2008-06-12 14:23 428032 ------w- c:\windows\system32\dllcache\msdtcprx.dll
2008-06-12 14:23 . 2008-06-12 14:23 161792 ------w- c:\windows\system32\dllcache\msdtcuiu.dll
2008-06-10 21:19 . 2008-05-08 14:02 203136 ------w- c:\windows\system32\dllcache\rmcast.sys
2008-06-10 21:19 . 2008-06-13 11:05 272128 ------w- c:\windows\system32\dllcache\bthport.sys
2008-05-09 10:53 . 2008-05-09 10:53 90112 ------w- c:\windows\system32\dllcache\wshext.dll
2008-05-09 10:53 . 2008-05-09 10:53 430080 ------w- c:\windows\system32\dllcache\vbscript.dll
2008-05-09 10:53 . 2008-05-09 10:53 172032 ------w- c:\windows\system32\dllcache\scrrun.dll
2008-05-09 10:53 . 2008-05-09 10:53 512000 ------w- c:\windows\system32\dllcache\jscript.dll
2008-05-09 10:53 . 2008-05-09 10:53 180224 ------w- c:\windows\system32\dllcache\scrobj.dll
2008-05-08 11:24 . 2008-05-08 11:24 155648 ------w- c:\windows\system32\dllcache\wscript.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-10 00:29 . 2004-09-28 15:59 65336 ----a-w- c:\documents and settings\Mark Moore\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-01 14:34 . 2004-09-22 04:37 -------- d-----w- c:\program files\Java
2009-03-06 14:22 . 2002-08-29 10:00 284160 ----a-w- c:\windows\system32\pdh.dll
2009-02-20 18:09 . 2004-11-28 14:29 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2004-03-30 01:48 729088 ----a-w- c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2002-08-29 10:00 714752 ----a-w- c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2002-08-29 10:00 617472 ----a-w- c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2002-08-29 10:00 473600 ----a-w- c:\windows\system32\wbem\fastprox.dll
2009-02-09 12:10 . 2002-08-29 10:00 453120 ----a-w- c:\windows\system32\wbem\wmiprvsd.dll
2009-02-09 11:13 . 2002-08-29 10:00 1846784 ----a-w- c:\windows\system32\win32k.sys
2009-02-07 23:02 . 2002-08-29 10:00 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-02-06 11:11 . 2002-08-29 10:00 110592 ----a-w- c:\windows\system32\services.exe
2009-02-06 11:08 . 2002-08-29 10:00 2189056 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2002-08-29 10:00 35328 ----a-w- c:\windows\system32\sc.exe
2009-02-06 10:10 . 2002-08-29 10:00 227840 ----a-w- c:\windows\system32\wbem\wmiprvse.exe
2009-02-03 19:59 . 2002-08-29 10:00 56832 ----a-w- c:\windows\system32\secur32.dll
2008-12-11 10:57 . 2002-08-29 10:00 333952 ----a-w- c:\windows\system32\drivers\srv.sys
2008-12-05 06:54 . 2004-03-30 01:48 144896 ----a-w- c:\windows\system32\schannel.dll
2008-10-24 11:21 . 2002-08-29 10:00 455296 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:36 . 2004-03-30 01:48 286720 ----a-w- c:\windows\system32\gdi32.dll
2008-10-16 19:13 . 2002-08-29 10:00 1809944 ----a-w- c:\windows\system32\wuaueng.dll
2008-10-16 19:09 . 2002-08-29 10:00 92696 ----a-w- c:\windows\system32\cdm.dll
2008-10-16 19:09 . 2002-08-29 10:00 51224 ----a-w- c:\windows\system32\wuauclt.exe
2008-10-03 10:02 . 2002-08-29 10:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2008-09-11 17:13 . 2004-09-22 04:43 -------- d--h--w- c:\program files\InstallShield Installation Information
2008-09-10 01:14 . 2008-09-09 00:02 1307648 ----a-w- c:\windows\system32\msxml6.dll
2008-09-09 05:29 . 2002-09-03 13:58 79063 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2008-09-08 18:30 . 2004-09-22 04:38 -------- d-----w- c:\program files\Dell
2008-09-04 17:15 . 2005-01-11 02:37 1106944 ----a-w- c:\windows\system32\msxml3.dll
2008-08-14 10:04 . 2002-08-29 10:00 138496 ----a-w- c:\windows\system32\drivers\afd.sys
2008-06-20 17:46 . 2002-08-29 10:00 245248 ----a-w- c:\windows\system32\mswsock.dll
2008-06-20 11:51 . 2002-08-29 10:00 361600 ----a-w- c:\windows\system32\drivers\tcpip.sys
2008-06-20 11:08 . 2002-08-29 10:00 225856 ----a-w- c:\windows\system32\drivers\tcpip6.sys
2008-06-13 11:05 . 2004-11-28 14:28 272128 ------w- c:\windows\system32\drivers\bthport.sys
2008-06-12 14:23 . 2004-03-06 02:16 956928 ----a-w- c:\windows\system32\msdtctm.dll
2008-06-12 14:23 . 2004-03-06 02:16 428032 ----a-w- c:\windows\system32\msdtcprx.dll
2008-06-12 14:23 . 2004-03-06 02:16 161792 ----a-w- c:\windows\system32\msdtcuiu.dll
2008-06-12 14:23 . 2002-08-29 10:00 58880 ----a-w- c:\windows\system32\msdtclog.dll
2008-06-10 11:11 . 2004-09-22 04:56 1053696 ----a-w- c:\windows\system32\WMNetmgr.dll
2008-06-10 08:11 . 2004-09-22 04:56 103936 ----a-w- c:\windows\system32\logagent.exe
2008-05-30 18:19 . 2008-09-10 23:44 507400 ----a-w- c:\windows\system32\XAudio2_1.dll
2008-05-30 18:18 . 2008-09-10 23:44 238088 ----a-w- c:\windows\system32\xactengine3_1.dll
2008-05-30 18:17 . 2008-09-10 23:44 65032 ----a-w- c:\windows\system32\XAPOFX1_0.dll
2008-05-30 18:17 . 2008-09-10 23:44 25608 ----a-w- c:\windows\system32\X3DAudio1_4.dll
2008-05-30 18:11 . 2008-09-10 23:44 467984 ----a-w- c:\windows\system32\d3dx10_38.dll
2008-05-30 18:11 . 2008-09-10 23:44 1491992 ----a-w- c:\windows\system32\D3DCompiler_38.dll
2008-05-30 18:11 . 2008-09-10 23:44 3850760 ----a-w- c:\windows\system32\D3DX9_38.dll
2008-05-09 10:53 . 2002-08-29 10:00 90112 ----a-w- c:\windows\system32\wshext.dll
2008-05-09 10:53 . 2002-08-29 10:00 430080 ----a-w- c:\windows\system32\vbscript.dll
2008-05-09 10:53 . 2002-08-29 10:00 172032 ----a-w- c:\windows\system32\scrrun.dll
2008-05-09 10:53 . 2002-08-29 10:00 180224 ----a-w- c:\windows\system32\scrobj.dll
2008-05-08 14:02 . 2002-08-29 10:00 203136 ----a-w- c:\windows\system32\drivers\rmcast.sys
2008-05-08 11:24 . 2002-08-29 10:00 155648 ----a-w- c:\windows\system32\wscript.exe
2008-05-07 09:07 . 2002-08-29 10:00 135168 ----a-w- c:\windows\system32\cscript.exe
2008-04-14 09:42 . 2004-11-28 14:30 11264 ------w- c:\windows\system32\spnpinst.exe
2008-04-14 09:42 . 2002-08-29 10:00 985088 ----a-w- c:\windows\system32\setupapi.dll
2008-04-14 09:41 . 2002-08-29 10:00 423936 ----a-w- c:\windows\system32\licdll.dll
2008-04-14 00:25 . 2002-08-29 10:00 1804 ----a-w- c:\windows\system32\dcache.bin
2008-04-14 00:16 . 2002-08-29 10:00 329728 ----a-w- c:\windows\system32\netsetup.exe
2008-04-14 00:13 . 2002-08-29 10:00 92424 ----a-w- c:\windows\system32\rdpdd.dll
2008-04-14 00:13 . 2002-08-29 10:00 87176 ----a-w- c:\windows\system32\rdpwsx.dll
2008-04-14 00:13 . 2002-08-29 10:00 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2008-04-14 00:13 . 2002-08-29 10:00 21896 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2008-04-14 00:13 . 2002-08-29 10:00 12168 ----a-w- c:\windows\system32\tsddd.dll
2008-04-14 00:13 . 2002-08-29 10:00 12040 ----a-w- c:\windows\system32\drivers\tdpipe.sys
2008-04-14 00:13 . 2002-08-29 08:46 40840 ----a-w- c:\windows\system32\drivers\termdd.sys
2008-04-14 00:13 . 2004-09-22 04:56 299520 ----a-w- c:\windows\system32\drmclien.dll
2008-04-14 00:11 . 2005-01-11 02:37 151552 ----a-w- c:\windows\system32\msdart.dll
2008-04-14 00:10 . 2002-08-29 10:00 53279 ----a-w- c:\windows\system32\odbcji32.dll
2008-04-14 00:10 . 2002-08-29 10:00 4126 ----a-w- c:\windows\system32\msdxmlc.dll
2008-04-14 00:10 . 2002-08-29 10:00 3584 ----a-w- c:\windows\system32\msafd.dll
2008-04-13 21:00 . 2002-08-29 10:00 103424 ----a-w- c:\windows\system32\dpcdll.dll
2008-04-13 19:28 . 2002-08-29 10:00 175744 ----a-w- c:\windows\system32\drivers\rdbss.sys
2008-04-13 19:21 . 2002-08-29 10:00 162816 ----a-w- c:\windows\system32\drivers\netbt.sys
2008-04-13 19:20 . 2002-08-29 10:00 91520 ----a-w- c:\windows\system32\drivers\ndiswan.sys
2008-04-13 19:20 . 2002-08-29 10:00 182656 ----a-w- c:\windows\system32\drivers\ndis.sys
2008-04-13 19:19 . 2002-08-29 10:00 48384 ----a-w- c:\windows\system32\drivers\raspptp.sys
2008-04-13 19:19 . 2002-08-29 10:00 51328 ----a-w- c:\windows\system32\drivers\rasl2tp.sys
2008-04-13 19:19 . 2002-08-29 10:00 75264 ----a-w- c:\windows\system32\drivers\ipsec.sys
2008-04-13 19:19 . 2004-09-22 04:19 146048 ----a-w- c:\windows\system32\drivers\portcls.sys
2008-04-13 19:18 . 2002-08-29 10:00 52480 ----a-w- c:\windows\system32\drivers\i8042prt.sys
2008-04-13 19:17 . 2004-09-22 04:20 83072 ----a-w- c:\windows\system32\drivers\wdmaud.sys
2008-04-13 19:17 . 2002-08-29 10:00 105344 ----a-w- c:\windows\system32\drivers\mup.sys
2008-04-13 19:16 . 2002-12-12 05:14 141056 ----a-w- c:\windows\system32\drivers\ks.sys
2008-04-13 19:16 . 2002-08-29 10:00 49536 ----a-w- c:\windows\system32\drivers\classpnp.sys
2008-04-13 19:15 . 2004-09-22 04:20 60800 ----a-w- c:\windows\system32\drivers\sysaudio.sys
2008-04-13 19:15 . 2002-08-29 10:00 574976 ----a-w- c:\windows\system32\drivers\ntfs.sys
2008-04-13 19:15 . 2002-08-29 10:00 64512 ----a-w- c:\windows\system32\drivers\serial.sys
2008-04-13 19:14 . 2002-08-29 10:00 143744 ----a-w- c:\windows\system32\drivers\fastfat.sys
2008-04-13 19:14 . 2002-08-29 10:00 63744 ----a-w- c:\windows\system32\drivers\cdfs.sys
2008-04-13 19:00 . 2002-08-29 10:00 30080 ----a-w- c:\windows\system32\drivers\modem.sys
2008-04-13 19:00 . 2002-08-29 10:00 19072 ----a-w- c:\windows\system32\drivers\tdi.sys
2008-04-13 18:57 . 2002-08-29 10:00 41472 ----a-w- c:\windows\system32\drivers\raspppoe.sys
2008-04-13 18:57 . 2002-08-29 10:00 40576 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2008-04-13 18:57 . 2002-08-29 10:00 14336 ----a-w- c:\windows\system32\drivers\asyncmac.sys
2008-04-13 18:57 . 2002-08-29 10:00 10112 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2008-04-13 18:57 . 2002-08-29 10:00 34560 ----a-w- c:\windows\system32\drivers\wanarp.sys
2008-04-13 18:57 . 2002-08-29 10:00 152832 ----a-w- c:\windows\system32\drivers\ipnat.sys
2008-04-13 18:57 . 2002-08-29 10:00 20864 ----a-w- c:\windows\system32\drivers\ipinip.sys
2008-04-13 18:56 . 2004-11-28 14:31 12800 ------w- c:\windows\system32\drivers\usb8023x.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 200704]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"PhotoShow Deluxe Media Manager"="c:\progra~1\SIMPLE~1\PHOTOS~1\data\xtras\mssysmgr.exe" [2005-02-01 163840]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-04 39408]
"Intelinet"="c:\program files\Intelinet\Intelinet.exe" [2009-04-28 7480600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-13 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-14 536576]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-03-15 122933]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
"mmtask"="c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2004-04-19 53248]
"MMTray"="c:\program files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe" [2004-04-19 131072]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-08 185896]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-01 1392640]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-03-11 936960]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-06 177472]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Adobe Acrobat 6.0 CE\Distillr\acrotray.exe [2003-7-17 217180]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-13 110592]
DataViz Inc Messenger.lnk - c:\program files\Common Files\DataViz\DvzIncMsgr.exe [2006-5-31 28672]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2004-9-21 24576]
HotSync Manager.lnk - c:\program files\palmOne\Hotsync.exe [2004-6-9 471040]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-28 53248]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-12 83360]
NkvMon.exe.lnk - c:\program files\Nikon\NkView6\NkvMon.exe [2004-11-3 241664]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\EXPOCAD\\Program\\Cadvance.exe"=
"c:\\WINDOWS\\SYSTEM32\\spoolsv.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 pavboot;pavboot;c:\windows\SYSTEM32\DRIVERS\pavboot.sys [9/8/2008 9:53 PM 28544]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [9/18/2008 9:30 PM 210216]
S2 gupdate1c9b574f47a2d4c;Google Update Service (gupdate1c9b574f47a2d4c);c:\program files\Google\Update\GoogleUpdate.exe [4/4/2009 5:30 PM 133104]
S3 ACGPRS;Sierra Wireless 3G Adapter;c:\windows\SYSTEM32\DRIVERS\acgprs.sys [9/19/2005 4:17 PM 88192]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [9/16/2008 11:54 PM 33752]
S3 Nikon1394;Nikon1394Driver;c:\windows\SYSTEM32\DRIVERS\NikonDx.sys [7/4/2006 9:26 AM 106172]
S3 SDTHOOK;SDTHOOK;c:\windows\SYSTEM32\DRIVERS\SDTHOOK.SYS [3/13/2008 10:32 AM 44928]
S3 SQTECH907B;EZCam(PID_907B_00);c:\windows\SYSTEM32\DRIVERS\Capt907B.sys [1/27/2007 6:37 PM 61643]
.
Contents of the 'Scheduled Tasks' folder

2009-04-21 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2002-01-08 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-10-28 22:26]

2002-01-08 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-04 22:29]

2009-04-15 c:\windows\Tasks\McDefragTask.job
- c:\windows\system32\defrag.exe [2002-08-29 00:12]

2008-07-01 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2006-10-14 15:53]
.
- - - - ORPHANS REMOVED - - - -

SSODL-VolumeComponent-{b1aed209-5cf2-4013-9235-999f7ff1ae4a} - (no file)
SafeBoot-procexp90.Sys

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = <local>;*.local
IE: RemindU. - file://c:\program files\Upromise_Remind_U\UpromisesRemindU\UpromisetRemindU\uproC0.htm
LSP: bmnet.dll
FF - ProfilePath - c:\documents and settings\Mark Moore\Application Data\Mozilla\Firefox\Profiles\0xs7t934.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2002-01-07 22:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(816)
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'lsass.exe'(872)
c:\windows\system32\bmnet.dll

- - - - - - - > 'explorer.exe'(2940)
c:\windows\system32\SynTPFcs.dll
c:\program files\McAfee\SiteAdvisor\saHook.dll
.
Completion time: 2002-01-08 22:48
ComboFix-quarantined-files.txt 2002-01-08 03:47
ComboFix2.txt 2008-04-06 06:36
ComboFix3.txt 2008-04-06 03:54

Pre-Run: 22,578,216,960 bytes free
Post-Run: 23,027,326,976 bytes free

369 --- E O F --- 2009-05-13 21:16

**chemist** · 06-08-2009, 11:25 AM

Hello Kimberly. Please tell us why your date/time is set to over 7 years behind:

Quote:

ComboFix 09-06-07.07 - Mark Moore 01/07/2002 22:34.4 - NTFSx86

dispixie3 · 06-09-2009, 09:49 AM

ooooookaaaaaaay, I really do not know!!!!

I just went in and changed it!

Is that the root of my problem? I know some updates just popped up, so I'll do those.

**chemist** · 06-09-2009, 10:43 AM

Hello again, Kimberly.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists:

Intelinet 3.1.0<<Please read this

If it fails to uninstall, just continue.

------------------------------------------------------

Close any open browsers.

Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix.

Open Notepad and copy/paste all the text in the codebox below into Notepad:

Code:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/382095-need-help-some-various-problems.html#post2178723

Collect::
c:\program files\Intelinet\Intelinet.exe

Folder::
c:\program files\Intelinet

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000000
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\SYSTEM32\\spoolsv.exe"=-

Save this Notepad file as CFScript.txt to your Desktop and then close the file.

Referring to the picture above, drag CFScript onto ComboFix

If you are prompted to update ComboFix and have an internet connection, please choose Yes

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply.

------------------------------------------------------

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

If you do not get a message box, please do the following:

There should be a file named [4]-Submit_date@time.zip with today's date, located here:

C:\QooBox\Quarantine\[4]-Submit_date@time.zip

Using the 'Browse' button, please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4

Please let me know if you successfully submitted the file. Thanks.

------------------------------------------------------

dispixie3 · 06-09-2009, 11:55 PM

Hello!

Here is the Combofix log. I could not find the file I was supposed to send to Bleeping Computer. Sorry!

Thank You,
Kimberly

ComboFix 09-06-09.06 - Mark Moore 06/10/2009 1:21.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1006.449 [GMT -4:00]
Running from: c:\documents and settings\Mark Moore\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Mark Moore\Desktop\cfscript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Intelinet
c:\program files\Intelinet\Logs\2002_01_01.log
c:\program files\Intelinet\Logs\2002_01_02.log
c:\program files\Intelinet\Logs\2002_01_03.log
c:\program files\Intelinet\Logs\2002_01_04.log
c:\program files\Intelinet\Logs\2002_01_05.log
c:\program files\Intelinet\Logs\2002_01_06.log
c:\program files\Intelinet\Logs\2002_01_07.log
c:\program files\Intelinet\Logs\2002_01_08.log
c:\program files\Intelinet\Logs\2009_06_09.log

.
((((((((((((((((((((((((( Files Created from 2009-05-10 to 2009-06-10 )))))))))))))))))))))))))))))))
.

2009-06-10 03:52 . 2009-06-10 03:52 152576 ----a-w- c:\documents and settings\Mark Moore\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-10 03:42 . 2009-06-10 03:42 -------- d-sh--w- c:\documents and settings\Mark Moore\IETldCache
2009-06-10 03:33 . 2009-04-30 21:22 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
2009-06-10 03:33 . 2009-04-30 21:22 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-10 03:33 . 2009-06-10 03:33 -------- d-----w- c:\windows\ie8updates
2009-06-10 03:31 . 2009-05-12 05:11 102912 ------w- c:\windows\system32\dllcache\iecompat.dll
2009-06-10 03:26 . 2009-06-10 03:28 -------- dc-h--w- c:\windows\ie8
2009-05-12 01:39 . 2009-05-12 01:39 390664 ----a-w- c:\documents and settings\Mark Moore\Application Data\Real\RealPlayer\Update\RealPlayer11.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-10 03:53 . 2004-09-22 04:37 -------- d-----w- c:\program files\Java
2009-06-10 03:42 . 2009-04-04 22:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-05-21 15:33 . 2008-11-14 17:19 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-13 05:15 . 2005-10-21 17:51 915456 ----a-w- c:\windows\system32\wininet.dll
2009-04-24 04:53 . 2009-02-06 16:23 -------- d-----w- c:\program files\QuickTime
2009-04-19 22:44 . 2009-04-19 22:43 -------- d-----w- c:\program files\iTunes
2009-04-19 22:44 . 2009-04-19 22:43 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-19 22:43 . 2004-11-02 21:33 -------- d-----w- c:\program files\iPod
2009-04-19 22:43 . 2007-07-03 17:15 -------- d-----w- c:\program files\Common Files\Apple
2009-04-19 22:36 . 2009-04-19 22:36 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe
2009-04-18 03:51 . 2006-10-14 21:35 -------- d-----w- c:\program files\McAfee
2009-04-15 04:12 . 2009-04-15 04:12 -------- d-----w- c:\program files\TweetDeck
2009-04-10 00:29 . 2004-09-28 15:59 65336 ----a-w- c:\documents and settings\Mark Moore\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-08 04:33 . 2009-04-08 04:33 292878 ----a-r- c:\documents and settings\Mark Moore\Application Data\Microsoft\Installer\{A212E6C2-20F7-4A8E-BD8E-DC3EE7483FA2}\ARPPRODUCTICON.exe
2009-04-04 21:47 . 2009-02-22 15:34 38208 ----a-w- c:\documents and settings\Mark Moore\Application Data\Macromedia\Flash Player\http://www.macromedia.com\bin\airapp...pinstaller.exe
2009-04-01 14:32 . 2009-04-01 14:32 152576 ----a-w- c:\documents and settings\Mark Moore\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-03-25 15:06 . 2006-10-14 21:36 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-03-25 15:06 . 2006-10-14 21:36 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-03-25 15:06 . 2006-10-14 21:36 214024 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-03-25 15:06 . 2006-10-14 21:36 79880 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-03-25 15:05 . 2006-10-14 21:36 34216 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-03-19 20:32 . 2009-03-19 20:32 23400 ----a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys
2009-03-19 20:32 . 2008-01-29 16:01 23400 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2002-05-28 17:21 . 2004-12-09 03:02 556034 ----a-r- c:\program files\DATA1.CAB
2006-10-31 16:37 . 2006-10-31 16:37 1056 --sha-w- c:\windows\SYSTEM32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2002-01-08_03.43.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-10 03:54 . 2009-06-10 03:54 16384 c:\windows\Temp\Perflib_Perfdata_9cc.dat
+ 2005-08-25 03:44 . 2009-01-07 22:21 26144 c:\windows\SYSTEM32\spupdsvc.exe
+ 2004-09-22 04:28 . 2009-01-07 22:20 16928 c:\windows\SYSTEM32\spmsg.dll
+ 2002-08-29 10:00 . 2009-03-08 08:31 46592 c:\windows\SYSTEM32\pngfilt.dll
+ 2004-09-22 04:21 . 2009-06-10 03:47 99392 c:\windows\SYSTEM32\PERFC009.DAT
+ 2006-06-29 12:05 . 2009-01-07 22:20 23552 c:\windows\SYSTEM32\normaliz.dll
- 2006-06-29 12:05 . 2006-06-29 12:05 23552 c:\windows\SYSTEM32\normaliz.dll
- 2006-06-28 21:59 . 2006-06-28 21:59 24576 c:\windows\SYSTEM32\nlsdl.dll
+ 2006-06-28 21:59 . 2009-01-07 22:20 24576 c:\windows\SYSTEM32\nlsdl.dll
- 2002-08-29 10:00 . 2007-08-13 22:01 48128 c:\windows\SYSTEM32\mshtmler.dll
+ 2002-08-29 10:00 . 2009-03-08 08:31 48128 c:\windows\SYSTEM32\mshtmler.dll
+ 2002-08-29 10:00 . 2009-03-08 08:31 66560 c:\windows\SYSTEM32\mshtmled.dll
- 2002-08-29 10:00 . 2007-08-13 22:32 45568 c:\windows\SYSTEM32\mshta.exe
+ 2002-08-29 10:00 . 2009-03-08 08:31 45568 c:\windows\SYSTEM32\mshta.exe
+ 2007-08-13 22:36 . 2009-03-08 08:31 13312 c:\windows\SYSTEM32\msfeedssync.exe
+ 2007-08-13 22:54 . 2009-03-08 08:31 55296 c:\windows\SYSTEM32\msfeedsbs.dll
+ 2002-08-29 10:00 . 2009-03-08 08:34 43008 c:\windows\SYSTEM32\licmgr10.dll
+ 2002-08-29 10:00 . 2009-04-30 21:22 25600 c:\windows\SYSTEM32\jsproxy.dll
+ 2004-08-26 14:53 . 2009-03-08 08:32 94720 c:\windows\SYSTEM32\inseng.dll
+ 2002-08-29 10:00 . 2009-03-08 08:31 34816 c:\windows\SYSTEM32\imgutil.dll
+ 2007-08-13 22:39 . 2009-03-08 08:32 36864 c:\windows\SYSTEM32\ieudinit.exe
+ 2002-08-29 10:00 . 2009-03-08 08:32 71680 c:\windows\SYSTEM32\iesetup.dll
+ 2002-08-29 10:00 . 2009-03-08 08:32 55808 c:\windows\SYSTEM32\iernonce.dll
- 2006-06-29 12:05 . 2006-06-29 12:05 26112 c:\windows\SYSTEM32\idndl.dll
+ 2006-06-29 12:05 . 2009-01-07 22:20 26112 c:\windows\SYSTEM32\idndl.dll
+ 2007-08-13 22:36 . 2009-03-08 08:31 59904 c:\windows\SYSTEM32\icardie.dll
+ 2006-05-10 05:23 . 2009-03-08 08:31 46592 c:\windows\SYSTEM32\DLLCACHE\pngfilt.dll
- 2007-08-13 22:01 . 2007-08-13 22:01 48128 c:\windows\SYSTEM32\DLLCACHE\mshtmler.dll
+ 2007-08-13 22:01 . 2009-03-08 08:31 48128 c:\windows\SYSTEM32\DLLCACHE\mshtmler.dll
+ 2006-05-10 05:23 . 2009-03-08 08:31 66560 c:\windows\SYSTEM32\DLLCACHE\mshtmled.dll
- 2007-08-13 22:32 . 2007-08-13 22:32 45568 c:\windows\SYSTEM32\DLLCACHE\mshta.exe
+ 2007-08-13 22:32 . 2009-03-08 08:31 45568 c:\windows\SYSTEM32\DLLCACHE\mshta.exe
+ 2008-03-13 20:10 . 2009-03-08 08:31 55296 c:\windows\SYSTEM32\DLLCACHE\msfeedsbs.dll
+ 2007-08-13 22:44 . 2009-03-08 08:34 43008 c:\windows\SYSTEM32\DLLCACHE\licmgr10.dll
+ 2006-05-10 05:22 . 2009-04-30 21:22 25600 c:\windows\SYSTEM32\DLLCACHE\jsproxy.dll
+ 2006-05-10 05:22 . 2009-03-08 08:32 94720 c:\windows\SYSTEM32\DLLCACHE\inseng.dll
+ 2007-08-13 22:36 . 2009-03-08 08:31 34816 c:\windows\SYSTEM32\DLLCACHE\imgutil.dll
+ 2007-08-13 22:39 . 2009-03-08 08:32 71680 c:\windows\SYSTEM32\DLLCACHE\iesetup.dll
+ 2007-08-13 22:39 . 2009-03-08 08:32 55808 c:\windows\SYSTEM32\DLLCACHE\iernonce.dll
+ 2008-03-13 20:10 . 2009-03-08 08:31 59904 c:\windows\SYSTEM32\DLLCACHE\icardie.dll
+ 2007-08-13 22:18 . 2009-03-08 08:24 68608 c:\windows\SYSTEM32\DLLCACHE\hmmapi.dll
+ 2009-03-08 08:33 . 2009-03-08 08:33 18944 c:\windows\SYSTEM32\DLLCACHE\corpol.dll
+ 2007-08-13 22:39 . 2009-03-08 08:32 72704 c:\windows\SYSTEM32\DLLCACHE\admparse.dll
+ 2002-08-29 10:00 . 2009-03-08 08:33 18944 c:\windows\SYSTEM32\corpol.dll
- 2008-04-06 07:05 . 2009-05-13 20:28 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-04-06 07:05 . 2009-06-10 03:18 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2002-09-03 07:08 . 2009-06-10 03:18 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT
- 2002-09-03 07:08 . 2009-05-13 20:28 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT
- 2002-09-03 07:08 . 2009-05-13 20:28 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\INDEX.DAT
+ 2002-09-03 07:08 . 2009-06-10 03:18 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\INDEX.DAT
+ 2002-08-29 10:00 . 2009-03-08 08:32 72704 c:\windows\SYSTEM32\admparse.dll
+ 2009-06-10 03:33 . 2009-03-08 08:33 12288 c:\windows\ie8updates\KB969897-IE8\xpshims.dll
+ 2009-06-10 03:33 . 2009-03-08 08:33 25600 c:\windows\ie8updates\KB969897-IE8\jsproxy.dll
+ 2009-06-10 03:28 . 2009-03-08 18:23 58464 c:\windows\ie8\spuninst\iecustom.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 44544 c:\windows\ie8\pngfilt.dll
+ 2009-06-10 03:26 . 2007-08-13 22:01 48128 c:\windows\ie8\mshtmler.dll
+ 2009-06-10 03:26 . 2007-08-13 22:32 45568 c:\windows\ie8\mshta.exe
+ 2009-06-10 03:26 . 2007-08-13 22:36 12288 c:\windows\ie8\msfeedssync.exe
+ 2009-06-10 03:26 . 2009-02-20 18:09 52224 c:\windows\ie8\msfeedsbs.dll
+ 2009-06-10 03:26 . 2007-08-13 22:44 40960 c:\windows\ie8\licmgr10.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 27648 c:\windows\ie8\jsproxy.dll
+ 2009-06-10 03:26 . 2007-08-13 22:39 92672 c:\windows\ie8\inseng.dll
+ 2009-06-10 03:26 . 2007-08-13 22:36 36352 c:\windows\ie8\imgutil.dll
+ 2009-06-10 03:26 . 2007-08-13 22:39 55296 c:\windows\ie8\iesetup.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 44544 c:\windows\ie8\iernonce.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 78336 c:\windows\ie8\ieencode.dll
+ 2009-06-10 03:26 . 2009-02-20 10:20 70656 c:\windows\ie8\ie4uinit.exe
+ 2009-06-10 03:26 . 2009-02-20 18:09 63488 c:\windows\ie8\icardie.dll
+ 2009-06-10 03:26 . 2007-08-13 22:18 60416 c:\windows\ie8\hmmapi.dll
+ 2009-06-10 03:26 . 2008-04-14 00:11 35328 c:\windows\ie8\corpol.dll
+ 2009-06-10 03:26 . 2007-08-13 22:39 71680 c:\windows\ie8\admparse.dll
+ 2009-06-10 03:33 . 2009-03-08 08:35 2048 c:\windows\ie8updates\KB971180-IE8\iecompat.dll
+ 2008-03-13 20:05 . 2009-01-07 22:21 121856 c:\windows\SYSTEM32\xmllite.dll
- 2008-03-13 20:05 . 2008-04-14 00:12 121856 c:\windows\SYSTEM32\xmllite.dll
+ 2007-08-13 22:45 . 2009-03-08 08:34 208384 c:\windows\SYSTEM32\WinFXDocObj.exe
+ 2002-08-29 10:00 . 2009-03-08 08:34 236544 c:\windows\SYSTEM32\webcheck.dll
+ 2002-08-29 10:00 . 2009-03-08 08:33 420352 c:\windows\SYSTEM32\vbscript.dll
- 2002-08-29 10:00 . 2009-02-20 18:09 105984 c:\windows\SYSTEM32\url.dll
+ 2002-08-29 10:00 . 2009-03-08 08:34 105984 c:\windows\SYSTEM32\url.dll
+ 2004-09-22 04:21 . 2009-06-10 03:47 464034 c:\windows\SYSTEM32\PERFH009.DAT
+ 2002-08-29 10:00 . 2009-03-08 08:34 109568 c:\windows\SYSTEM32\occache.dll
+ 2002-08-29 10:00 . 2009-03-08 08:32 611840 c:\windows\SYSTEM32\mstime.dll
+ 2002-08-29 10:00 . 2009-03-08 08:34 193536 c:\windows\SYSTEM32\msrating.dll
+ 2002-08-29 10:00 . 2009-03-08 08:22 156160 c:\windows\SYSTEM32\msls31.dll
- 2002-08-29 10:00 . 2007-08-13 22:54 156160 c:\windows\SYSTEM32\msls31.dll
+ 2007-08-13 22:54 . 2009-03-08 08:32 594432 c:\windows\SYSTEM32\msfeeds.dll
+ 2009-01-07 22:20 . 2009-01-07 22:20 265720 c:\windows\SYSTEM32\msdbg2.dll
+ 2003-01-13 19:57 . 2009-03-08 08:33 726528 c:\windows\SYSTEM32\jscript.dll
+ 2009-06-10 03:53 . 2009-05-21 15:34 148888 c:\windows\SYSTEM32\javaws.exe
- 2009-04-01 14:34 . 2009-03-09 09:19 148888 c:\windows\SYSTEM32\javaws.exe
+ 2009-06-10 03:53 . 2009-05-21 15:34 144792 c:\windows\SYSTEM32\javaw.exe
- 2009-04-01 14:34 . 2009-03-09 09:19 144792 c:\windows\SYSTEM32\javaw.exe
- 2009-04-01 14:34 . 2009-03-09 09:19 144792 c:\windows\SYSTEM32\java.exe
+ 2009-06-10 03:53 . 2009-05-21 15:34 144792 c:\windows\SYSTEM32\java.exe
+ 2007-08-13 22:54 . 2009-03-08 08:22 164352 c:\windows\SYSTEM32\ieui.dll
+ 2005-02-18 16:43 . 2009-03-08 08:31 183808 c:\windows\SYSTEM32\iepeers.dll
+ 2002-08-29 10:00 . 2009-04-30 21:22 385536 c:\windows\SYSTEM32\iedkcs32.dll
+ 2007-07-11 16:27 . 2009-03-08 08:11 445952 c:\windows\SYSTEM32\ieapfltr.dll
+ 2002-08-29 10:00 . 2009-03-08 08:32 163840 c:\windows\SYSTEM32\ieakui.dll
+ 2002-08-29 10:00 . 2009-03-08 08:33 229376 c:\windows\SYSTEM32\ieaksie.dll
+ 2002-08-29 10:00 . 2009-03-08 08:33 125952 c:\windows\SYSTEM32\ieakeng.dll
+ 2002-08-29 10:00 . 2009-04-30 11:21 173056 c:\windows\SYSTEM32\ie4uinit.exe
+ 2005-09-02 20:35 . 2009-03-08 08:31 216064 c:\windows\SYSTEM32\dxtrans.dll
+ 2002-08-29 10:00 . 2009-03-08 08:31 348160 c:\windows\SYSTEM32\dxtmsft.dll
+ 2006-05-10 05:23 . 2009-05-13 05:15 915456 c:\windows\SYSTEM32\DLLCACHE\wininet.dll
+ 2007-08-13 22:54 . 2009-03-08 08:34 236544 c:\windows\SYSTEM32\DLLCACHE\webcheck.dll
+ 2006-09-18 14:15 . 2009-03-08 08:33 759296 c:\windows\SYSTEM32\DLLCACHE\VGX.dll
+ 2008-05-09 10:53 . 2009-03-08 08:33 420352 c:\windows\SYSTEM32\DLLCACHE\vbscript.dll
+ 2007-08-13 22:44 . 2009-03-08 08:34 105984 c:\windows\SYSTEM32\DLLCACHE\url.dll
- 2007-08-13 22:44 . 2009-02-20 18:09 105984 c:\windows\SYSTEM32\DLLCACHE\url.dll
+ 2009-01-07 22:20 . 2009-01-07 22:20 134144 c:\windows\SYSTEM32\DLLCACHE\sqmapi.dll
+ 2009-01-07 22:20 . 2009-01-07 22:20 474112 c:\windows\SYSTEM32\DLLCACHE\shlwapi.dll
+ 2007-08-13 22:44 . 2009-03-08 08:34 109568 c:\windows\SYSTEM32\DLLCACHE\occache.dll
+ 2006-05-10 05:23 . 2009-03-08 08:32 611840 c:\windows\SYSTEM32\DLLCACHE\mstime.dll
+ 2006-05-10 05:23 . 2009-03-08 08:34 193536 c:\windows\SYSTEM32\DLLCACHE\msrating.dll
+ 2002-08-29 10:00 . 2009-03-08 08:22 156160 c:\windows\SYSTEM32\DLLCACHE\msls31.dll
- 2002-08-29 10:00 . 2007-08-13 22:54 156160 c:\windows\SYSTEM32\DLLCACHE\msls31.dll
+ 2008-03-13 20:10 . 2009-03-08 08:32 594432 c:\windows\SYSTEM32\DLLCACHE\msfeeds.dll
+ 2008-05-09 10:53 . 2009-03-08 08:33 726528 c:\windows\SYSTEM32\DLLCACHE\jscript.dll
+ 2007-08-13 22:43 . 2009-03-08 18:09 638816 c:\windows\SYSTEM32\DLLCACHE\iexplore.exe
+ 2006-05-10 05:22 . 2009-03-08 08:31 183808 c:\windows\SYSTEM32\DLLCACHE\iepeers.dll
+ 2007-08-13 22:39 . 2009-04-30 21:22 385536 c:\windows\SYSTEM32\DLLCACHE\iedkcs32.dll
+ 2008-03-13 20:10 . 2009-03-08 08:11 445952 c:\windows\SYSTEM32\DLLCACHE\ieapfltr.dll
+ 2007-08-13 21:56 . 2009-03-08 08:32 163840 c:\windows\SYSTEM32\DLLCACHE\ieakui.dll
+ 2007-08-13 22:39 . 2009-03-08 08:33 229376 c:\windows\SYSTEM32\DLLCACHE\ieaksie.dll
+ 2007-08-13 22:39 . 2009-03-08 08:33 125952 c:\windows\SYSTEM32\DLLCACHE\ieakeng.dll
+ 2007-08-13 22:39 . 2009-04-30 11:21 173056 c:\windows\SYSTEM32\DLLCACHE\ie4uinit.exe
+ 2006-05-10 05:22 . 2009-03-08 08:31 216064 c:\windows\SYSTEM32\DLLCACHE\dxtrans.dll
+ 2006-05-10 05:22 . 2009-03-08 08:31 348160 c:\windows\SYSTEM32\DLLCACHE\dxtmsft.dll
+ 2007-08-13 22:39 . 2009-03-08 08:32 128512 c:\windows\SYSTEM32\DLLCACHE\advpack.dll
+ 2002-08-29 10:00 . 2009-03-08 08:32 128512 c:\windows\SYSTEM32\advpack.dll
+ 2009-06-10 03:33 . 2007-11-30 12:39 382840 c:\windows\ie8updates\KB971180-IE8\spuninst\updspapi.dll
+ 2009-06-10 03:33 . 2007-11-30 12:39 231288 c:\windows\ie8updates\KB971180-IE8\spuninst\spuninst.exe
+ 2009-06-10 03:33 . 2009-03-08 08:34 914944 c:\windows\ie8updates\KB969897-IE8\wininet.dll
+ 2009-06-10 03:33 . 2008-07-09 07:38 382840 c:\windows\ie8updates\KB969897-IE8\spuninst\updspapi.dll
+ 2009-06-10 03:33 . 2007-11-30 12:39 231288 c:\windows\ie8updates\KB969897-IE8\spuninst\spuninst.exe
+ 2009-06-10 03:33 . 2009-03-08 08:33 246784 c:\windows\ie8updates\KB969897-IE8\ieproxy.dll
+ 2009-06-10 03:33 . 2009-03-08 18:09 391536 c:\windows\ie8updates\KB969897-IE8\iedkcs32.dll
+ 2009-06-10 03:33 . 2009-03-08 08:32 173056 c:\windows\ie8updates\KB969897-IE8\ie4uinit.exe
+ 2009-06-10 03:26 . 2009-03-03 00:18 826368 c:\windows\ie8\wininet.dll
+ 2009-06-10 03:26 . 2007-08-13 22:45 206336 c:\windows\ie8\winfxdocobj.exe
+ 2009-06-10 03:26 . 2009-02-20 18:09 233472 c:\windows\ie8\webcheck.dll
+ 2009-06-10 03:26 . 2007-07-12 23:31 765952 c:\windows\ie8\vgx.dll
+ 2009-06-10 03:26 . 2008-05-09 10:53 430080 c:\windows\ie8\vbscript.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 105984 c:\windows\ie8\url.dll
+ 2009-06-10 03:28 . 2009-01-07 22:21 382496 c:\windows\ie8\spuninst\updspapi.dll
+ 2009-06-10 03:28 . 2009-01-07 22:20 231456 c:\windows\ie8\spuninst\spuninst.exe
+ 2009-06-10 03:26 . 2006-09-06 21:43 213216 c:\windows\ie8\spuninst.exe
+ 2009-06-10 03:26 . 2009-02-20 18:09 102912 c:\windows\ie8\occache.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 671232 c:\windows\ie8\mstime.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 193024 c:\windows\ie8\msrating.dll
+ 2009-06-10 03:26 . 2007-08-13 22:54 156160 c:\windows\ie8\msls31.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 477696 c:\windows\ie8\mshtmled.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 459264 c:\windows\ie8\msfeeds.dll
+ 2009-06-10 03:26 . 2008-05-09 10:53 512000 c:\windows\ie8\jscript.dll
+ 2009-06-10 03:26 . 2009-02-28 04:54 636072 c:\windows\ie8\iexplore.exe
+ 2009-06-10 03:26 . 2007-08-13 22:54 180736 c:\windows\ie8\ieui.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 268288 c:\windows\ie8\iertutil.dll
+ 2009-06-10 03:26 . 2007-08-13 22:54 287744 c:\windows\ie8\ieproxy.dll
+ 2009-06-10 03:26 . 2007-08-13 22:54 191488 c:\windows\ie8\iepeers.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 385024 c:\windows\ie8\iedkcs32.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 383488 c:\windows\ie8\ieapfltr.dll
+ 2009-06-10 03:26 . 2009-02-20 05:14 161792 c:\windows\ie8\ieakui.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 230400 c:\windows\ie8\ieaksie.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 153088 c:\windows\ie8\ieakeng.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 214528 c:\windows\ie8\dxtrans.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 347136 c:\windows\ie8\dxtmsft.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 124928 c:\windows\ie8\advpack.dll
+ 2005-10-21 17:51 . 2009-04-30 21:22 1207808 c:\windows\SYSTEM32\urlmon.dll
+ 2005-10-04 16:19 . 2009-05-13 05:15 5936128 c:\windows\SYSTEM32\mshtml.dll
+ 2007-08-13 22:34 . 2009-04-30 21:22 1985024 c:\windows\SYSTEM32\iertutil.dll
+ 2007-02-12 20:10 . 2009-02-07 01:07 3698584 c:\windows\SYSTEM32\ieapfltr.dat
+ 2006-05-10 05:23 . 2009-04-30 21:22 1207808 c:\windows\SYSTEM32\DLLCACHE\urlmon.dll
+ 2009-01-07 22:20 . 2009-01-07 22:20 1497088 c:\windows\SYSTEM32\DLLCACHE\shdocvw.dll
+ 2006-05-19 15:08 . 2009-05-13 05:15 5936128 c:\windows\SYSTEM32\DLLCACHE\mshtml.dll
+ 2008-03-13 20:10 . 2009-04-30 21:22 1985024 c:\windows\SYSTEM32\DLLCACHE\iertutil.dll
+ 2008-03-13 20:10 . 2009-02-07 01:07 3698584 c:\windows\SYSTEM32\DLLCACHE\ieapfltr.dat
+ 2009-01-07 22:20 . 2009-01-07 22:20 1022976 c:\windows\SYSTEM32\DLLCACHE\browseui.dll
+ 2009-06-10 03:33 . 2009-03-08 08:34 1206784 c:\windows\ie8updates\KB969897-IE8\urlmon.dll
+ 2009-06-10 03:33 . 2009-03-08 08:41 5937152 c:\windows\ie8updates\KB969897-IE8\mshtml.dll
+ 2009-06-10 03:33 . 2009-03-08 08:32 1985024 c:\windows\ie8updates\KB969897-IE8\iertutil.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 1160192 c:\windows\ie8\urlmon.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 3595264 c:\windows\ie8\mshtml.dll
+ 2009-06-10 03:26 . 2009-02-20 18:09 6066176 c:\windows\ie8\ieframe.dll
+ 2009-06-10 03:26 . 2008-07-09 14:25 2455488 c:\windows\ie8\ieapfltr.dat
+ 2009-04-15 11:07 . 2008-07-09 14:25 2455488 c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\ieapfltr.dat
- 2009-04-15 11:07 . 2007-04-17 09:32 2455488 c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\ieapfltr.dat
+ 2005-05-31 19:32 . 2009-06-01 13:51 23635392 c:\windows\SYSTEM32\MRT.exe
+ 2007-08-13 22:54 . 2009-04-30 21:22 11064832 c:\windows\SYSTEM32\ieframe.dll
+ 2008-03-13 20:10 . 2009-04-30 21:22 11064832 c:\windows\SYSTEM32\DLLCACHE\ieframe.dll
+ 2009-06-10 03:33 . 2009-03-08 08:39 11063808 c:\windows\ie8updates\KB969897-IE8\ieframe.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 200704]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"PhotoShow Deluxe Media Manager"="c:\progra~1\SIMPLE~1\PHOTOS~1\data\xtras\mssysmgr.exe" [2005-02-01 163840]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-04 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-13 98304]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-14 536576]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-03-15 122933]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248]
"mmtask"="c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2004-04-19 53248]
"MMTray"="c:\program files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe" [2004-04-19 131072]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-08 185896]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-01 1392640]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-03-11 936960]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-06 177472]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Adobe Acrobat 6.0 CE\Distillr\acrotray.exe [2003-7-17 217180]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-13 110592]
DataViz Inc Messenger.lnk - c:\program files\Common Files\DataViz\DvzIncMsgr.exe [2006-5-31 28672]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2004-9-22 24576]
HotSync Manager.lnk - c:\program files\palmOne\Hotsync.exe [2004-6-9 471040]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-29 53248]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-12 83360]
NkvMon.exe.lnk - c:\program files\Nikon\NkView6\NkvMon.exe [2004-11-3 241664]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\EXPOCAD\\Program\\Cadvance.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 pavboot;pavboot;c:\windows\SYSTEM32\DRIVERS\pavboot.sys [9/8/2008 10:53 PM 28544]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [9/18/2008 10:30 PM 210216]
S2 gupdate1c9b574f47a2d4c;Google Update Service (gupdate1c9b574f47a2d4c);c:\program files\Google\Update\GoogleUpdate.exe [4/4/2009 6:30 PM 133104]
S3 ACGPRS;Sierra Wireless 3G Adapter;c:\windows\SYSTEM32\DRIVERS\acgprs.sys [9/19/2005 5:17 PM 88192]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [9/17/2008 12:54 AM 33752]
S3 Nikon1394;Nikon1394Driver;c:\windows\SYSTEM32\DRIVERS\NikonDx.sys [7/4/2006 10:26 AM 106172]
S3 SDTHOOK;SDTHOOK;c:\windows\SYSTEM32\DRIVERS\SDTHOOK.SYS [3/13/2008 11:32 AM 44928]
S3 SQTECH907B;EZCam(PID_907B_00);c:\windows\SYSTEM32\DRIVERS\Capt907B.sys [1/27/2007 7:37 PM 61643]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - JAVAQUICKSTARTERSERVICE

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-06-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-06-10 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-10-28 22:26]

2009-06-10 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-04-04 22:29]

2009-04-15 c:\windows\Tasks\McDefragTask.job
- c:\windows\system32\defrag.exe [2002-08-29 00:12]

2008-07-01 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2006-10-14 15:53]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Intelinet - c:\program files\Intelinet\Intelinet.exe

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = <local>;*.local
IE: RemindU. - file://c:\program files\Upromise_Remind_U\UpromisesRemindU\UpromisetRemindU\uproC0.htm
LSP: bmnet.dll
FF - ProfilePath - c:\documents and settings\Mark Moore\Application Data\Mozilla\Firefox\Profiles\0xs7t934.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-10 01:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(820)
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'lsass.exe'(876)
c:\windows\system32\bmnet.dll
.
Completion time: 2009-06-10 1:31
ComboFix-quarantined-files.txt 2009-06-10 05:30
ComboFix2.txt 2002-01-08 03:48
ComboFix3.txt 2008-04-06 06:36
ComboFix4.txt 2008-04-06 03:54

Pre-Run: 22,658,523,136 bytes free
Post-Run: 22,637,641,728 bytes free

384 --- E O F --- 2009-06-10 03:34

**chemist** · 06-10-2009, 04:30 AM

Hello again, Kimberly. Please tell us how your system is behaving.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs):

Java(TM) 6 Update 7

These are all outdated, and security risks by having them installed still.

Leave this one as it has the latest definitions:

Java(TM) 6 Update 13

Going forward, Java will overwrite existing installs, so removing older versions should not be required after this.

When updating in the future, make sure you untick the box next to Yahoo Toolbar for Firefox/Mozilla or MSN Toolbar unless you want it.

------------------------------------------------------

Please download ATF-Cleaner by Atribune and Save it to your Desktop.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

------------------------------------------------------

Please run this online scan to help look for remnants.

Establish an internet connection & perform an online scan at Kaspersky Online Scanner

Ensure your external and/or USB drives are inserted during the scan.

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at any Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected.
It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

------------------------------------------------------

Please post the following in your next reply:

Kaspersky report
report on system behavior

**chemist** · 06-10-2009, 04:31 AM

Hello again, Kimberly. Please tell us how your system is behaving.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs):

Java(TM) 6 Update 7

These are all outdated, and security risks by having them installed still.

Leave this one as it has the latest definitions:

Java(TM) 6 Update 13

Going forward, Java will overwrite existing installs, so removing older versions should not be required after this.

When updating in the future, make sure you untick the box next to Yahoo Toolbar for Firefox/Mozilla or MSN Toolbar unless you want it.

------------------------------------------------------

Please download ATF-Cleaner by Atribune and Save it to your Desktop.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

------------------------------------------------------

Please run this online scan to help look for remnants.

Establish an internet connection & perform an online scan at Kaspersky Online Scanner

Ensure your external and/or USB drives are inserted during the scan.

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at any Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected.
It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

------------------------------------------------------

Please post the following in your next reply:

Kaspersky report
report on system behavior

dispixie3 · 06-11-2009, 09:47 AM

system seems to be better. I'll try a couple of things. In the meantime, I took care of the Java and ATF.

Kaspersky follows:

KASPERSKY ONLINE SCANNER 7.0 REPORT
Thursday, June 11, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Thursday, June 11, 2009 12:15:25
Records in database: 2336989
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 133484
Threat name: 1
Infected objects: 3
Suspicious objects: 0
Duration of the scan: 04:14:15

File name / Threat name / Threats count
C:\Documents and Settings\Mark Moore\Desktop\setup(2).exe Infected: not-a-virus:FraudTool.Win32.Agent.dx 1
C:\Documents and Settings\Mark Moore\Desktop\setup.exe Infected: not-a-virus:FraudTool.Win32.Agent.dx 1
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP415\A0141757.exe Infected: not-a-virus:FraudTool.Win32.Agent.dx 1

The selected area was scanned.

**chemist** · 06-11-2009, 09:53 AM

Hello again, Kimberly. System Volume Information is where Windows keeps old system restore points. That will get deleted when we uninstall ComboFix.

Open Notepad and copy/paste the entire contents of the codebox below into Notepad:

Code:

@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (

"C:\Documents and Settings\Mark Moore\Desktop\setup(2).exe"
"C:\Documents and Settings\Mark Moore\Desktop\setup.exe"

) do (
del /a/f/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)


if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

pause
del %0

Save this Notepad file as fix.bat and choose to Save as type: - All Files then close the Notepad file.
It should look like this:

Double-click on fix.bat to run it.

Tell me what it says in your next reply. Press any key to continue.

------------------------------------------------------

dispixie3 · 06-11-2009, 08:10 PM

Sorry it happened so quick. There was one sentence that said something "deleted".

**chemist** · 06-11-2009, 08:40 PM

Congratulations. Well done! Your logs appear clean. You should be good to go.

As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now.

Please disable McAfee before uninstalling ComboFix and then re-enable it after doing so.

Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK:

combofix /u

This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point.

Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already.

You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix.

------------------------------------------------------

MICROSOFT UPDATES
It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection.

SPYWARE PREVENTION
This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles:

How Did I Get Infected In The First Place? by TonyKlein
How to Prevent Malware by miekiemoes

To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware, or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an add-on available for both Firefox and IE.
SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites in Internet Explorer. See tutorial here
MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here
- Download Host.zip and Save it to your Desktop.
- Right-click hosts.zip and select 'Extract all files' or 'Extract files...'.
- Follow the prompts and click 'Finish'.
- This will open the newly created hosts folder on your Desktop.
- Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
- Once updated you should see another prompt that the task was completed.
IE-Spyad is another excellent program that places over 5000 dubious websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. It basically prevents any downloads from the sites listed, although you will still be able to connect to the site. See tutorial here

Keep your antivirus program and antispyware programs updated and scan with them on a regular basis.

Please respond to this thread one more time so we can mark this thread as resolved.

dispixie3 · 06-12-2009, 01:54 PM

I'm all good.

Thank You
Kimberly

**chemist** · 06-12-2009, 07:57 PM

You're welcome, Kimberly! Glad to have helped.

06-04-2009, 02:27 PM	#2 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,582 OS: XP SP3	Re: Need help, some various problems Hello and Welcome to TSF. Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ Please visit this webpage for download links, and instructions for running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix. Get help here Please post the C:\ComboFix.txt in your next reply for further review. ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

06-06-2009, 10:57 PM	#3 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,582 OS: XP SP3	Re: Need help, some various problems Due to lack of response, this topic will now be closed. If you need continued support, please begin a new thread, and provide a link to this topic. This applies only to the original topic starter. Everyone else please begin a New Topic, after following the steps outlined here: IMPORTANT - Read This Before Posting For Malware Removal Help ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

06-07-2009, 09:52 PM	#4 (permalink)
dispixie3 Registered User Join Date: Mar 2008 Posts: 20 OS: xp	Need Help I got tossed out, sorry. I've tried to post a link below, I hope it works. http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/hijackthis-log-help-inactive/382095-need-help-some-various-problems.html

06-08-2009, 04:22 AM	#5 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,582 OS: XP SP3	Re: Need help, some various problems Hello dispixie3. Did you carry out the instructions in post #2 above? Please post the log. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

06-08-2009, 09:09 AM	#6 (permalink)
dispixie3 Registered User Join Date: Mar 2008 Posts: 20 OS: xp	Re: Need help, some various problems Combo fix: ComboFix 09-06-07.07 - Mark Moore 01/07/2002 22:34.4 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1006.592 [GMT -5:00] Running from: c:\documents and settings\Mark Moore\Desktop\ComboFix.exe AV: McAfee VirusScan On-access scanning disabled (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall disabled {94894B63-8C7F-4050-BDA4-813CA00DA3E8} . ((((((((((((((((((((((((( Files Created from 2001-12-08 to 2002-01-08 ))))))))))))))))))))))))))))))) . 2009-05-12 01:39 . 2009-05-12 01:39 390664 ----a-w- c:\documents and settings\Mark Moore\Application Data\Real\RealPlayer\Update\RealPlayer11.exe 2009-04-19 22:43 . 2009-04-19 22:44 -------- d-----w- c:\program files\iTunes 2009-04-19 22:43 . 2009-04-19 22:44 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-04-19 22:36 . 2009-04-19 22:36 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.1.1.10\SetupAdmin.exe 2009-04-15 11:05 . 2009-03-06 14:22 284160 ------w- c:\windows\system32\dllcache\pdh.dll 2009-04-15 11:05 . 2009-02-06 10:39 35328 ------w- c:\windows\system32\dllcache\sc.exe 2009-04-15 11:05 . 2009-02-09 12:10 401408 ------w- c:\windows\system32\dllcache\rpcss.dll 2009-04-15 11:05 . 2009-02-06 11:11 110592 ------w- c:\windows\system32\dllcache\services.exe 2009-04-15 11:05 . 2009-02-09 12:10 473600 ------w- c:\windows\system32\dllcache\fastprox.dll 2009-04-15 11:05 . 2009-02-06 10:10 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe 2009-04-15 11:05 . 2009-02-09 12:10 453120 ------w- c:\windows\system32\dllcache\wmiprvsd.dll 2009-04-15 11:05 . 2009-02-09 12:10 729088 ------w- c:\windows\system32\dllcache\lsasrv.dll 2009-04-15 11:05 . 2009-02-09 12:10 617472 ------w- c:\windows\system32\dllcache\advapi32.dll 2009-04-15 11:05 . 2009-02-09 12:10 714752 ------w- c:\windows\system32\dllcache\ntdll.dll 2009-04-15 11:03 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll 2009-04-15 11:03 . 2008-04-21 12:08 215552 ------w- c:\windows\system32\dllcache\wordpad.exe 2009-04-15 04:12 . 2009-04-15 04:12 -------- d-----w- c:\program files\TweetDeck 2009-04-10 00:32 . 2009-04-10 00:32 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\SACore 2009-04-08 04:33 . 2009-04-08 04:33 292878 ----a-r- c:\documents and settings\Mark Moore\Application Data\Microsoft\Installer\{A212E6C2-20F7-4A8E-BD8E-DC3EE7483FA2}\ARPPRODUCTICON.exe 2009-04-08 04:33 . 2009-04-08 04:33 -------- d-----w- c:\program files\Common Files\Sony Shared 2009-04-04 22:30 . 2009-04-04 22:30 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google 2009-04-04 22:26 . 2002-01-04 12:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-04-01 14:32 . 2009-04-01 14:32 152576 ----a-w- c:\documents and settings\Mark Moore\Application Data\Sun\Java\jre1.6.0_13\lzma.dll 2009-03-21 14:06 . 2009-03-21 14:06 989696 ------w- c:\windows\system32\dllcache\kernel32.dll 2009-03-19 20:32 . 2009-03-19 20:32 23400 ----a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\x86\GEARAspiWDM.sys 2009-03-13 13:07 . 2009-03-13 13:08 -------- d-----w- c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3} 2009-03-13 13:02 . 2009-03-06 03:59 1900544 ----a-w- c:\windows\system32\usbaaplrc.dll 2009-03-13 12:55 . 2009-03-13 12:56 -------- d-----w- c:\program files\Safari 2009-02-22 15:35 . 2009-02-22 15:35 -------- d-----w- c:\documents and settings\Mark Moore\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1 2009-02-22 15:34 . 2009-04-04 21:47 38208 ----a-w- c:\documents and settings\Mark Moore\Application Data\Macromedia\Flash Player\http://www.macromedia.com\bin\airapp...pinstaller.exe 2009-02-22 15:34 . 2009-04-04 21:48 -------- d-----w- c:\program files\Common Files\Adobe AIR 2009-02-20 18:09 . 2009-02-20 18:09 78336 ------w- c:\windows\system32\dllcache\ieencode.dll 2009-02-06 16:23 . 2009-04-24 04:53 -------- d-----w- c:\program files\QuickTime 2009-02-06 16:18 . 2009-02-06 16:18 -------- d-----w- c:\program files\Sun 2009-02-04 17:56 . 2009-02-04 17:56 75112 ----a-w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}\x86\DifXInstall32.exe 2009-02-03 19:59 . 2009-02-03 19:59 56832 ------w- c:\windows\system32\dllcache\secur32.dll 2009-01-07 01:00 . 2009-01-07 01:00 -------- d-----w- c:\program files\Bonjour 2008-12-16 12:30 . 2008-12-16 12:30 354304 ------w- c:\windows\system32\dllcache\winhttp.dll 2008-12-12 16:18 . 2008-12-12 16:18 87336 ----a-w- c:\windows\system32\dns-sd.exe 2008-12-12 16:11 . 2008-12-12 16:11 61440 ----a-w- c:\windows\system32\dnssd.dll 2008-12-05 06:54 . 2008-12-05 06:54 144896 ------w- c:\windows\system32\dllcache\schannel.dll 2008-12-03 18:51 . 2009-02-06 16:15 152576 ----a-w- c:\documents and settings\Mark Moore\Application Data\Sun\Java\jre1.6.0_11\lzma.dll 2008-11-14 17:19 . 2009-03-09 09:19 410984 ----a-w- c:\windows\system32\deploytk.dll 2008-11-14 17:17 . 2008-11-14 17:17 152576 ----a-w- c:\documents and settings\Mark Moore\Application Data\Sun\Java\jre1.6.0_10\lzma.dll 2008-11-12 14:36 . 2008-10-24 11:21 455296 ------w- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-12 14:35 . 2008-09-04 17:15 1106944 ------w- c:\windows\system32\dllcache\msxml3.dll 2008-11-09 14:04 . 2008-11-09 14:04 -------- d-----w- c:\program files\PhotoViewer 2008-11-03 00:36 . 2008-11-03 00:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Marlin 2008-11-02 20:43 . 2009-04-08 04:33 -------- d-----w- c:\program files\Sony 2008-11-02 20:40 . 2008-11-02 20:40 -------- d-----w- c:\documents and settings\Mark Moore\Local Settings\Application Data\Sony Corporation 2008-11-02 20:40 . 2008-11-02 20:40 -------- d-----w- c:\documents and settings\Mark Moore\Local Settings\Application Data\kinoma 2008-11-02 20:40 . 2008-11-02 20:40 -------- d-----w- c:\documents and settings\All Users\Application Data\kinoma 2008-11-02 20:40 . 2008-11-02 20:40 -------- d-----w- c:\program files\DIFX 2008-11-01 22:58 . 2008-12-11 10:57 333952 ------w- c:\windows\system32\dllcache\srv.sys 2008-11-01 22:57 . 2009-02-09 11:13 1846784 ------w- c:\windows\system32\dllcache\win32k.sys 2008-11-01 22:57 . 2009-02-06 11:06 2145280 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe 2008-11-01 22:57 . 2009-02-06 11:08 2189056 ------w- c:\windows\system32\dllcache\ntoskrnl.exe 2008-11-01 22:57 . 2009-02-06 10:32 2023936 ------w- c:\windows\system32\dllcache\ntkrpamp.exe 2008-11-01 22:57 . 2009-02-07 23:02 2066048 ------w- c:\windows\system32\dllcache\ntkrnlpa.exe 2008-11-01 22:57 . 2008-10-15 16:34 337408 ------w- c:\windows\system32\dllcache\netapi32.dll 2008-10-23 12:36 . 2008-10-23 12:36 286720 ------w- c:\windows\system32\dllcache\gdi32.dll 2008-09-30 21:43 . 2008-09-30 21:43 1286152 ----a-w- c:\windows\system32\msxml4.dll 2008-09-20 02:45 . 2008-09-20 02:45 -------- d-----w- c:\documents and settings\Mark Moore\Application Data\Motive 2008-09-20 02:45 . 2008-09-20 02:45 -------- d-----w- c:\documents and settings\All Users\Application Data\SiteAdvisor 2008-09-19 17:52 . 2008-09-19 17:52 -------- d-----w- c:\documents and settings\LocalService\Application Data\SiteAdvisor 2008-09-19 03:07 . 2008-09-19 03:07 -------- d-----w- c:\documents and settings\Mark Moore\Local Settings\Application Data\Citrix 2008-09-19 03:07 . 2008-09-19 03:07 61224 ----a-w- c:\documents and settings\Mark Moore\GoToAssistDownloadHelper.exe 2008-09-19 02:36 . 2008-09-19 02:36 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore 2008-09-18 20:49 . 2008-11-14 22:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Motive 2008-09-18 20:49 . 2008-09-18 20:49 -------- d-----w- c:\program files\Common Files\Motive 2008-09-18 20:49 . 2008-09-24 14:00 -------- d-----w- c:\program files\Verizon 2008-09-17 04:54 . 2008-09-17 05:09 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS 2008-09-17 04:54 . 2008-09-17 04:54 -------- d-----w- c:\program files\NOS 2008-09-11 03:23 . 2008-09-11 03:23 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters 2008-09-11 03:22 . 2008-09-11 03:22 -------- d-----w- c:\documents and settings\Mark Moore\Local Settings\Application Data\Downloaded Installations 2008-09-10 23:45 . 2008-07-31 14:41 68616 ----a-w- c:\windows\system32\XAPOFX1_1.dll 2008-09-10 23:45 . 2008-07-31 14:40 509448 ----a-w- c:\windows\system32\XAudio2_2.dll 2008-09-10 23:45 . 2008-07-31 14:41 238088 ----a-w- c:\windows\system32\xactengine3_2.dll 2008-09-10 23:45 . 2008-07-12 12:18 467984 ----a-w- c:\windows\system32\d3dx10_39.dll 2008-09-10 23:45 . 2008-07-12 12:18 1493528 ----a-w- c:\windows\system32\D3DCompiler_39.dll 2008-09-10 23:45 . 2008-07-12 12:18 3851784 ----a-w- c:\windows\system32\D3DX9_39.dll 2008-09-10 23:35 . 2008-09-10 23:43 -------- d--h--w- c:\windows\msdownld.tmp 2008-09-10 23:35 . 2008-09-10 23:35 -------- d-----w- c:\windows\Logs 2008-09-10 15:22 . 2008-09-10 15:22 -------- d-----w- c:\program files\Three Rings Design 2008-09-10 14:02 . 2002-01-03 13:37 -------- d-----w- c:\program files\SpywareBlaster 2008-09-10 01:47 . 2008-09-10 01:47 -------- d-----w- c:\documents and settings\Mark Moore\Local Settings\Application Data\Mozilla 2008-09-09 05:24 . 2008-09-09 05:24 -------- d-----w- c:\windows\system32\scripting 2008-09-09 05:24 . 2008-09-09 05:24 -------- d-----w- c:\windows\l2schemas 2008-09-09 05:24 . 2008-09-09 05:24 -------- d-----w- c:\windows\system32\en 2008-09-09 02:53 . 2008-06-19 21:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys 2008-09-09 02:53 . 2008-09-09 02:53 -------- d-----w- c:\program files\Panda Security 2008-09-09 00:02 . 2008-04-14 00:12 152064 ------w- c:\windows\system32\dllcache\shmedia.dll 2008-09-09 00:01 . 2008-04-14 00:12 259072 ------w- c:\windows\system32\dllcache\msnetobj.dll 2008-09-09 00:00 . 2008-04-13 16:36 144384 ------w- c:\windows\system32\drivers\hdaudbus.sys 2008-09-08 18:31 . 2006-11-01 16:48 33664 ----a-w- c:\windows\system32\drivers\BCMWLNPF.SYS 2008-09-08 18:31 . 2006-11-01 16:48 86016 ----a-w- c:\windows\system32\preflib.dll 2008-09-08 18:31 . 2006-11-01 16:48 44032 ----a-w- c:\windows\system32\wltrynt.dll 2008-09-08 18:31 . 2006-11-01 16:48 69632 ----a-w- c:\windows\system32\bcmwlpkt.dll 2008-09-08 18:31 . 2006-11-01 16:48 1392640 ----a-w- c:\windows\system32\WLTRAY.EXE 2008-09-08 18:31 . 2006-11-01 16:48 2129920 ----a-w- c:\windows\system32\WLBCGCBPRO731.DLL 2008-09-08 18:31 . 2006-11-01 16:48 757760 ----a-w- c:\windows\system32\bcm1xsup.dll 2008-09-08 17:51 . 2008-04-11 19:04 691712 ------w- c:\windows\system32\dllcache\inetcomm.dll 2008-09-05 13:40 . 2008-05-01 14:33 331776 ------w- c:\windows\system32\dllcache\msadce.dll 2008-07-07 20:26 . 2008-07-07 20:26 253952 ------w- c:\windows\system32\dllcache\es.dll 2008-06-24 16:43 . 2008-06-24 16:43 74240 ------w- c:\windows\system32\dllcache\mscms.dll 2008-06-20 17:46 . 2008-06-20 17:46 245248 ------w- c:\windows\system32\dllcache\mswsock.dll 2008-06-20 17:46 . 2008-06-20 17:46 147968 ------w- c:\windows\system32\dllcache\dnsapi.dll 2008-06-20 11:51 . 2008-06-20 11:51 361600 ------w- c:\windows\system32\dllcache\tcpip.sys 2008-06-20 11:40 . 2008-08-14 10:04 138496 ------w- c:\windows\system32\dllcache\afd.sys 2008-06-20 11:08 . 2008-06-20 11:08 225856 ------w- c:\windows\system32\dllcache\tcpip6.sys 2008-06-17 19:02 . 2008-06-17 19:02 8461312 ------w- c:\windows\system32\dllcache\shell32.dll 2008-06-12 14:23 . 2008-06-12 14:23 956928 ------w- c:\windows\system32\dllcache\msdtctm.dll 2008-06-12 14:23 . 2008-06-12 14:23 91648 ------w- c:\windows\system32\dllcache\mtxoci.dll 2008-06-12 14:23 . 2008-06-12 14:23 66560 ------w- c:\windows\system32\dllcache\mtxclu.dll 2008-06-12 14:23 . 2008-06-12 14:23 58880 ------w- c:\windows\system32\dllcache\msdtclog.dll 2008-06-12 14:23 . 2008-06-12 14:23 428032 ------w- c:\windows\system32\dllcache\msdtcprx.dll 2008-06-12 14:23 . 2008-06-12 14:23 161792 ------w- c:\windows\system32\dllcache\msdtcuiu.dll 2008-06-10 21:19 . 2008-05-08 14:02 203136 ------w- c:\windows\system32\dllcache\rmcast.sys 2008-06-10 21:19 . 2008-06-13 11:05 272128 ------w- c:\windows\system32\dllcache\bthport.sys 2008-05-09 10:53 . 2008-05-09 10:53 90112 ------w- c:\windows\system32\dllcache\wshext.dll 2008-05-09 10:53 . 2008-05-09 10:53 430080 ------w- c:\windows\system32\dllcache\vbscript.dll 2008-05-09 10:53 . 2008-05-09 10:53 172032 ------w- c:\windows\system32\dllcache\scrrun.dll 2008-05-09 10:53 . 2008-05-09 10:53 512000 ------w- c:\windows\system32\dllcache\jscript.dll 2008-05-09 10:53 . 2008-05-09 10:53 180224 ------w- c:\windows\system32\dllcache\scrobj.dll 2008-05-08 11:24 . 2008-05-08 11:24 155648 ------w- c:\windows\system32\dllcache\wscript.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-10 00:29 . 2004-09-28 15:59 65336 ----a-w- c:\documents and settings\Mark Moore\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-04-01 14:34 . 2004-09-22 04:37 -------- d-----w- c:\program files\Java 2009-03-06 14:22 . 2002-08-29 10:00 284160 ----a-w- c:\windows\system32\pdh.dll 2009-02-20 18:09 . 2004-11-28 14:29 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-02-09 12:10 . 2004-03-30 01:48 729088 ----a-w- c:\windows\system32\lsasrv.dll 2009-02-09 12:10 . 2002-08-29 10:00 714752 ----a-w- c:\windows\system32\ntdll.dll 2009-02-09 12:10 . 2002-08-29 10:00 617472 ----a-w- c:\windows\system32\advapi32.dll 2009-02-09 12:10 . 2002-08-29 10:00 473600 ----a-w- c:\windows\system32\wbem\fastprox.dll 2009-02-09 12:10 . 2002-08-29 10:00 453120 ----a-w- c:\windows\system32\wbem\wmiprvsd.dll 2009-02-09 11:13 . 2002-08-29 10:00 1846784 ----a-w- c:\windows\system32\win32k.sys 2009-02-07 23:02 . 2002-08-29 10:00 2066048 ----a-w- c:\windows\system32\ntkrnlpa.exe 2009-02-06 11:11 . 2002-08-29 10:00 110592 ----a-w- c:\windows\system32\services.exe 2009-02-06 11:08 . 2002-08-29 10:00 2189056 ----a-w- c:\windows\system32\ntoskrnl.exe 2009-02-06 10:39 . 2002-08-29 10:00 35328 ----a-w- c:\windows\system32\sc.exe 2009-02-06 10:10 . 2002-08-29 10:00 227840 ----a-w- c:\windows\system32\wbem\wmiprvse.exe 2009-02-03 19:59 . 2002-08-29 10:00 56832 ----a-w- c:\windows\system32\secur32.dll 2008-12-11 10:57 . 2002-08-29 10:00 333952 ----a-w- c:\windows\system32\drivers\srv.sys 2008-12-05 06:54 . 2004-03-30 01:48 144896 ----a-w- c:\windows\system32\schannel.dll 2008-10-24 11:21 . 2002-08-29 10:00 455296 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2008-10-23 12:36 . 2004-03-30 01:48 286720 ----a-w- c:\windows\system32\gdi32.dll 2008-10-16 19:13 . 2002-08-29 10:00 1809944 ----a-w- c:\windows\system32\wuaueng.dll 2008-10-16 19:09 . 2002-08-29 10:00 92696 ----a-w- c:\windows\system32\cdm.dll 2008-10-16 19:09 . 2002-08-29 10:00 51224 ----a-w- c:\windows\system32\wuauclt.exe 2008-10-03 10:02 . 2002-08-29 10:00 247326 ----a-w- c:\windows\system32\strmdll.dll 2008-09-11 17:13 . 2004-09-22 04:43 -------- d--h--w- c:\program files\InstallShield Installation Information 2008-09-10 01:14 . 2008-09-09 00:02 1307648 ----a-w- c:\windows\system32\msxml6.dll 2008-09-09 05:29 . 2002-09-03 13:58 79063 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat 2008-09-08 18:30 . 2004-09-22 04:38 -------- d-----w- c:\program files\Dell 2008-09-04 17:15 . 2005-01-11 02:37 1106944 ----a-w- c:\windows\system32\msxml3.dll 2008-08-14 10:04 . 2002-08-29 10:00 138496 ----a-w- c:\windows\system32\drivers\afd.sys 2008-06-20 17:46 . 2002-08-29 10:00 245248 ----a-w- c:\windows\system32\mswsock.dll 2008-06-20 11:51 . 2002-08-29 10:00 361600 ----a-w- c:\windows\system32\drivers\tcpip.sys 2008-06-20 11:08 . 2002-08-29 10:00 225856 ----a-w- c:\windows\system32\drivers\tcpip6.sys 2008-06-13 11:05 . 2004-11-28 14:28 272128 ------w- c:\windows\system32\drivers\bthport.sys 2008-06-12 14:23 . 2004-03-06 02:16 956928 ----a-w- c:\windows\system32\msdtctm.dll 2008-06-12 14:23 . 2004-03-06 02:16 428032 ----a-w- c:\windows\system32\msdtcprx.dll 2008-06-12 14:23 . 2004-03-06 02:16 161792 ----a-w- c:\windows\system32\msdtcuiu.dll 2008-06-12 14:23 . 2002-08-29 10:00 58880 ----a-w- c:\windows\system32\msdtclog.dll 2008-06-10 11:11 . 2004-09-22 04:56 1053696 ----a-w- c:\windows\system32\WMNetmgr.dll 2008-06-10 08:11 . 2004-09-22 04:56 103936 ----a-w- c:\windows\system32\logagent.exe 2008-05-30 18:19 . 2008-09-10 23:44 507400 ----a-w- c:\windows\system32\XAudio2_1.dll 2008-05-30 18:18 . 2008-09-10 23:44 238088 ----a-w- c:\windows\system32\xactengine3_1.dll 2008-05-30 18:17 . 2008-09-10 23:44 65032 ----a-w- c:\windows\system32\XAPOFX1_0.dll 2008-05-30 18:17 . 2008-09-10 23:44 25608 ----a-w- c:\windows\system32\X3DAudio1_4.dll 2008-05-30 18:11 . 2008-09-10 23:44 467984 ----a-w- c:\windows\system32\d3dx10_38.dll 2008-05-30 18:11 . 2008-09-10 23:44 1491992 ----a-w- c:\windows\system32\D3DCompiler_38.dll 2008-05-30 18:11 . 2008-09-10 23:44 3850760 ----a-w- c:\windows\system32\D3DX9_38.dll 2008-05-09 10:53 . 2002-08-29 10:00 90112 ----a-w- c:\windows\system32\wshext.dll 2008-05-09 10:53 . 2002-08-29 10:00 430080 ----a-w- c:\windows\system32\vbscript.dll 2008-05-09 10:53 . 2002-08-29 10:00 172032 ----a-w- c:\windows\system32\scrrun.dll 2008-05-09 10:53 . 2002-08-29 10:00 180224 ----a-w- c:\windows\system32\scrobj.dll 2008-05-08 14:02 . 2002-08-29 10:00 203136 ----a-w- c:\windows\system32\drivers\rmcast.sys 2008-05-08 11:24 . 2002-08-29 10:00 155648 ----a-w- c:\windows\system32\wscript.exe 2008-05-07 09:07 . 2002-08-29 10:00 135168 ----a-w- c:\windows\system32\cscript.exe 2008-04-14 09:42 . 2004-11-28 14:30 11264 ------w- c:\windows\system32\spnpinst.exe 2008-04-14 09:42 . 2002-08-29 10:00 985088 ----a-w- c:\windows\system32\setupapi.dll 2008-04-14 09:41 . 2002-08-29 10:00 423936 ----a-w- c:\windows\system32\licdll.dll 2008-04-14 00:25 . 2002-08-29 10:00 1804 ----a-w- c:\windows\system32\dcache.bin 2008-04-14 00:16 . 2002-08-29 10:00 329728 ----a-w- c:\windows\system32\netsetup.exe 2008-04-14 00:13 . 2002-08-29 10:00 92424 ----a-w- c:\windows\system32\rdpdd.dll 2008-04-14 00:13 . 2002-08-29 10:00 87176 ----a-w- c:\windows\system32\rdpwsx.dll 2008-04-14 00:13 . 2002-08-29 10:00 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys 2008-04-14 00:13 . 2002-08-29 10:00 21896 ----a-w- c:\windows\system32\drivers\tdtcp.sys 2008-04-14 00:13 . 2002-08-29 10:00 12168 ----a-w- c:\windows\system32\tsddd.dll 2008-04-14 00:13 . 2002-08-29 10:00 12040 ----a-w- c:\windows\system32\drivers\tdpipe.sys 2008-04-14 00:13 . 2002-08-29 08:46 40840 ----a-w- c:\windows\system32\drivers\termdd.sys 2008-04-14 00:13 . 2004-09-22 04:56 299520 ----a-w- c:\windows\system32\drmclien.dll 2008-04-14 00:11 . 2005-01-11 02:37 151552 ----a-w- c:\windows\system32\msdart.dll 2008-04-14 00:10 . 2002-08-29 10:00 53279 ----a-w- c:\windows\system32\odbcji32.dll 2008-04-14 00:10 . 2002-08-29 10:00 4126 ----a-w- c:\windows\system32\msdxmlc.dll 2008-04-14 00:10 . 2002-08-29 10:00 3584 ----a-w- c:\windows\system32\msafd.dll 2008-04-13 21:00 . 2002-08-29 10:00 103424 ----a-w- c:\windows\system32\dpcdll.dll 2008-04-13 19:28 . 2002-08-29 10:00 175744 ----a-w- c:\windows\system32\drivers\rdbss.sys 2008-04-13 19:21 . 2002-08-29 10:00 162816 ----a-w- c:\windows\system32\drivers\netbt.sys 2008-04-13 19:20 . 2002-08-29 10:00 91520 ----a-w- c:\windows\system32\drivers\ndiswan.sys 2008-04-13 19:20 . 2002-08-29 10:00 182656 ----a-w- c:\windows\system32\drivers\ndis.sys 2008-04-13 19:19 . 2002-08-29 10:00 48384 ----a-w- c:\windows\system32\drivers\raspptp.sys 2008-04-13 19:19 . 2002-08-29 10:00 51328 ----a-w- c:\windows\system32\drivers\rasl2tp.sys 2008-04-13 19:19 . 2002-08-29 10:00 75264 ----a-w- c:\windows\system32\drivers\ipsec.sys 2008-04-13 19:19 . 2004-09-22 04:19 146048 ----a-w- c:\windows\system32\drivers\portcls.sys 2008-04-13 19:18 . 2002-08-29 10:00 52480 ----a-w- c:\windows\system32\drivers\i8042prt.sys 2008-04-13 19:17 . 2004-09-22 04:20 83072 ----a-w- c:\windows\system32\drivers\wdmaud.sys 2008-04-13 19:17 . 2002-08-29 10:00 105344 ----a-w- c:\windows\system32\drivers\mup.sys 2008-04-13 19:16 . 2002-12-12 05:14 141056 ----a-w- c:\windows\system32\drivers\ks.sys 2008-04-13 19:16 . 2002-08-29 10:00 49536 ----a-w- c:\windows\system32\drivers\classpnp.sys 2008-04-13 19:15 . 2004-09-22 04:20 60800 ----a-w- c:\windows\system32\drivers\sysaudio.sys 2008-04-13 19:15 . 2002-08-29 10:00 574976 ----a-w- c:\windows\system32\drivers\ntfs.sys 2008-04-13 19:15 . 2002-08-29 10:00 64512 ----a-w- c:\windows\system32\drivers\serial.sys 2008-04-13 19:14 . 2002-08-29 10:00 143744 ----a-w- c:\windows\system32\drivers\fastfat.sys 2008-04-13 19:14 . 2002-08-29 10:00 63744 ----a-w- c:\windows\system32\drivers\cdfs.sys 2008-04-13 19:00 . 2002-08-29 10:00 30080 ----a-w- c:\windows\system32\drivers\modem.sys 2008-04-13 19:00 . 2002-08-29 10:00 19072 ----a-w- c:\windows\system32\drivers\tdi.sys 2008-04-13 18:57 . 2002-08-29 10:00 41472 ----a-w- c:\windows\system32\drivers\raspppoe.sys 2008-04-13 18:57 . 2002-08-29 10:00 40576 ----a-w- c:\windows\system32\drivers\ndproxy.sys 2008-04-13 18:57 . 2002-08-29 10:00 14336 ----a-w- c:\windows\system32\drivers\asyncmac.sys 2008-04-13 18:57 . 2002-08-29 10:00 10112 ----a-w- c:\windows\system32\drivers\ndistapi.sys 2008-04-13 18:57 . 2002-08-29 10:00 34560 ----a-w- c:\windows\system32\drivers\wanarp.sys 2008-04-13 18:57 . 2002-08-29 10:00 152832 ----a-w- c:\windows\system32\drivers\ipnat.sys 2008-04-13 18:57 . 2002-08-29 10:00 20864 ----a-w- c:\windows\system32\drivers\ipinip.sys 2008-04-13 18:56 . 2004-11-28 14:31 12800 ------w- c:\windows\system32\drivers\usb8023x.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 200704] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "PhotoShow Deluxe Media Manager"="c:\progra~1\SIMPLE~1\PHOTOS~1\data\xtras\mssysmgr.exe" [2005-02-01 163840] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-04 39408] "Intelinet"="c:\program files\Intelinet\Intelinet.exe" [2009-04-28 7480600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-13 98304] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-14 536576] "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-03-15 122933] "UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592] "PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-12 290816] "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 53248] "mmtask"="c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2004-04-19 53248] "MMTray"="c:\program files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe" [2004-04-19 131072] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688] "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-08 185896] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-01 1392640] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-03-11 936960] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-06 177472] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Acrobat Assistant.lnk - c:\program files\Adobe\Adobe Acrobat 6.0 CE\Distillr\acrotray.exe [2003-7-17 217180] Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-10-13 110592] DataViz Inc Messenger.lnk - c:\program files\Common Files\DataViz\DvzIncMsgr.exe [2006-5-31 28672] Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2004-9-21 24576] HotSync Manager.lnk - c:\program files\palmOne\Hotsync.exe [2004-6-9 471040] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664] HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-28 53248] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-12 83360] NkvMon.exe.lnk - c:\program files\Nikon\NkView6\NkvMon.exe [2004-11-3 241664] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\EXPOCAD\\Program\\Cadvance.exe"= "c:\\WINDOWS\\SYSTEM32\\spoolsv.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\SYSTEM32\\dpvsetup.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R0 pavboot;pavboot;c:\windows\SYSTEM32\DRIVERS\pavboot.sys [9/8/2008 9:53 PM 28544] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [9/18/2008 9:30 PM 210216] S2 gupdate1c9b574f47a2d4c;Google Update Service (gupdate1c9b574f47a2d4c);c:\program files\Google\Update\GoogleUpdate.exe [4/4/2009 5:30 PM 133104] S3 ACGPRS;Sierra Wireless 3G Adapter;c:\windows\SYSTEM32\DRIVERS\acgprs.sys [9/19/2005 4:17 PM 88192] S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [9/16/2008 11:54 PM 33752] S3 Nikon1394;Nikon1394Driver;c:\windows\SYSTEM32\DRIVERS\NikonDx.sys [7/4/2006 9:26 AM 106172] S3 SDTHOOK;SDTHOOK;c:\windows\SYSTEM32\DRIVERS\SDTHOOK.SYS [3/13/2008 10:32 AM 44928] S3 SQTECH907B;EZCam(PID_907B_00);c:\windows\SYSTEM32\DRIVERS\Capt907B.sys [1/27/2007 6:37 PM 61643] . Contents of the 'Scheduled Tasks' folder 2009-04-21 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] 2002-01-08 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-10-28 22:26] 2002-01-08 c:\windows\Tasks\GoogleUpdateTaskMachine.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-04-04 22:29] 2009-04-15 c:\windows\Tasks\McDefragTask.job - c:\windows\system32\defrag.exe [2002-08-29 00:12] 2008-07-01 c:\windows\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2006-10-14 15:53] . - - - - ORPHANS REMOVED - - - - SSODL-VolumeComponent-{b1aed209-5cf2-4013-9235-999f7ff1ae4a} - (no file) SafeBoot-procexp90.Sys . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ uInternet Settings,ProxyOverride = <local>;.local IE: RemindU. - file://c:\program files\Upromise_Remind_U\UpromisesRemindU\UpromisetRemindU\uproC0.htm LSP: bmnet.dll FF - ProfilePath - c:\documents and settings\Mark Moore\Application Data\Mozilla\Firefox\Profiles\0xs7t934.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll ---- FIREFOX POLICIES ---- FF - user.js: yahoo.homepage.dontask - true. *********************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2002-01-07 22:43 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(816) c:\windows\System32\BCMLogon.dll - - - - - - - > 'lsass.exe'(872) c:\windows\system32\bmnet.dll - - - - - - - > 'explorer.exe'(2940) c:\windows\system32\SynTPFcs.dll c:\program files\McAfee\SiteAdvisor\saHook.dll . Completion time: 2002-01-08 22:48 ComboFix-quarantined-files.txt 2002-01-08 03:47 ComboFix2.txt 2008-04-06 06:36 ComboFix3.txt 2008-04-06 03:54 Pre-Run: 22,578,216,960 bytes free Post-Run: 23,027,326,976 bytes free 369 --- E O F --- 2009-05-13 21:16

06-09-2009, 09:49 AM	#8 (permalink)
dispixie3 Registered User Join Date: Mar 2008 Posts: 20 OS: xp	Re: Need help, some various problems ooooookaaaaaaay, I really do not know!!!! I just went in and changed it! Is that the root of my problem? I know some updates just popped up, so I'll do those.

06-09-2009, 10:43 AM	#9 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,582 OS: XP SP3	Re: Need help, some various problems Hello again, Kimberly. Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Please uninstall the following via Start->(or My Computer)->Control Panel->Add or Remove Programs if it still exists: Intelinet 3.1.0<<Please read this If it fails to uninstall, just continue. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the codebox below into Notepad: Code: http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/382095-need-help-some-various-problems.html#post2178723 Collect:: c:\program files\Intelinet\Intelinet.exe Folder:: c:\program files\Intelinet Registry:: [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000000 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\WINDOWS\\SYSTEM32\\spoolsv.exe"=- Save this Notepad file as CFScript.txt to your Desktop and then close the file. Referring to the picture above, drag CFScript onto ComboFix If you are prompted to update ComboFix and have an internet connection, please choose Yes Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. ------------------------------------------------------ Note When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis. Ensure you are connected to the internet and click OK on the message box. If you do not get a message box, please do the following: There should be a file named [4]-Submit_date@time.zip with today's date, located here: C:\QooBox\Quarantine\[4]-Submit_date@time.zip Using the 'Browse' button, please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4 Please let me know if you successfully submitted the file. Thanks. ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

06-10-2009, 04:30 AM	#11 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,582 OS: XP SP3	Re: Need help, some various problems Hello again, Kimberly. Please tell us how your system is behaving. Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs): Java(TM) 6 Update 7 These are all outdated, and security risks by having them installed still. Leave this one as it has the latest definitions: Java(TM) 6 Update 13 Going forward, Java will overwrite existing installs, so removing older versions should not be required after this. When updating in the future, make sure you untick the box next to Yahoo Toolbar for Firefox/Mozilla or MSN Toolbar unless you want it. ------------------------------------------------------ Please download ATF-Cleaner by Atribune and Save it to your Desktop. Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions. Click Run at any Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes. Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined. Click View scan report at the bottom. Click the Save Report As... button. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply. Note To optimize scanning time and produce a more sensible report for review: Close any open programs. Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan. Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%. ------------------------------------------------------ Please post the following in your next reply: Kaspersky report report on system behavior __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

06-10-2009, 04:31 AM	#12 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,582 OS: XP SP3	Re: Need help, some various problems Hello again, Kimberly. Please tell us how your system is behaving. Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs): Java(TM) 6 Update 7 These are all outdated, and security risks by having them installed still. Leave this one as it has the latest definitions: Java(TM) 6 Update 13 Going forward, Java will overwrite existing installs, so removing older versions should not be required after this. When updating in the future, make sure you untick the box next to Yahoo Toolbar for Firefox/Mozilla or MSN Toolbar unless you want it. ------------------------------------------------------ Please download ATF-Cleaner by Atribune and Save it to your Desktop. Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions. Click Run at any Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes. Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined. Click View scan report at the bottom. Click the Save Report As... button. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply. Note To optimize scanning time and produce a more sensible report for review: Close any open programs. Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan. Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%. ------------------------------------------------------ Please post the following in your next reply: Kaspersky report report on system behavior __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

06-11-2009, 09:47 AM	#13 (permalink)
dispixie3 Registered User Join Date: Mar 2008 Posts: 20 OS: xp	Re: Need help, some various problems system seems to be better. I'll try a couple of things. In the meantime, I took care of the Java and ATF. Kaspersky follows: KASPERSKY ONLINE SCANNER 7.0 REPORT Thursday, June 11, 2009 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Thursday, June 11, 2009 12:15:25 Records in database: 2336989 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 133484 Threat name: 1 Infected objects: 3 Suspicious objects: 0 Duration of the scan: 04:14:15 File name / Threat name / Threats count C:\Documents and Settings\Mark Moore\Desktop\setup(2).exe Infected: not-a-virus:FraudTool.Win32.Agent.dx 1 C:\Documents and Settings\Mark Moore\Desktop\setup.exe Infected: not-a-virus:FraudTool.Win32.Agent.dx 1 C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP415\A0141757.exe Infected: not-a-virus:FraudTool.Win32.Agent.dx 1 The selected area was scanned.

06-11-2009, 09:53 AM	#14 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,582 OS: XP SP3	Re: Need help, some various problems Hello again, Kimberly. System Volume Information is where Windows keeps old system restore points. That will get deleted when we uninstall ComboFix. Open Notepad and copy/paste the entire contents of the codebox below into Notepad: Code: @echo off if exist "%temp%\log.txt" del "%temp%\log.txt" for %%g in ( "C:\Documents and Settings\Mark Moore\Desktop\setup(2).exe" "C:\Documents and Settings\Mark Moore\Desktop\setup.exe" ) do ( del /a/f/q %%g >nul 2>&1 if exist %%g echo.%%~g>>"%temp%\log.txt" ) if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt" ) else echo.Deleted Successfully !! pause del %0 Save this Notepad file as fix.bat and choose to Save as type: - All Files then close the Notepad file. It should look like this: Double-click on fix.bat to run it. Tell me what it says in your next reply. Press any key to continue. ------------------------------------------------------ __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

06-11-2009, 08:10 PM	#15 (permalink)
dispixie3 Registered User Join Date: Mar 2008 Posts: 20 OS: xp	Re: Need help, some various problems Sorry it happened so quick. There was one sentence that said something "deleted".

06-11-2009, 08:40 PM	#16 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,582 OS: XP SP3	Re: Need help, some various problems Congratulations. Well done! Your logs appear clean. You should be good to go. As far as those infected objects listed in the Kaspersky report, those are safely tucked away in ComboFix's quarantine folder or in old System Restore Points, which we will be taking care of now. Please disable McAfee before uninstalling ComboFix and then re-enable it after doing so. Go to Start >> Run and Copy/Paste the following single-line command into the Run box and click OK: combofix /u This will uninstall ComboFix and delete ComboFix's quarantine folder. It will also implement some cleanup procedures, remove old System Restore Points which contain previous infections, and create a fresh, clean System Restore Point. Please re-enable your antivirus program and any other antispyware programs disabled earlier if you haven't already. You can safely delete any tools downloaded or any logs, files, and any shortcuts on your desktop that were created during this fix. ------------------------------------------------------ MICROSOFT UPDATES It is very important that you get all of the critical updates for your Operating System and Internet Explorer. Keeping your OS and browser up to date will help make you less susceptible to attacks by Trojans and viruses. Please go to Microsoft and download all the critical updates to help prevent possible re-infection. SPYWARE PREVENTION This is a good time to set up protection against further attacks. In light of your recent problem, I'm sure you'd like to avoid any future infections. Please read these well written articles: How Did I Get Infected In The First Place? by TonyKlein How to Prevent Malware by miekiemoes To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware, or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites: Green to go Yellow for caution Red to stop WOT has an add-on available for both Firefox and IE. SpywareBlaster prevents the installation of ActiveX-based malware, blocks cookies, and restricts the actions of "bad" sites in Internet Explorer. See tutorial here MVPS HOSTS FILE replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. It basically prevents your computer from connecting to those sites by redirecting the attempted connections to 127.0.0.1, which is the IP of your local computer. See guide here and for Windows Vista here Download Host.zip and Save it to your Desktop. Right-click hosts.zip and select 'Extract all files' or 'Extract files...'. Follow the prompts and click 'Finish'. This will open the newly created hosts folder on your Desktop. Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine. Once updated you should see another prompt that the task was completed. IE-Spyad is another excellent program that places over 5000 dubious websites and domains in the IE Restricted list, which will help prevent attempts to infect your system. It basically prevents any downloads from the sites listed, although you will still be able to connect to the site. See tutorial here Keep your antivirus program and antispyware programs updated and scan with them on a regular basis. Please respond to this thread one more time so we can mark this thread as resolved. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

06-12-2009, 01:54 PM	#17 (permalink)
dispixie3 Registered User Join Date: Mar 2008 Posts: 20 OS: xp	Re: Need help, some various problems I'm all good. Thank You Kimberly

06-12-2009, 07:57 PM	#18 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,582 OS: XP SP3	Re: Need help, some various problems You're welcome, Kimberly! Glad to have helped. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE