Jump to content

Change Mode

Requested to Post Here


Recommended Posts

Jon Tom said

 

Hello kensob

 

You had some very nasty stuff on your machine (Backdoors and Rootkits). It may be the case that there are still a few things that need to be taken care of.

 

If I were you I would create a thread in the HJT forum and ask the good people there to check your system:

 

http://forums.pcpitstop.com/index.php?showforum=25

 

Include a link to this thread or alternatively post the MBAM log in the new thread.

 

Then wait for a Trusted HJT Advisor to get in touch. They will ask you to perform some system scans and then advise you if anything else needs to be done.

 

JonTom

 

 

Here are the results of the scan.

 

Malwarebytes' Anti-Malware 1.45

www.malwarebytes.org

 

Database version: 4021

 

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

 

4/22/2010 8:38:59 AM

mbam-log-2010-04-22 (08-38-59).txt

 

Scan type: Quick scan

Objects scanned: 113818

Time elapsed: 8 minute(s), 41 second(s)

 

Memory Processes Infected: 1

Memory Modules Infected: 1

Registry Keys Infected: 8

Registry Values Infected: 2

Registry Data Items Infected: 3

Folders Infected: 0

Files Infected: 7

 

Memory Processes Infected:

C:\Documents and Settings\MYNAME\Local Settings\Application Data\vma.exe (Rogue.MultipleAV) -> Unloaded process successfully.

 

Memory Modules Infected:

c:\WINDOWS\system32\6to4v32.dll (Backdoor.Bot) -> Delete on reboot.

 

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6to4 (Backdoor.Bot) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{98279c38-de4b-4bcf-93c9-8ec26069d6f4} (Adware.SelectRebates) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\PRAGMA (Rootkit.TDSS) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\YVIBBBHA8C (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\B1RQJ7YJ0U (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\QZAIB7KITK (Trojan.FakeAlert) -> Quarantined and deleted successfully.

 

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{98279c38-de4b-4bcf-93c9-8ec26069d6f4} (Adware.SelectRebates) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully.

 

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 93.188.162.185,93.188.161.153 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{252e4288-fd55-4506-a456-9208c6be7cc8}\NameServer (Trojan.DNSChanger) -> Data: 93.188.162.185,93.188.161.153 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{c6bef952-dc8f-4435-8004-795aa3183414}\NameServer (Trojan.DNSChanger) -> Data: 93.188.162.185,93.188.161.153 -> Quarantined and deleted successfully.

 

Folders Infected:

(No malicious items detected)

 

Files Infected:

c:\WINDOWS\system32\6to4v32.dll (Backdoor.Bot) -> Delete on reboot.

C:\Program Files\Internet Explorer\ws2_32.dll (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\scsichk.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\Jpadia.exe (Trojan.CodecPack) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Favorites\_favdata.dat (Malware.Trace) -> Quarantined and deleted successfully.

C:\Documents and Settings\MYNAME\Local Settings\Application Data\vma.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\certstore.dat (Trojan.Agent) -> Quarantined and deleted successfully.

Link to post
Share on other sites

Hello, kensob

Welcome to the PCPitstop Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.

 

 

 

Please take note of some guidelines for this fix:

  • Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
  • If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
  • Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
  • Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Please set your system to show all files.

    Click Start, open My Computer, select the Tools menu and click Folder Options.

    Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.

    Uncheck: Hide file extensions for known file types

    Uncheck the Hide protected operating system files (recommended) option.

    Click Yes to confirm.

 

 

  • Please download OTL from one of the following mirrors:
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Under the Custom Scan box paste this in

    netsvcs

    %SYSTEMDRIVE%\*.exe

    /md5start

    eventlog.dll

    scecli.dll

    netlogon.dll

    cngaudit.dll

    sceclt.dll

    ntelogon.dll

    logevent.dll

    iaStor.sys

    nvstor.sys

    atapi.sys

    IdeChnDr.sys

    viasraid.sys

    AGP440.sys

    vaxscsi.sys

    nvatabus.sys

    viamraid.sys

    nvata.sys

    nvgts.sys

    iastorv.sys

    ViPrt.sys

    eNetHook.dll

    ahcix86.sys

    KR10N.sys

    /md5stop

    %systemroot%\*. /mp /s

    CREATERESTOREPOINT

  • Push the Quick Scan button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

 

 

 

Download GMER from Here. Note the file's name and save it to your root folder, such as C:\.

  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
  • Click on this link to see a list of programs that should be disabled.
  • Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
  • Allow the driver to load if asked.
  • You may be prompted to scan immediately if it detects rootkit activity.
  • If you are prompted to scan your system click "No", save the log and post back the results.
  • If not prompted, click the "Rootkit/Malware" tab.
  • On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
  • Select all drives that are connected to your system to be scanned.
  • Click the Scan button to begin. (Please be patient as it can take some time to complete)
  • When the scan is finished, click Save to save the scan results to your Desktop.
  • Save the file as Results.log and copy/paste the contents in your next reply.
  • Exit the program and re-enable all active protection when done.
Link to post
Share on other sites

Hello, kensob

Welcome to the PCPitstop Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems.

Please take note of some guidelines for this fix:

  • Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix.
  • If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken.
  • Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself.
  • Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Please set your system to show all files.

    Click Start, open My Computer, select the Tools menu and click Folder Options.

    Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.

    Uncheck: Hide file extensions for known file types

    Uncheck the Hide protected operating system files (recommended) option.

    Click Yes to confirm.

  • Please download OTL from one of the following mirrors:
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Under the Custom Scan box paste this in

    netsvcs

    %SYSTEMDRIVE%\*.exe

    /md5start

    eventlog.dll

    scecli.dll

    netlogon.dll

    cngaudit.dll

    sceclt.dll

    ntelogon.dll

    logevent.dll

    iaStor.sys

    nvstor.sys

    atapi.sys

    IdeChnDr.sys

    viasraid.sys

    AGP440.sys

    vaxscsi.sys

    nvatabus.sys

    viamraid.sys

    nvata.sys

    nvgts.sys

    iastorv.sys

    ViPrt.sys

    eNetHook.dll

    ahcix86.sys

    KR10N.sys

    /md5stop

    %systemroot%\*. /mp /s

    CREATERESTOREPOINT

  • Push the Quick Scan button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extra.txt <-- Will be minimized
Download GMER from Here. Note the file's name and save it to your root folder, such as C:\.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security program drivers will not conflict with this file.
  • Click on this link to see a list of programs that should be disabled.
  • Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator")
  • Allow the driver to load if asked.
  • You may be prompted to scan immediately if it detects rootkit activity.
  • If you are prompted to scan your system click "No", save the log and post back the results.
  • If not prompted, click the "Rootkit/Malware" tab.
  • On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked.
  • Select all drives that are connected to your system to be scanned.
  • Click the Scan button to begin. (Please be patient as it can take some time to complete)
  • When the scan is finished, click Save to save the scan results to your Desktop.
  • Save the file as Results.log and copy/paste the contents in your next reply.
  • Exit the program and re-enable all active protection when done.
Link to post
Share on other sites

OTL logfile created on: 4/24/2010 10:33:53 PM - Run 1

OTL by OldTimer - Version 3.2.2.0 Folder = C:\Documents and Settings\KSOBECKI\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 51.00% Memory free

4.00 Gb Paging File | 3.00 Gb Available in Paging File | 78.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 231.87 Gb Total Space | 199.23 Gb Free Space | 85.92% Space Free | Partition Type: NTFS

Drive D: | 1.00 Gb Total Space | 0.97 Gb Free Space | 97.24% Space Free | Partition Type: FAT32

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: KENHPLT

Current User Name: KSOBECKI

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

 

========== Processes (SafeList) ==========

 

PRC - [2010/04/24 22:12:17 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe

PRC - [2010/02/11 15:36:12 | 000,300,400 | ---- | M] (Eastman Kodak Company) -- C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe

PRC - [2010/02/08 12:09:00 | 001,634,304 | ---- | M] (Eastman Kodak Company) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe

PRC - [2009/02/26 15:07:10 | 001,443,144 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe

PRC - [2009/02/26 15:07:08 | 001,799,496 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

PRC - [2009/02/01 23:37:00 | 002,440,120 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

PRC - [2008/12/18 16:47:22 | 000,115,560 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe

PRC - [2008/12/18 16:46:30 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

PRC - [2008/06/02 13:32:16 | 000,018,944 | ---- | M] (Hewlett-Packard Development Company, L.P) -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe

PRC - [2008/05/30 12:36:20 | 000,256,512 | ---- | M] (SafeBoot International) -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe

PRC - [2008/05/20 20:47:18 | 000,065,296 | ---- | M] (Bioscrypt Inc.) -- c:\Program Files\Hewlett-Packard\IAM\Bin\asghost.exe

PRC - [2008/05/15 18:11:12 | 001,176,824 | ---- | M] (AuthenTec, Inc.) -- c:\Program Files\Fingerprint Sensor\AtService.exe

PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2008/04/04 11:09:56 | 001,044,480 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe

PRC - [2007/12/11 15:15:04 | 000,012,800 | ---- | M] (Agere Systems) -- C:\WINDOWS\system32\agrsmsvc.exe

PRC - [2007/05/15 19:08:40 | 000,182,576 | ---- | M] (ActivIdentity) -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe

 

 

========== Modules (SafeList) ==========

 

MOD - [2010/04/24 22:12:17 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe

MOD - [2008/03/25 08:17:04 | 000,076,048 | ---- | M] (Bioscrypt Inc.) -- C:\WINDOWS\system32\APSHook.dll

 

 

========== Win32 Services (SafeList) ==========

 

SRV - [2010/02/11 15:36:12 | 000,300,400 | ---- | M] (Eastman Kodak Company) [Auto | Running] -- C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe -- (Kodak AiO Network Discovery Service)

SRV - [2009/02/26 15:07:08 | 001,799,496 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService)

SRV - [2009/02/01 23:37:00 | 002,440,120 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus)

SRV - [2009/02/01 21:43:02 | 000,320,840 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE -- (SNAC)

SRV - [2008/12/18 16:46:30 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (EraserSvc10923)

SRV - [2008/12/18 16:46:30 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)

SRV - [2008/12/18 16:46:30 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)

SRV - [2008/12/10 15:46:58 | 003,093,880 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)

SRV - [2008/06/02 13:32:16 | 000,018,944 | ---- | M] (Hewlett-Packard Development Company, L.P) [Auto | Running] -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe -- (HP ProtectTools Service)

SRV - [2008/05/30 12:36:20 | 000,256,512 | ---- | M] (SafeBoot International) [Auto | Running] -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe -- (HpFkCryptService)

SRV - [2008/05/20 20:42:40 | 000,111,888 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll -- (ASBroker)

SRV - [2008/05/20 20:42:34 | 000,137,488 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASChnl.dll -- (ASChannel)

SRV - [2008/05/15 18:11:12 | 001,176,824 | ---- | M] (AuthenTec, Inc.) [Auto | Running] -- c:\Program Files\Fingerprint Sensor\AtService.exe -- (ATService)

SRV - [2007/12/11 15:15:04 | 000,012,800 | ---- | M] (Agere Systems) [Auto | Running] -- C:\WINDOWS\system32\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2007/05/15 19:08:40 | 000,182,576 | ---- | M] (ActivIdentity) [Auto | Running] -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe -- (accoca)

SRV - [2006/01/06 15:07:26 | 000,077,824 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\hphipm11.exe -- (Pml Driver HPH11)

 

 

========== Driver Services (SafeList) ==========

 

DRV - [2010/04/24 22:29:16 | 000,024,064 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfaudio.sys -- (SFAUDIO)

DRV - [2010/02/16 05:00:00 | 001,324,720 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100424.020\NAVEX15.SYS -- (NAVEX15)

DRV - [2010/02/16 05:00:00 | 000,084,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100424.020\NAVENG.SYS -- (NAVENG)

DRV - [2009/08/27 04:00:00 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)

DRV - [2009/08/27 04:00:00 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)

DRV - [2009/03/23 12:32:31 | 000,123,952 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)

DRV - [2008/12/19 15:08:12 | 000,319,792 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\srtspl.sys -- (SRTSPL)

DRV - [2008/12/19 15:08:12 | 000,280,112 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\srtsp.sys -- (SRTSP)

DRV - [2008/12/19 15:08:12 | 000,043,824 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srtspx.sys -- (SRTSPX)

DRV - [2008/09/09 14:54:42 | 000,421,424 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)

DRV - [2008/08/21 11:13:56 | 000,191,536 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)

DRV - [2008/08/21 11:13:56 | 000,027,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)

DRV - [2008/05/30 12:37:06 | 000,051,376 | ---- | M] (SafeBoot N.V.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SbAlg.sys -- (SbAlg)

DRV - [2008/05/30 12:37:02 | 000,012,928 | ---- | M] (SafeBoot International) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\SbFsLock.sys -- (SbFsLock)

DRV - [2008/05/30 12:37:00 | 000,012,496 | ---- | M] (SafeBoot International) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\rsvlock.sys -- (RsvLock)

DRV - [2008/05/30 12:36:58 | 000,108,752 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SafeBoot.sys -- (SafeBoot)

DRV - [2008/05/27 09:55:48 | 000,174,600 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\ahcix86.sys -- (ahcix86)

DRV - [2008/05/23 09:51:02 | 000,024,624 | ---- | M] (Hewlett-Packard Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\hpdskflt.sys -- (hpdskflt)

DRV - [2008/05/23 09:50:16 | 000,028,592 | ---- | M] (Hewlett-Packard Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Accelerometer.sys -- (Accelerometer)

DRV - [2008/05/15 20:33:44 | 002,881,536 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2008/05/15 16:29:32 | 000,475,520 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATSwpWDF.sys -- (ATSwpWDF)

DRV - [2008/05/08 10:02:52 | 000,203,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rmcast.sys -- (RMCAST)

DRV - [2008/04/28 18:22:10 | 000,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey)

DRV - [2008/04/13 14:40:50 | 000,149,376 | ---- | M] (M-Systems) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\tffsport.sys -- (tffsport)

DRV - [2008/04/13 14:39:44 | 000,092,544 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mqac.sys -- (MQAC)

DRV - [2008/04/13 12:36:05 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)

DRV - [2008/04/11 12:19:42 | 000,338,944 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService)

DRV - [2008/04/10 17:27:34 | 001,804,160 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)

DRV - [2008/03/27 14:14:06 | 000,224,672 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)

DRV - [2008/03/21 14:35:14 | 001,287,552 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)

DRV - [2008/03/12 11:43:26 | 000,015,416 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Amddfltr.sys -- (Amddfltr)

DRV - [2008/02/29 19:13:38 | 001,202,560 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2007/11/29 14:35:44 | 000,163,328 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) Broadcom NetLink

DRV - [2007/06/18 20:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)

DRV - [2007/04/16 19:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)

DRV - [2007/04/04 15:16:20 | 000,041,216 | ---- | M] (Infineon Technologies AG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ifxtpm.sys -- (IFXTPM)

DRV - [2006/01/06 15:07:27 | 000,018,928 | ---- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hphius11.sys -- (Dot4Usb HPH11)

DRV - [2006/01/06 15:07:27 | 000,016,112 | ---- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hphipr11.sys -- (Dot4Print HPH11)

DRV - [2006/01/06 15:07:26 | 000,050,896 | ---- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hphid411.sys -- (Dot4 HPH11)

DRV - [2001/08/17 15:10:28 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)

DRV - [2001/08/17 11:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

FF - HKLM\software\mozilla\Firefox\Extensions\\{E3278AD6-FAF3-496F-906E-18B81B7B083E}: C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\{E3278AD6-FAF3-496F-906E-18B81B7B083E} [2010/04/20 15:40:35 | 000,000,000 | ---D | M]

 

[2010/04/22 10:12:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Extensions

[2010/01/05 13:08:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Extensions\[email protected]

 

O1 HOSTS File: ([2010/04/22 10:32:41 | 000,392,702 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: 127.0.0.1 www.007guard.com

O1 - Hosts: 127.0.0.1 007guard.com

O1 - Hosts: 127.0.0.1 008i.com

O1 - Hosts: 127.0.0.1 www.008k.com

O1 - Hosts: 127.0.0.1 008k.com

O1 - Hosts: 127.0.0.1 www.00hq.com

O1 - Hosts: 127.0.0.1 00hq.com

O1 - Hosts: 127.0.0.1 010402.com

O1 - Hosts: 127.0.0.1 www.032439.com

O1 - Hosts: 127.0.0.1 032439.com

O1 - Hosts: 127.0.0.1 www.0scan.com

O1 - Hosts: 127.0.0.1 0scan.com

O1 - Hosts: 127.0.0.1 1000gratisproben.com

O1 - Hosts: 127.0.0.1 www.1000gratisproben.com

O1 - Hosts: 127.0.0.1 1001namen.com

O1 - Hosts: 127.0.0.1 www.1001namen.com

O1 - Hosts: 127.0.0.1 100888290cs.com

O1 - Hosts: 127.0.0.1 www.100888290cs.com

O1 - Hosts: 127.0.0.1 www.100sexlinks.com

O1 - Hosts: 127.0.0.1 100sexlinks.com

O1 - Hosts: 127.0.0.1 10sek.com

O1 - Hosts: 127.0.0.1 www.10sek.com

O1 - Hosts: 127.0.0.1 www.1-2005-search.com

O1 - Hosts: 127.0.0.1 1-2005-search.com

O1 - Hosts: 13564 more lines...

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.

O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)

O4 - HKLM..\Run: [Conime] C:\WINDOWS\system32\conime.exe (Microsoft Corporation)

O4 - HKLM..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\Cpqset.exe ()

O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)

O4 - HKLM..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)

O4 - HKLM..\Run: [startCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll (Apple Inc.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1237572595955 (MUWebControl Class)

O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0...oUploader55.cab (Facebook Photo Uploader 5 Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14)

O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (APSHook.dll) - C:\WINDOWS\System32\APSHook.dll (Bioscrypt Inc.)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\ackpbsc: DllName - c:\WINDOWS\system32\ackpbsc.dll - C:\WINDOWS\system32\ackpbsc.dll (ActivIdentity)

O20 - Winlogon\Notify\acunlock: DllName - c:\Program Files\ActivIdentity\ActivClient\acunlock.dll - c:\Program Files\ActivIdentity\ActivClient\acunlock.dll (ActivIdentity)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O20 - Winlogon\Notify\OneCard: DllName - c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll - c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll (Bioscrypt Inc.)

O24 - Desktop BackupWallPaper: C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

NetSvcs: 6to4 - File not found

NetSvcs: Ias - C:\WINDOWS\system32\ias [2008/06/21 23:26:35 | 000,000,000 | ---D | M]

NetSvcs: Iprip - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

NetSvcs: SSHNAS - File not found

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point (69256455022182400)

 

========== Files/Folders - Created Within 90 Days ==========

 

[2010/04/24 22:12:12 | 000,562,688 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe

[2010/04/24 22:07:13 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\KSOBECKI\Recent

[2010/04/23 10:23:51 | 000,409,600 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJ5000MON.dll

[2010/04/23 10:23:51 | 000,131,072 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJCOINST07.dll

[2010/04/23 10:22:08 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 6.0

[2010/04/22 10:50:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple Computer

[2010/04/22 08:28:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Application Data\Malwarebytes

[2010/04/22 08:27:53 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/04/22 08:27:51 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/04/22 08:27:51 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010/04/22 08:27:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2010/04/22 08:15:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe

[2010/04/21 08:46:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun

[2010/04/20 15:46:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia

[2010/04/20 15:40:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\{E3278AD6-FAF3-496F-906E-18B81B7B083E}

[2010/04/20 15:10:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe

[2010/04/20 15:05:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Application Data\F0C8A70282C3527304FD7E600530EA1C

[2010/04/12 15:54:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Application Data\pdf995

[2010/04/12 15:50:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\pdf995

[2010/04/12 15:50:39 | 000,249,856 | ---- | C] (TODO: <Company name>) -- C:\WINDOWS\System32\pdfmona.dll

[2010/04/08 19:53:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Mozilla

[2010/03/30 16:37:08 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime

[2010/03/30 16:37:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple Computer

[2010/03/21 17:44:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Application Data\Apple Computer

[2010/03/21 08:50:49 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple

[2010/03/21 08:50:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Apple

[2010/03/21 08:50:21 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update

[2010/03/21 08:50:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Apple Computer

[2010/03/07 21:16:43 | 000,000,000 | ---D | C] -- C:\Program Files\DeductionPro 2009

[2010/03/07 21:14:36 | 000,000,000 | ---D | C] -- C:\Program Files\HRBlock2009

[2010/03/01 09:02:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Eastman_Kodak_Company

[2010/03/01 08:56:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\KODAK

[2010/03/01 08:56:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Eastman Kodak Company

[2010/03/01 08:54:17 | 000,000,000 | ---D | C] -- C:\Program Files\Kodak

[2009/03/20 20:16:56 | 000,180,224 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll

[2007/07/05 04:28:52 | 000,176,128 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 

========== Files - Modified Within 90 Days ==========

 

[2010/04/24 22:31:02 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/04/24 22:30:16 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010/04/24 22:30:06 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/04/24 22:29:44 | 1875,759,104 | -HS- | M] () -- C:\hiberfil.sys

[2010/04/24 22:29:16 | 000,024,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\sfaudio.sys

[2010/04/24 22:16:06 | 000,293,376 | ---- | M] () -- C:\nvmx55zj.exe

[2010/04/24 22:12:17 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe

[2010/04/23 17:43:16 | 006,815,744 | -H-- | M] () -- C:\Documents and Settings\KSOBECKI\NTUSER.DAT

[2010/04/23 16:56:40 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\ntuser.ini

[2010/04/23 16:56:33 | 004,299,956 | -H-- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\IconCache.db

[2010/04/23 13:24:13 | 000,013,426 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841

[2010/04/23 13:24:13 | 000,013,426 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\q841

[2010/04/23 12:22:07 | 000,407,552 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\My Documents\Order Sofo Foods Samples 4-23-10.xls

[2010/04/23 12:21:55 | 001,349,120 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\My Documents\Copy of National Account Price list for orders shipping 03 22 10 - 04 02 10.xls

[2010/04/23 10:26:44 | 000,000,775 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\KODAK AiO Home Center.lnk

[2010/04/23 09:27:48 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010/04/22 20:57:16 | 000,020,686 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\March.docx

[2010/04/22 10:32:41 | 000,392,702 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2010/04/22 08:27:56 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/04/22 08:19:01 | 000,011,868 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60

[2010/04/22 08:19:01 | 000,011,868 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\34f60

[2010/04/22 08:15:40 | 000,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat

[2010/04/21 02:48:33 | 000,000,094 | ---- | M] () -- C:\WINDOWS\wininit.ini

[2010/04/20 17:43:14 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Jcirejifigocixa.dat

[2010/04/20 16:58:28 | 000,001,661 | ---- | M] () -- C:\WINDOWS\lsrslt.ini

[2010/04/20 15:42:26 | 000,571,308 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010/04/20 15:42:26 | 000,477,702 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010/04/20 15:42:26 | 000,082,990 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010/04/20 15:40:36 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Psapewisurase.bin

[2010/04/19 21:44:37 | 000,306,176 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\My Documents\Copy of House of Raeford Contract Request Form Final.xls

[2010/04/13 16:31:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2010/04/12 15:54:43 | 000,000,028 | ---- | M] () -- C:\WINDOWS\pdf995.ini

[2010/04/12 15:50:39 | 000,249,856 | ---- | M] (TODO: <Company name>) -- C:\WINDOWS\System32\pdfmona.dll

[2010/04/12 15:50:39 | 000,051,716 | ---- | M] () -- C:\WINDOWS\System32\pdf995mon.dll

[2010/04/08 19:53:37 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat

[2010/03/30 00:46:30 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/03/30 00:45:52 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/03/22 11:51:13 | 000,046,592 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/03/07 21:16:58 | 000,001,479 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\DeductionPro 2009.lnk

[2010/03/07 21:16:03 | 000,001,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\H&R Block 2009.lnk

[2010/02/18 14:53:07 | 000,000,560 | ---- | M] () -- C:\hpfr5550.xml

[2010/02/16 18:25:35 | 000,011,396 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\Year to year Sofo.docx

[2010/02/16 17:51:29 | 000,034,602 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\2008 Cases Sofo.docx

[2010/02/16 17:40:35 | 000,035,521 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\2009 Cases Sofo.docx

[2010/02/08 15:17:51 | 000,028,408 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\s0p17h4102T.docx

[2010/02/08 12:06:00 | 000,409,600 | ---- | M] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJ5000MON.dll

[2010/02/08 12:05:00 | 000,131,072 | ---- | M] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJCOINST07.dll

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 

========== Files Created - No Company Name ==========

 

[2010/04/24 22:16:03 | 000,293,376 | ---- | C] () -- C:\nvmx55zj.exe

[2010/04/23 12:21:53 | 001,349,120 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\My Documents\Copy of National Account Price list for orders shipping 03 22 10 - 04 02 10.xls

[2010/04/23 10:26:44 | 000,000,775 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\KODAK AiO Home Center.lnk

[2010/04/23 10:14:02 | 000,035,634 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\c4u.log

[2010/04/23 08:23:59 | 000,407,552 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\My Documents\Order Sofo Foods Samples 4-23-10.xls

[2010/04/23 07:52:23 | 000,013,426 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841

[2010/04/23 07:52:23 | 000,013,426 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\q841

[2010/04/22 08:27:56 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/04/22 08:17:00 | 1875,759,104 | -HS- | C] () -- C:\hiberfil.sys

[2010/04/22 08:15:40 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat

[2010/04/21 21:49:19 | 000,011,868 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60

[2010/04/21 21:49:19 | 000,011,868 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\34f60

[2010/04/20 17:38:45 | 000,000,094 | ---- | C] () -- C:\WINDOWS\wininit.ini

[2010/04/20 16:58:28 | 000,001,661 | ---- | C] () -- C:\WINDOWS\lsrslt.ini

[2010/04/20 15:40:36 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Jcirejifigocixa.dat

[2010/04/20 15:40:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Psapewisurase.bin

[2010/04/19 21:44:32 | 000,306,176 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\My Documents\Copy of House of Raeford Contract Request Form Final.xls

[2010/04/12 15:54:43 | 000,000,028 | ---- | C] () -- C:\WINDOWS\pdf995.ini

[2010/04/12 15:50:40 | 000,000,142 | ---- | C] () -- C:\WINDOWS\wpd99.drv

[2010/04/12 15:50:39 | 000,051,716 | ---- | C] () -- C:\WINDOWS\System32\pdf995mon.dll

[2010/04/08 19:53:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2010/03/21 08:50:26 | 000,000,284 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2010/03/07 21:22:47 | 000,002,414 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\DeductionPro2009.log

[2010/03/07 21:16:58 | 000,001,479 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\DeductionPro 2009.lnk

[2010/03/07 21:16:03 | 000,001,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\H&R Block 2009.lnk

[2010/02/16 18:25:35 | 000,011,396 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\Desktop\Year to year Sofo.docx

[2010/02/16 17:51:29 | 000,034,602 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\Desktop\2008 Cases Sofo.docx

[2010/02/16 17:40:35 | 000,035,521 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\Desktop\2009 Cases Sofo.docx

[2010/02/08 15:17:51 | 000,028,408 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\Desktop\s0p17h4102T.docx

[2010/01/21 22:49:12 | 000,000,044 | ---- | C] () -- C:\WINDOWS\SMWizard.INI

[2009/09/17 19:09:54 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini

[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll

[2009/04/29 12:46:02 | 000,000,034 | ---- | C] () -- C:\WINDOWS\hpfsched.ini

[2009/04/29 12:40:27 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\hpodinet.dll

[2009/04/10 12:37:43 | 000,176,235 | ---- | C] () -- C:\WINDOWS\System32\Primomonnt.dll

[2008/06/22 00:28:19 | 000,028,510 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini

[2008/05/30 12:36:58 | 000,108,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\SafeBoot.sys

[2008/04/28 12:13:33 | 000,000,310 | ---- | C] () -- C:\WINDOWS\primopdf.ini

[2008/04/10 13:27:34 | 001,804,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys

[2008/03/28 06:14:02 | 000,024,064 | ---- | C] () -- C:\WINDOWS\System32\drivers\sfaudio.sys

[2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini

[2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini

[2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini

[2007/05/10 02:16:40 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys

[2006/05/19 22:39:58 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini

[2005/04/03 18:30:00 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\scardsyn.dll

[2004/08/07 09:19:16 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2004/08/07 09:12:40 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini

[1998/05/06 23:10:00 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\ODMA32.dll

 

========== LOP Check ==========

 

[2009/10/13 21:12:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM

[2010/03/01 09:02:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Eastman Kodak Company

[2010/03/01 09:03:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\kds_kodak

[2010/04/12 20:48:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\pdf995

[2009/12/31 18:54:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SITEguard

[2010/01/01 13:03:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\STOPzilla!

[2010/03/07 21:13:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TaxCut

[2010/01/06 14:02:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint

[2008/06/22 00:33:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}

[2009/10/13 21:13:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\acccore

[2009/04/03 11:29:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1

[2010/04/21 21:21:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\F0C8A70282C3527304FD7E600530EA1C

[2010/01/05 13:08:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Flickr

[2010/01/07 19:50:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\MSNInstaller

[2010/04/12 15:54:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\pdf995

[2010/04/12 20:48:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\TaxCut

[2010/04/23 12:37:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Temp

[2009/04/30 18:13:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Windows Desktop Search

[2009/08/02 08:40:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Windows Search

 

========== Purity Check ==========

 

 

 

========== Custom Scans ==========

 

 

< %SYSTEMDRIVE%\*.exe >

[2010/04/24 22:16:06 | 000,293,376 | ---- | M] () -- C:\nvmx55zj.exe

 

 

< MD5 for: AGP440.SYS >

[2004/08/04 09:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\i386\sp2.cab:AGP440.sys

[2004/08/04 04:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys

[2009/03/20 14:31:16 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys

[2009/03/20 14:31:16 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys

[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys

[2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys

 

< MD5 for: AHCIX86.SYS >

[2008/05/27 09:55:48 | 000,174,600 | ---- | M] (AMD Technologies Inc.) MD5=15DA079FF09BE5FA6602041EE286DE80 -- C:\SwSetup\HDD1\ahcix86.sys

[2008/05/27 09:55:48 | 000,174,600 | ---- | M] (AMD Technologies Inc.) MD5=15DA079FF09BE5FA6602041EE286DE80 -- C:\SwSetup\HDD1\RAID7xx\x86\ahcix86.sys

[2008/05/27 09:55:48 | 000,174,600 | ---- | M] (AMD Technologies Inc.) MD5=15DA079FF09BE5FA6602041EE286DE80 -- C:\WINDOWS\system32\drivers\ahcix86.sys

 

< MD5 for: ATAPI.SYS >

[2004/08/04 09:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\i386\sp2.cab:atapi.sys

[2004/08/04 04:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys

[2009/03/20 14:31:16 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys

[2009/03/20 14:31:16 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys

[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys

[2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys

[2004/08/03 20:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys

 

< MD5 for: EVENTLOG.DLL >

[2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll

[2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll

[2004/08/04 04:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

 

< MD5 for: NETLOGON.DLL >

[2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll

[2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll

[2004/08/04 04:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

 

< MD5 for: SCECLI.DLL >

[2004/08/04 04:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll

[2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll

[2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll

 

< %systemroot%\*. /mp /s >

< End of report >

 

 

OTL Extras logfile created on: 4/24/2010 10:33:53 PM - Run 1

OTL by OldTimer - Version 3.2.2.0 Folder = C:\Documents and Settings\KSOBECKI\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 51.00% Memory free

4.00 Gb Paging File | 3.00 Gb Available in Paging File | 78.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 231.87 Gb Total Space | 199.23 Gb Free Space | 85.92% Space Free | Partition Type: NTFS

Drive D: | 1.00 Gb Total Space | 0.97 Gb Free Space | 97.24% Space Free | Partition Type: FAT32

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: KENHPLT

Current User Name: KSOBECKI

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: On

Skip Microsoft Files: On

File Age = 90 Days

Output = Standard

Quick Scan

 

========== Extra Registry (SafeList) ==========

 

 

========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

 

========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusOverride" = 0

"FirewallOverride" = 0

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 0

"DoNotAllowExceptions" = 0

"DisableNotifications" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

"DisableNotifications" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1723:TCP" = 1723:TCP:*:Enabled:VPN

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"9322:TCP" = 9322:TCP:*:Enabled:EKDiscovery

 

========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)

"C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe" = C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe:*:Enabled:SMC Service -- (Symantec Corporation)

"C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE" = C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE:*:Enabled:SNAC Service -- (Symantec Corporation)

"C:\Program Files\Common Files\Symantec Shared\ccApp.exe" = C:\Program Files\Common Files\Symantec Shared\ccApp.exe:*:Enabled:Symantec Email -- (Symantec Corporation)

"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)

"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -- (AOL LLC)

"C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM -- File not found

"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AIM -- (AOL LLC)

"C:\Program Files\Ares\Ares.exe" = C:\Program Files\Ares\Ares.exe:*:Enabled:Ares p2p for windows -- File not found

"C:\WINDOWS\system32\fxsclnt.exe" = C:\WINDOWS\system32\fxsclnt.exe:*:Enabled:Microsoft Fax Console -- (Microsoft Corporation)

"C:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe" = C:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe:*:Enabled:Kodak.AiO.HomeCenter -- (Eastman Kodak Company)

"C:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe" = C:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe:*:Enabled:Kodak.AiO.Statistics -- (Eastman Kodak Company)

"C:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe" = C:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe:*:Enabled:Kodak.AiO.SetupUtility -- (Eastman Kodak Company)

"C:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe" = C:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe:*:Enabled:Kodak.AiO.FwUpdater -- (Eastman Kodak Company)

"C:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe" = C:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe:*:Enabled:Kodak.AiO.Installer -- (Eastman Kodak Company)

 

 

========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{04788045-DEF3-4911-91B5-384A6915F21B}" = TaxCut Ohio 2008

"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center

"{05B62241-5495-46EF-5086-DBE0F37F052C}" = Catalyst Control Center Localization Korean

"{0645A454-AD44-4F0D-99CF-6B762735AD1F}" = aioprnt

"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour

"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer

"{0F98662A-EA83-414F-8766-3FCE46A32641}" = Credential Manager for HP ProtectTools

"{10934A28-0CC6-4B98-A14F-76B3546003AF}" = ksDIP

"{154E4F71-DFC0-4B31-8D99-F97615031B02}" = HP Webcam Application

"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0

"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java 6 Update 14

"{27FE77BD-2E0A-385C-C2CC-8367D877356F}" = CCC Help Norwegian

"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com

"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime

"{2CD54AED-740B-1418-464E-CC8E15AD1E4F}" = Catalyst Control Center Localization Swedish

"{2D0EE88B-8720-50A7-7F31-503B4300A8C5}" = Catalyst Control Center Localization French

"{2D87E961-577B-492B-AD54-1368680FB9A7}" = Bing Maps 3D

"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 E1

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{35EB3E58-F46C-CB48-C623-16A455C37C5D}" = CCC Help Turkish

"{36C491D0-A196-F49C-C63C-3509D7A2B91D}" = CCC Help Finnish

"{37AF26EB-ACCD-4F9C-A13E-81483F932203}" = Catalyst Control Center - Branding

"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = HP Webcam

"{45E6BF4C-6DC8-B1BB-517C-5F2C1D055A9B}" = CCC Help Hungarian

"{48072101-4DFE-9DC2-9F5D-DE0EF7193C98}" = CCC Help Korean

"{48B41C3A-9A92-4B81-B653-C97FEB85C910}" = C4USelfUpdater

"{49798684-CC48-AF5C-E513-9FFF61EFD3A6}" = CCC Help Japanese

"{4BFA6EEB-AAED-4334-8E98-A907DE4DD5CF}" = AMD Driver Support for HP 3D DriverGuard

"{4CF11D44-43B7-1359-B438-972C69D7AD6F}" = CCC Help Spanish

"{4ED20E34-D511-A85B-D7E5-755AE64D5F6C}" = CCC Help Portuguese

"{53A19323-917A-4822-B27E-A57D1EF6E9FC}" = H&R Block Deluxe + Efile + State 2009

"{553255F3-78FD-4

Link to post
Share on other sites

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit quick scan 2010-04-24 23:17:32

Windows 5.1.2600 Service Pack 3

Running: nvmx55zj.exe; Driver: C:\DOCUME~1\KSOBECKI\LOCALS~1\Temp\uwldqpow.sys

 

 

---- Devices - GMER 1.0.15 ----

 

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

 

Device -> \Driver\ahcix86 \Device\Harddisk0\DR0 89BF1AC8

 

---- Files - GMER 1.0.15 ----

 

File C:\WINDOWS\system32\drivers\ahcix86.sys suspicious modification

 

---- EOF - GMER 1.0.15 ----

Link to post
Share on other sites

Hi,

 

 

Please go here and have a look how you can disable your security software.

 

Download Combofix from any of the links below but rename it to <schrauber> before saving it to your desktop.

 

Link 1

Link 2

 

 

 

--------------------------------------------------------------------

 

Double click on the renamed Combofix.exe & follow the prompts.

  • When finished, it will produce a report for you.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

 

Posted Image

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

 

Posted Image

Click on Yes, to continue scanning for malware.

 

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply.

 

This tool is not a toy and not for everyday use.

ComboFix SHOULD NOT be used unless requested by a forum helper

 

If you need help, see this link:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Link to post
Share on other sites

I tried to shut off the Symantec EndPoint but every time I did.....it locked the computer. I ran it while it was on.

 

ComboFix 10-04-21.01 - KSOBECKI 04/25/2010 18:25:41.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1789.1084 [GMT -4:00]

Running from: c:\documents and settings\KSOBECKI\Desktop\schrauber.exe

AV: Symantec Endpoint Protection *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\documents and settings\All Users\Documents\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ken\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ken\My Pictures\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Berkley Square\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Cedar Point 2010\Cedar Point 2007\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Cedar Point 2010\Cedar Point 2008\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Cedar Point 2010\Cedar Point 2009\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Cedar Point 2010\Geauga Lake 2007\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Clark County Schools\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Holiday World 2008\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Holiday World 2008\Holiday World 2007\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Others\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Toledo Public Schools 2010-2011\Toledo Public Schools 2009-2010\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Toledo Public Schools 2010-2011\Toledo Public Schools 2009-2010\Toledo Public Schools 2008-2009\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Toledo Public Schools 2010-2011\Toledo Public Schools 2009-2010\Toledo Public Schools 2008-2009\Toledo Public Schools 2007-08\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Toledo Zoo 2010\Toledo Zoo 2007\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Toledo Zoo 2010\Toledo Zoo 2008\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Toledo Zoo 2010\Toledo Zoo 2009\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Washington Local 2009-2010\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Washington Local 2009-2010\Washington Local 2008-09\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Washington Local 2009-2010\Washington Local 2008-09\Washington Local 2007-08\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Western Michigan 09-10\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Western Michigan 09-10\Western Michigan 08-09\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Western Michigan 09-10\Western Michigan 08-09\Western Michigan 07-08\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Cavendish\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Command\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Durable Foil\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Heartland\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\HOR\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\LaPreferida\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Liguria Foods\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Lipari\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Naturally Fresh\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Graphics Packaging\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Lance\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\LBP\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\LBP\CARRABBA'S PHOTOS\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\LBP\HURRICANE\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\Archive\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kandj120\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kandj120\Archive\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kandj120\Archive\Messages\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kandj120\Archive\Messages\cat_fezz13x\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kandj120\Archive\Messages\khalkru\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Conferences\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\bluelady488\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\grobak130\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\kitten_pd\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\lmhallengren\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\mojohands2\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\monarchtoo\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\notcattrell\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\ohioskipatroller\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\salongoddess2004\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\spookyjill2\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\ts07563\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\victoria02256\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Mobile Messages\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Mobile Messages\+14193059845\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\ayoungsenior\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\bacardi350\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\bluelady488\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\grobak130\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\just4lisaa\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\kitten_pd\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\lmhallengren\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\mojohands2\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\monarchtoo\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\notcattrell\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\ohioskipatroller\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\search469\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\spookyjill2\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\twiztid32\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\victoria02256\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Mobile Messages\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Mobile Messages\+14193059845\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Mobile Messages\+16143320333\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\My Icons\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\My Icons\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\Archive\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\Archive\Messages\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\Archive\Messages\cmhguitarist\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\Archive\Messages\ohiocpl2008\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\Archive\Messages\sidneyfunguy63\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\My Icons\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\Archive\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\Archive\Messages\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\Archive\Messages\bob_45036\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\Archive\Messages\cmhguitarist\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\Archive\Messages\greeneyedbabe111\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\Archive\Messages\jlshoe1963\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\Archive\Messages\sidneyfunguy63\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\My Icons\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\kandj120\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\kandj120\My Icons\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\kensob99\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\kensob99\Archive\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\kensob99\Archive\Mobile Messages\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\kensob99\Archive\Mobile Messages\+16143320333\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\kensob99\My Icons\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Riverside\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Sanfacon\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Tennessee Pride\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Pastorelli\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Ritchie\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Smith Family\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Smithfield\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Sofo Foods\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Sofo Foods\2006 Show\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Sofo Foods\2007 Show\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Sofo Foods\2008 Show\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Sofo Foods\2009 Show\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Tradex\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Upstate Farms\_desktop.ini

c:\documents and settings\All Users\Documents\My Documents\Ritchie\Vincent Giordano\_desktop.ini

c:\documents and settings\All Users\Documents\My Music\_desktop.ini

c:\documents and settings\All Users\Documents\My Music\My Playlists\_desktop.ini

c:\documents and settings\All Users\Documents\My Music\Sample Music\_desktop.ini

c:\documents and settings\All Users\Documents\My Music\Sample Playlists\_desktop.ini

c:\documents and settings\All Users\Documents\My Music\Sample Playlists\0009B52B\_desktop.ini

c:\documents and settings\All Users\Documents\My Music\Sync Playlists\_desktop.ini

c:\documents and settings\All Users\Documents\My Music\Sync Playlists\14EDBA\_desktop.ini

c:\documents and settings\All Users\Documents\My Pictures\_desktop.ini

c:\documents and settings\All Users\Documents\My Pictures\Sample Pictures\_desktop.ini

c:\documents and settings\All Users\Documents\My Videos\_desktop.ini

c:\documents and settings\KSOBECKI\Application Data\F0C8A70282C3527304FD7E600530EA1C

c:\documents and settings\KSOBECKI\Application Data\F0C8A70282C3527304FD7E600530EA1C\enemies-names.txt

c:\documents and settings\KSOBECKI\Application Data\F0C8A70282C3527304FD7E600530EA1C\lsrslt.ini

c:\documents and settings\KSOBECKI\Local Settings\Application Data\{E3278AD6-FAF3-496F-906E-18B81B7B083E}

c:\documents and settings\KSOBECKI\Local Settings\Application Data\{E3278AD6-FAF3-496F-906E-18B81B7B083E}\chrome.manifest

c:\documents and settings\KSOBECKI\Local Settings\Application Data\{E3278AD6-FAF3-496F-906E-18B81B7B083E}\chrome\content\_cfg.js

c:\documents and settings\KSOBECKI\Local Settings\Application Data\{E3278AD6-FAF3-496F-906E-18B81B7B083E}\chrome\content\overlay.xul

c:\documents and settings\KSOBECKI\Local Settings\Application Data\{E3278AD6-FAF3-496F-906E-18B81B7B083E}\install.rdf

c:\recycler\S-1-5-21-1708537768-602609370-725345543-500

c:\recycler\S-1-5-21-625955303-583744707-3302112861-500

 

Infected copy of c:\windows\system32\drivers\sfaudio.sys was found and disinfected

Restored copy from - Kitty had a snack :P

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_6TO4

 

 

((((((((((((((((((((((((( Files Created from 2010-03-25 to 2010-04-25 )))))))))))))))))))))))))))))))

.

 

2010-04-25 22:21 . 2010-04-25 21:33 24064 ----a-w- c:\windows\system32\drivers\sfaudio.sys

2010-04-25 02:16 . 2010-04-25 02:16 293376 ----a-w- C:\nvmx55zj.exe

2010-04-23 14:23 . 2010-02-08 16:06 409600 ----a-w- c:\windows\system32\EKIJ5000MON.dll

2010-04-23 14:23 . 2010-02-08 16:06 196608 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\EKIJ5000PPR.dll

2010-04-23 14:23 . 2010-02-08 16:05 131072 ----a-w- c:\windows\system32\EKIJCOINST07.dll

2010-04-23 14:22 . 2010-04-23 14:22 -------- d-----w- c:\program files\MSXML 6.0

2010-04-23 14:15 . 2010-02-22 16:01 53248 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.XmlSerializers.dll

2010-04-23 14:15 . 2010-02-22 16:01 19968 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.dll

2010-04-23 14:15 . 2010-02-22 16:01 36864 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Interop.WindowsInstaller.dll

2010-04-22 14:50 . 2010-04-22 14:50 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer

2010-04-22 12:28 . 2010-04-22 12:28 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Malwarebytes

2010-04-22 12:27 . 2010-03-30 04:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-04-22 12:27 . 2010-03-30 04:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-22 12:15 . 2010-04-22 12:15 552 ----a-w- c:\windows\system32\d3d8caps.dat

2010-04-22 12:15 . 2010-04-22 12:15 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2010-04-20 19:40 . 2010-04-20 21:43 120 ----a-w- c:\windows\Jcirejifigocixa.dat

2010-04-20 19:40 . 2010-04-20 19:40 0 ----a-w- c:\windows\Psapewisurase.bin

2010-04-20 19:05 . 2008-04-14 00:12 82432 ----a-w- c:\windows\system32\dllcache\ws2_32.dll

2010-04-12 19:54 . 2010-04-12 19:54 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\pdf995

2010-04-12 19:50 . 2010-04-13 00:48 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995

2010-04-12 19:50 . 2007-08-24 16:13 142 ----a-w- c:\windows\wpd99.drv

2010-04-12 19:50 . 2010-04-12 19:50 51716 ----a-w- c:\windows\system32\pdf995mon.dll

2010-04-12 19:50 . 2010-04-12 19:50 249856 ----a-w- c:\windows\system32\pdfmona.dll

2010-04-09 02:03 . 2010-04-09 02:03 1924976 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe

2010-04-08 23:53 . 2010-04-08 23:53 0 ----a-w- c:\windows\nsreg.dat

2010-04-08 23:53 . 2010-04-08 23:53 -------- d-----w- c:\documents and settings\KSOBECKI\Local Settings\Application Data\Mozilla

2010-03-30 20:37 . 2010-03-30 20:37 -------- d-----w- c:\program files\QuickTime

2010-03-30 20:37 . 2010-03-30 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-04-25 22:36 . 2009-04-14 11:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak

2010-04-23 16:37 . 2009-09-17 21:33 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Temp

2010-04-23 16:29 . 2010-01-01 16:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-04-23 14:26 . 2010-03-01 12:54 -------- d-----w- c:\program files\Kodak

2010-04-23 13:27 . 2009-12-30 23:12 1324 ----a-w- c:\windows\system32\d3d9caps.dat

2010-04-15 12:48 . 2009-04-03 15:21 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2010-04-15 02:36 . 2008-06-22 04:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-04-13 00:48 . 2009-04-07 00:26 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\TaxCut

2010-04-12 19:50 . 2009-04-06 16:12 -------- d-----w- c:\program files\PDF995

2010-04-06 15:29 . 2009-05-14 23:32 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Skype

2010-04-02 02:17 . 2009-04-02 00:57 -------- d-----w- c:\program files\CCleaner

2010-03-23 22:59 . 2010-03-23 22:59 2934896 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Downloads\HRBlockOH.exe

2010-03-23 22:41 . 2010-03-08 01:16 -------- d-----w- c:\program files\DeductionPro 2009

2010-03-23 20:24 . 2010-03-23 20:24 21195208 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US65016901xupd.exe

2010-03-21 21:44 . 2010-03-21 21:44 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Apple Computer

2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Common Files\Apple

2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Apple Software Update

2010-03-11 12:38 . 2004-08-04 08:00 832512 ----a-w- c:\windows\system32\wininet.dll

2010-03-11 12:38 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll

2010-03-11 12:38 . 2004-08-04 08:00 17408 ----a-w- c:\windows\system32\corpol.dll

2010-03-09 11:09 . 2004-08-04 08:00 430080 ----a-w- c:\windows\system32\vbscript.dll

2010-03-08 01:18 . 2010-03-08 01:17 19486488 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US30026501xupd.exe

2010-03-08 01:16 . 2008-06-22 03:38 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-03-08 01:15 . 2010-03-08 01:14 -------- d-----w- c:\program files\HRBlock2009

2010-03-08 01:13 . 2009-04-06 16:09 -------- d-----w- c:\documents and settings\All Users\Application Data\TaxCut

2010-03-01 13:03 . 2009-09-17 22:51 -------- d-----w- c:\documents and settings\All Users\Application Data\kds_kodak

2010-03-01 13:02 . 2009-09-17 22:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Eastman Kodak Company

2010-02-24 13:11 . 2004-08-04 08:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-16 14:08 . 2004-08-04 08:00 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-16 13:25 . 2004-08-04 08:00 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-02-12 04:33 . 2004-08-04 08:00 100864 ----a-w- c:\windows\system32\6to4svc.dll

2010-02-11 12:02 . 2004-08-04 08:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-27 1040384]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]

"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2008-05-14 61440]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1044480]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-12-18 115560]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

"Conime"="c:\windows\system32\conime.exe" [2008-04-14 27648]

"EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2010-02-08 1634304]

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc]

2007-05-15 23:08 112640 ----a-w- c:\windows\system32\ackpbsc.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock]

2007-05-15 23:08 281088 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]

2008-05-21 00:42 111888 ----a-w- c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\APSHook.dll

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-03-24 18:17 952768 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2010-04-04 05:42 36272 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"DisableNotifications"= 1 (0x1)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\mqsvc.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"=

"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"=

"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\AIM\\aim.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\WINDOWS\\system32\\fxsclnt.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\WINDOWS\\system32\\spoolsv.exe"=

"c:\\Program Files\\Kodak\\AiO\\Center\\AiOHomeCenter.exe"=

"c:\\Program Files\\Kodak\\AiO\\Center\\Kodak.Statistics.exe"=

"c:\\Program Files\\Kodak\\AiO\\Center\\NetworkPrinterDiscovery.exe"=

"c:\\Program Files\\Kodak\\AiO\\Firmware\\KodakAiOUpdater.exe"=

"c:\\Documents and Settings\\All Users\\Application Data\\Kodak\\Installer\\Setup.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1723:TCP"= 1723:TCP:VPN

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"9322:TCP"= 9322:TCP:EKDiscovery

 

R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [6/21/2008 11:24 PM 174600]

R0 Amddfltr;Amd Disk Lower Filter Driver;c:\windows\system32\drivers\Amddfltr.sys [6/21/2008 11:49 PM 15416]

R0 SafeBoot;SafeBoot;c:\windows\system32\drivers\SafeBoot.sys [5/30/2008 12:36 PM 108752]

R0 SbAlg;SbAlg;c:\windows\system32\drivers\SbAlg.sys [5/30/2008 12:37 PM 51376]

R0 SbFsLock;SbFsLock;c:\windows\system32\drivers\SbFsLock.sys [5/30/2008 12:37 PM 12928]

R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\drivers\tffsport.sys [4/25/2009 8:54 PM 149376]

R1 RsvLock;RsvLock;c:\windows\system32\drivers\rsvlock.sys [5/30/2008 12:37 PM 12496]

R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [5/15/2007 7:08 PM 182576]

R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336]

R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336]

R2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [5/15/2008 6:11 PM 1176824]

R2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [6/2/2008 1:32 PM 18944]

R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [5/30/2008 12:36 PM 256512]

R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\ekdiscovery.exe [2/11/2010 3:36 PM 300400]

R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [5/15/2008 4:29 PM 475520]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [4/20/2010 7:22 AM 102448]

R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [4/4/2007 3:16 PM 41216]

S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [6/22/2008 12:50 AM 193840]

S3 scsichk;scsichk;\??\c:\windows\system32\scsichk.sys --> c:\windows\system32\scsichk.sys [?]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Cognizance REG_MULTI_SZ ASBroker ASChannel

.

Contents of the 'Scheduled Tasks' folder

 

2010-04-13 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

.

- - - - ORPHANS REMOVED - - - -

 

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

SafeBoot-Symantec Antvirus

 

 

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-04-25 18:37

Windows 5.1.2600 Service Pack 3 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe???????????????????????|?M?|?????M?|[email protected]

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

 

- - - - - - - > 'winlogon.exe'(948)

c:\windows\system32\ackpbsc.dll

c:\windows\system32\aclog.dll

c:\windows\system32\ACLIBEAY.dll

c:\windows\system32\acevtsub.dll

c:\windows\system32\asphat32.dll

c:\windows\system32\acerrmes.dll

c:\windows\system32\aspcom.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll

c:\windows\system32\Ati2evxx.dll

c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll

c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll

c:\program files\ActivIdentity\ActivClient\acunlock.dll

c:\windows\system32\aipingui.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll

c:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll

 

- - - - - - - > 'explorer.exe'(6316)

c:\windows\system32\WININET.dll

c:\windows\system32\APSHook.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Common Files\Symantec Shared\ccSvcHst.exe

c:\windows\System32\SCardSvr.exe

c:\windows\system32\msdtc.exe

c:\windows\system32\agrsmsvc.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

c:\windows\system32\SearchIndexer.exe

c:\windows\system32\mqsvc.exe

c:\windows\system32\mqtgsvc.exe

c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe

c:\program files\Hewlett-Packard\IAM\Bin\AsGHost.exe

c:\program files\Symantec\Symantec Endpoint Protection\SmcGui.exe

c:\program files\Hewlett-Packard\Shared\HpqToaster.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

.

**************************************************************************

.

Completion time: 2010-04-25 18:42:22 - machine was rebooted

ComboFix-quarantined-files.txt 2010-04-25 22:42

 

Pre-Run: 213,825,617,920 bytes free

Post-Run: 213,846,351,872 bytes free

 

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

 

- - End Of File - - 13554D69C40CCAC8B8FB83B3FAD336E1

Link to post
Share on other sites

Hi,

 

 

Open notepad and copy/paste the text in the quotebox below into it:

 

http://forums.pcpitstop.com/index.php?act=...25&t=184902

 

Collect::

c:\windows\Jcirejifigocixa.dat

c:\windows\Psapewisurase.bin

c:\windows\system32\scsichk.sys

Folder::

c:\documents and settings\KSOBECKI\Application Data\pdf995

c:\documents and settings\All Users\Application Data\pdf995

Driver::

scsichk

 

Save this as CFScript.txt

 

 

Posted Image

 

 

Refering to the picture above, drag CFScript.txt into ComboFix.exe

 

When finished, it shall produce a log for you. Post that log in your next reply.

 

**Note**

 

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

  • Ensure you are connected to the internet and click OK on the message box.
Link to post
Share on other sites

ComboFix 10-04-26.05 - KSOBECKI 04/27/2010 21:46:40.3.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1789.999 [GMT -4:00]

Running from: c:\documents and settings\KSOBECKI\Desktop\schrauber.exe

Command switches used :: c:\documents and settings\KSOBECKI\Desktop\CFScript.txt

AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

 

file zipped: c:\windows\Jcirejifigocixa.dat

file zipped: c:\windows\Psapewisurase.bin

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\documents and settings\All Users\Application Data\pdf995

c:\documents and settings\All Users\Application Data\pdf995\pdfsync.ini

c:\documents and settings\All Users\Application Data\pdf995\queue.ini

c:\documents and settings\KSOBECKI\Application Data\pdf995

c:\documents and settings\KSOBECKI\Application Data\pdf995\pdf995server.ini

c:\documents and settings\KSOBECKI\Application Data\pdf995\res\pdf995.ini

c:\documents and settings\KSOBECKI\Application Data\pdf995\temp.ps

c:\documents and settings\KSOBECKI\Local Settings\Application Data\Windows Server

C:\feed.txt

c:\windows\Jcirejifigocixa.dat

c:\windows\Psapewisurase.bin

c:\windows\system32\ctfmon .exe

 

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_SCSICHK

-------\Service_scsichk

 

 

((((((((((((((((((((((((( Files Created from 2010-03-28 to 2010-04-28 )))))))))))))))))))))))))))))))

.

 

2010-04-28 01:53 . 2010-04-28 02:00 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995

2010-04-26 17:48 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys

2010-04-26 17:48 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys

2010-04-26 17:48 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys

2010-04-26 17:48 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\dllcache\changer.sys

2010-04-26 17:48 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys

2010-04-26 17:48 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\dllcache\i2omgmt.sys

2010-04-26 12:33 . 2010-04-26 12:33 -------- d-----w- c:\documents and settings\KSOBECKI\Local Settings\Application Data\Mozilla

2010-04-25 22:21 . 2010-04-25 21:33 24064 ----a-w- c:\windows\system32\drivers\sfaudio.sys

2010-04-25 02:16 . 2010-04-25 02:16 293376 ----a-w- C:\nvmx55zj.exe

2010-04-23 14:23 . 2010-02-08 16:06 409600 ----a-w- c:\windows\system32\EKIJ5000MON.dll

2010-04-23 14:23 . 2010-02-08 16:06 196608 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\EKIJ5000PPR.dll

2010-04-23 14:23 . 2010-02-08 16:05 131072 ----a-w- c:\windows\system32\EKIJCOINST07.dll

2010-04-23 14:22 . 2010-04-23 14:22 -------- d-----w- c:\program files\MSXML 6.0

2010-04-23 14:15 . 2010-02-22 16:01 53248 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.XmlSerializers.dll

2010-04-23 14:15 . 2010-02-22 16:01 19968 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.dll

2010-04-23 14:15 . 2010-02-22 16:01 36864 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Interop.WindowsInstaller.dll

2010-04-22 14:50 . 2010-04-22 14:50 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer

2010-04-22 12:28 . 2010-04-22 12:28 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Malwarebytes

2010-04-22 12:27 . 2010-03-30 04:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-04-22 12:27 . 2010-03-30 04:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-22 12:15 . 2010-04-22 12:15 552 ----a-w- c:\windows\system32\d3d8caps.dat

2010-04-22 12:15 . 2010-04-22 12:15 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2010-04-20 19:05 . 2008-04-14 00:12 82432 ----a-w- c:\windows\system32\dllcache\ws2_32.dll

2010-04-12 19:50 . 2007-08-24 16:13 142 ----a-w- c:\windows\wpd99.drv

2010-04-12 19:50 . 2010-04-12 19:50 51716 ----a-w- c:\windows\system32\pdf995mon.dll

2010-04-12 19:50 . 2010-04-12 19:50 249856 ----a-w- c:\windows\system32\pdfmona.dll

2010-04-09 02:03 . 2010-04-09 02:03 1924976 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe

2010-04-08 23:53 . 2010-04-08 23:53 0 ----a-w- c:\windows\nsreg.dat

2010-03-30 20:37 . 2010-04-27 11:53 -------- d-----w- c:\program files\QuickTime

2010-03-30 20:37 . 2010-03-30 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-04-28 01:53 . 2009-04-14 11:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak

2010-04-28 01:10 . 2009-03-23 16:31 -------- d-----w- c:\program files\Common Files\Symantec Shared

2010-04-28 01:02 . 2010-01-01 16:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-04-26 15:15 . 2009-12-30 23:12 1324 ----a-w- c:\windows\system32\d3d9caps.dat

2010-04-23 16:37 . 2009-09-17 21:33 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Temp

2010-04-23 14:26 . 2010-03-01 12:54 -------- d-----w- c:\program files\Kodak

2010-04-15 12:48 . 2009-04-03 15:21 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2010-04-15 02:36 . 2008-06-22 04:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-04-13 00:48 . 2009-04-07 00:26 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\TaxCut

2010-04-12 19:50 . 2009-04-06 16:12 -------- d-----w- c:\program files\PDF995

2010-04-06 15:29 . 2009-05-14 23:32 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Skype

2010-04-02 02:17 . 2009-04-02 00:57 -------- d-----w- c:\program files\CCleaner

2010-03-23 22:59 . 2010-03-23 22:59 2934896 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Downloads\HRBlockOH.exe

2010-03-23 22:41 . 2010-03-08 01:16 -------- d-----w- c:\program files\DeductionPro 2009

2010-03-23 20:24 . 2010-03-23 20:24 21195208 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US65016901xupd.exe

2010-03-21 21:44 . 2010-03-21 21:44 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Apple Computer

2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Common Files\Apple

2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Apple Software Update

2010-03-11 12:38 . 2004-08-04 08:00 832512 ----a-w- c:\windows\system32\wininet.dll

2010-03-11 12:38 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll

2010-03-11 12:38 . 2004-08-04 08:00 17408 ----a-w- c:\windows\system32\corpol.dll

2010-03-09 11:09 . 2004-08-04 08:00 430080 ----a-w- c:\windows\system32\vbscript.dll

2010-03-08 01:18 . 2010-03-08 01:17 19486488 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US30026501xupd.exe

2010-03-08 01:16 . 2008-06-22 03:38 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-03-08 01:15 . 2010-03-08 01:14 -------- d-----w- c:\program files\HRBlock2009

2010-03-08 01:13 . 2009-04-06 16:09 -------- d-----w- c:\documents and settings\All Users\Application Data\TaxCut

2010-03-01 13:03 . 2009-09-17 22:51 -------- d-----w- c:\documents and settings\All Users\Application Data\kds_kodak

2010-03-01 13:02 . 2009-09-17 22:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Eastman Kodak Company

2010-02-24 13:11 . 2004-08-04 08:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-16 14:08 . 2004-08-04 08:00 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-16 13:25 . 2004-08-04 08:00 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-02-12 04:33 . 2004-08-04 08:00 100864 ----a-w- c:\windows\system32\6to4svc.dll

2010-02-11 12:02 . 2004-08-04 08:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys

.

<pre>
c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe
c:\program files\Analog Devices\Core\smax4pnp .exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\clistart .exe
c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe
c:\program files\Common Files\Symantec Shared\ccapp .exe
c:\program files\Hewlett-Packard\Default Settings\cpqset .exe
c:\program files\Hewlett-Packard\HP Wireless Assistant\hpwamain .exe
c:\program files\QuickTime\qttask .exe
c:\program files\Synaptics\SynTP\syntpenh .exe
c:\windows\system32\spool\drivers\w32x86\3\ekij5000mui .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [N/A]

"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [N/A]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" [2008-04-14 53760]

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc]

2007-05-15 23:08 112640 ----a-w- c:\windows\system32\ackpbsc.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock]

2007-05-15 23:08 281088 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]

2008-05-21 00:42 111888 ----a-w- c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\APSHook.dll

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-04-27 11:53 36864 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\adobearm.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2010-04-27 11:53 36864 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"DisableNotifications"= 1 (0x1)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\mqsvc.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"=

"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"=

"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\AIM\\aim.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\WINDOWS\\system32\\fxsclnt.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Kodak\\AiO\\Center\\AiOHomeCenter.exe"=

"c:\\Program Files\\Kodak\\AiO\\Center\\Kodak.Statistics.exe"=

"c:\\Program Files\\Kodak\\AiO\\Center\\NetworkPrinterDiscovery.exe"=

"c:\\Program Files\\Kodak\\AiO\\Firmware\\KodakAiOUpdater.exe"=

"c:\\Documents and Settings\\All Users\\Application Data\\Kodak\\Installer\\Setup.exe"=

"c:\\WINDOWS\\system32\\spoolsv.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1723:TCP"= 1723:TCP:VPN

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"9322:TCP"= 9322:TCP:EKDiscovery

 

R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [6/21/2008 11:24 PM 174600]

R0 Amddfltr;Amd Disk Lower Filter Driver;c:\windows\system32\drivers\Amddfltr.sys [6/21/2008 11:49 PM 15416]

R0 SafeBoot;SafeBoot;c:\windows\system32\drivers\SafeBoot.sys [5/30/2008 12:36 PM 108752]

R0 SbAlg;SbAlg;c:\windows\system32\drivers\SbAlg.sys [5/30/2008 12:37 PM 51376]

R0 SbFsLock;SbFsLock;c:\windows\system32\drivers\SbFsLock.sys [5/30/2008 12:37 PM 12928]

R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\drivers\tffsport.sys [4/25/2009 8:54 PM 149376]

R1 RsvLock;RsvLock;c:\windows\system32\drivers\rsvlock.sys [5/30/2008 12:37 PM 12496]

R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [5/15/2007 7:08 PM 182576]

R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336]

R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336]

R2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [5/15/2008 6:11 PM 1176824]

R2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [6/2/2008 1:32 PM 18944]

R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [5/30/2008 12:36 PM 256512]

R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\ekdiscovery.exe [2/11/2010 3:36 PM 300400]

R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [5/15/2008 4:29 PM 475520]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [4/20/2010 7:22 AM 102448]

R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [4/4/2007 3:16 PM 41216]

S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [6/22/2008 12:50 AM 193840]

S3 memchek;memchek;c:\windows\system32\memchek.sys [8/4/2004 4:00 AM 2432]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Cognizance REG_MULTI_SZ ASBroker ASChannel

.

Contents of the 'Scheduled Tasks' folder

 

2010-04-13 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\KSOBECKI\Application Data\Mozilla\Firefox\Profiles\220ltht1.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

 

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-04-27 22:00

Windows 5.1.2600 Service Pack 3 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe???????????????????????|?M?|?????M?|[email protected]

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

 

- - - - - - - > 'winlogon.exe'(952)

c:\windows\system32\ackpbsc.dll

c:\windows\system32\aclog.dll

c:\windows\system32\ACLIBEAY.dll

c:\windows\system32\acevtsub.dll

c:\windows\system32\asphat32.dll

c:\windows\system32\acerrmes.dll

c:\windows\system32\aspcom.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll

c:\windows\system32\Ati2evxx.dll

c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll

c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll

c:\program files\ActivIdentity\ActivClient\acunlock.dll

c:\windows\system32\aipingui.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll

c:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll

 

- - - - - - - > 'explorer.exe'(5748)

c:\windows\system32\WININET.dll

c:\windows\system32\APSHook.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Common Files\Symantec Shared\ccSvcHst.exe

c:\windows\System32\SCardSvr.exe

c:\windows\system32\msdtc.exe

c:\windows\system32\agrsmsvc.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

c:\windows\system32\SearchIndexer.exe

c:\windows\system32\mqsvc.exe

c:\windows\system32\mqtgsvc.exe

c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe

c:\program files\Hewlett-Packard\IAM\Bin\AsGHost.exe

c:\program files\Symantec\Symantec Endpoint Protection\SmcGui.exe

c:\windows\system32\rundll32.exe

c:\windows\system32\SearchProtocolHost.exe

c:\windows\system32\SearchFilterHost.exe

.

**************************************************************************

.

Completion time: 2010-04-27 22:05:33 - machine was rebooted

ComboFix-quarantined-files.txt 2010-04-28 02:05

ComboFix2.txt 2010-04-26 18:38

 

Pre-Run: 213,911,220,224 bytes free

Post-Run: 213,889,757,184 bytes free

 

- - End Of File - - 33FF553A7358152F5918AE3FDF248486

Link to post
Share on other sites

Hi,

 

 

1. Close any open browsers.

 

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

 

3. Open notepad and copy/paste the text in the quotebox below into it:

 

RenV::
c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe
c:\program files\Analog Devices\Core\smax4pnp .exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\clistart .exe
c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe
c:\program files\Common Files\Symantec Shared\ccapp .exe
c:\program files\Hewlett-Packard\Default Settings\cpqset .exe
c:\program files\Hewlett-Packard\HP Wireless Assistant\hpwamain .exe
c:\program files\QuickTime\qttask .exe
c:\program files\Synaptics\SynTP\syntpenh .exe
c:\windows\system32\spool\drivers\w32x86\3\ekij5000mui .exe

Save this as CFScript.txt, in the same location as ComboFix.exe

 

 

Posted Image

 

Refering to the picture above, drag CFScript into ComboFix.exe

 

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Link to post
Share on other sites

ComboFix 10-04-28.03 - KSOBECKI 04/28/2010 22:20:42.4.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1789.921 [GMT -4:00]

Running from: c:\documents and settings\KSOBECKI\Desktop\schrauber.exe

Command switches used :: c:\documents and settings\KSOBECKI\Desktop\CFScript.txt

AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

.

 

((((((((((((((((((((((((( Files Created from 2010-03-28 to 2010-04-29 )))))))))))))))))))))))))))))))

.

 

2010-04-28 01:53 . 2010-04-28 02:00 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995

2010-04-26 17:48 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys

2010-04-26 17:48 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys

2010-04-26 17:48 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys

2010-04-26 17:48 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\dllcache\changer.sys

2010-04-26 17:48 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys

2010-04-26 17:48 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\dllcache\i2omgmt.sys

2010-04-26 12:33 . 2010-04-26 12:33 -------- d-----w- c:\documents and settings\KSOBECKI\Local Settings\Application Data\Mozilla

2010-04-25 22:21 . 2010-04-25 21:33 24064 ----a-w- c:\windows\system32\drivers\sfaudio.sys

2010-04-25 02:16 . 2010-04-25 02:16 293376 ----a-w- C:\nvmx55zj.exe

2010-04-23 14:23 . 2010-02-08 16:06 409600 ----a-w- c:\windows\system32\EKIJ5000MON.dll

2010-04-23 14:23 . 2010-02-08 16:06 196608 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\EKIJ5000PPR.dll

2010-04-23 14:23 . 2010-02-08 16:05 131072 ----a-w- c:\windows\system32\EKIJCOINST07.dll

2010-04-23 14:22 . 2010-04-23 14:22 -------- d-----w- c:\program files\MSXML 6.0

2010-04-23 14:15 . 2010-02-22 16:01 53248 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.XmlSerializers.dll

2010-04-23 14:15 . 2010-02-22 16:01 19968 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.dll

2010-04-23 14:15 . 2010-02-22 16:01 36864 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Interop.WindowsInstaller.dll

2010-04-22 14:50 . 2010-04-22 14:50 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer

2010-04-22 12:28 . 2010-04-22 12:28 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Malwarebytes

2010-04-22 12:27 . 2010-03-30 04:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-04-22 12:27 . 2010-03-30 04:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-22 12:15 . 2010-04-22 12:15 552 ----a-w- c:\windows\system32\d3d8caps.dat

2010-04-22 12:15 . 2010-04-22 12:15 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2010-04-20 19:05 . 2008-04-14 00:12 82432 ----a-w- c:\windows\system32\dllcache\ws2_32.dll

2010-04-12 19:50 . 2007-08-24 16:13 142 ----a-w- c:\windows\wpd99.drv

2010-04-12 19:50 . 2010-04-12 19:50 51716 ----a-w- c:\windows\system32\pdf995mon.dll

2010-04-12 19:50 . 2010-04-12 19:50 249856 ----a-w- c:\windows\system32\pdfmona.dll

2010-04-09 02:03 . 2010-04-09 02:03 1924976 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe

2010-04-08 23:53 . 2010-04-08 23:53 0 ----a-w- c:\windows\nsreg.dat

2010-03-30 20:37 . 2010-04-29 02:20 -------- d-----w- c:\program files\QuickTime

2010-03-30 20:37 . 2010-03-30 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-04-29 02:20 . 2009-03-23 16:31 -------- d-----w- c:\program files\Common Files\Symantec Shared

2010-04-28 02:13 . 2010-01-01 16:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-04-28 01:53 . 2009-04-14 11:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak

2010-04-26 15:15 . 2009-12-30 23:12 1324 ----a-w- c:\windows\system32\d3d9caps.dat

2010-04-23 16:37 . 2009-09-17 21:33 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Temp

2010-04-23 14:26 . 2010-03-01 12:54 -------- d-----w- c:\program files\Kodak

2010-04-15 12:48 . 2009-04-03 15:21 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2010-04-15 02:36 . 2008-06-22 04:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-04-13 00:48 . 2009-04-07 00:26 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\TaxCut

2010-04-12 19:50 . 2009-04-06 16:12 -------- d-----w- c:\program files\PDF995

2010-04-06 15:29 . 2009-05-14 23:32 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Skype

2010-04-02 02:17 . 2009-04-02 00:57 -------- d-----w- c:\program files\CCleaner

2010-03-23 22:59 . 2010-03-23 22:59 2934896 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Downloads\HRBlockOH.exe

2010-03-23 22:41 . 2010-03-08 01:16 -------- d-----w- c:\program files\DeductionPro 2009

2010-03-23 20:24 . 2010-03-23 20:24 21195208 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US65016901xupd.exe

2010-03-21 21:44 . 2010-03-21 21:44 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Apple Computer

2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Common Files\Apple

2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Apple Software Update

2010-03-11 12:38 . 2004-08-04 08:00 832512 ----a-w- c:\windows\system32\wininet.dll

2010-03-11 12:38 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll

2010-03-11 12:38 . 2004-08-04 08:00 17408 ----a-w- c:\windows\system32\corpol.dll

2010-03-09 11:09 . 2004-08-04 08:00 430080 ----a-w- c:\windows\system32\vbscript.dll

2010-03-08 01:18 . 2010-03-08 01:17 19486488 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US30026501xupd.exe

2010-03-08 01:16 . 2008-06-22 03:38 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-03-08 01:15 . 2010-03-08 01:14 -------- d-----w- c:\program files\HRBlock2009

2010-03-08 01:13 . 2009-04-06 16:09 -------- d-----w- c:\documents and settings\All Users\Application Data\TaxCut

2010-03-01 13:03 . 2009-09-17 22:51 -------- d-----w- c:\documents and settings\All Users\Application Data\kds_kodak

2010-03-01 13:02 . 2009-09-17 22:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Eastman Kodak Company

2010-02-24 13:11 . 2004-08-04 08:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-16 14:08 . 2004-08-04 08:00 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-16 13:25 . 2004-08-04 08:00 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-02-12 04:33 . 2004-08-04 08:00 100864 ----a-w- c:\windows\system32\6to4svc.dll

2010-02-11 12:02 . 2004-08-04 08:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys

.

 

((((((((((((((((((((((((((((( [email protected]_02.00.41 )))))))))))))))))))))))))))))))))))))))))

.

+ 2010-04-28 02:17 . 2010-04-28 02:17 16384 c:\windows\Temp\Perflib_Perfdata_290.dat

+ 2010-04-23 14:23 . 2010-02-08 16:09 1634304 c:\windows\system32\spool\drivers\w32x86\3\ekij5000mui.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" [2008-04-14 53760]

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc]

2007-05-15 23:08 112640 ----a-w- c:\windows\system32\ackpbsc.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock]

2007-05-15 23:08 281088 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]

2008-05-21 00:42 111888 ----a-w- c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\APSHook.dll

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-03-24 18:17 952768 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\adobearm.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2010-04-04 05:42 36272 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"DisableNotifications"= 1 (0x1)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\mqsvc.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"=

"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"=

"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\AIM\\aim.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\WINDOWS\\system32\\fxsclnt.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Kodak\\AiO\\Center\\AiOHomeCenter.exe"=

"c:\\Program Files\\Kodak\\AiO\\Center\\Kodak.Statistics.exe"=

"c:\\Program Files\\Kodak\\AiO\\Center\\NetworkPrinterDiscovery.exe"=

"c:\\Program Files\\Kodak\\AiO\\Firmware\\KodakAiOUpdater.exe"=

"c:\\Documents and Settings\\All Users\\Application Data\\Kodak\\Installer\\Setup.exe"=

"c:\\WINDOWS\\system32\\spoolsv.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1723:TCP"= 1723:TCP:VPN

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"9322:TCP"= 9322:TCP:EKDiscovery

 

R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [6/21/2008 11:24 PM 174600]

R0 Amddfltr;Amd Disk Lower Filter Driver;c:\windows\system32\drivers\Amddfltr.sys [6/21/2008 11:49 PM 15416]

R0 SafeBoot;SafeBoot;c:\windows\system32\drivers\SafeBoot.sys [5/30/2008 12:36 PM 108752]

R0 SbAlg;SbAlg;c:\windows\system32\drivers\SbAlg.sys [5/30/2008 12:37 PM 51376]

R0 SbFsLock;SbFsLock;c:\windows\system32\drivers\SbFsLock.sys [5/30/2008 12:37 PM 12928]

R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\drivers\tffsport.sys [4/25/2009 8:54 PM 149376]

R1 RsvLock;RsvLock;c:\windows\system32\drivers\rsvlock.sys [5/30/2008 12:37 PM 12496]

R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [5/15/2007 7:08 PM 182576]

R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336]

R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336]

R2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [5/15/2008 6:11 PM 1176824]

R2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [6/2/2008 1:32 PM 18944]

R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [5/30/2008 12:36 PM 256512]

R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [5/15/2008 4:29 PM 475520]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [4/20/2010 7:22 AM 102448]

R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [4/4/2007 3:16 PM 41216]

S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\ekdiscovery.exe [2/11/2010 3:36 PM 300400]

S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [6/22/2008 12:50 AM 193840]

S3 memchek;memchek;c:\windows\system32\memchek.sys [8/4/2004 4:00 AM 2432]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Cognizance REG_MULTI_SZ ASBroker ASChannel

.

Contents of the 'Scheduled Tasks' folder

 

2010-04-13 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\KSOBECKI\Application Data\Mozilla\Firefox\Profiles\220ltht1.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

 

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

.

 

**************************************************************************

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files:

 

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

 

- - - - - - - > 'winlogon.exe'(952)

c:\windows\system32\ackpbsc.dll

c:\windows\system32\aclog.dll

c:\windows\system32\ACLIBEAY.dll

c:\windows\system32\acevtsub.dll

c:\windows\system32\asphat32.dll

c:\windows\system32\acerrmes.dll

c:\windows\system32\aspcom.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll

c:\windows\system32\Ati2evxx.dll

c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll

c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll

c:\program files\ActivIdentity\ActivClient\acunlock.dll

c:\windows\system32\aipingui.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll

c:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll

 

- - - - - - - > 'explorer.exe'(23844)

c:\windows\system32\WININET.dll

c:\windows\system32\APSHook.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2010-04-28 22:27:27

ComboFix-quarantined-files.txt 2010-04-29 02:27

ComboFix2.txt 2010-04-28 02:05

ComboFix3.txt 2010-04-26 18:38

 

Pre-Run: 213,855,825,920 bytes free

Post-Run: 213,819,035,648 bytes free

 

- - End Of File - - 2B8558AD49A8D08963D255200BE7A525

Link to post
Share on other sites

Looks good.

 

How is it running?

 

Please update your version of Malwarebytes and run a quick scan, post back with the content of the logfile.

 

 

 

Please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan

  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • When asked, allow the ActiveX control to install
  • Click Start
  • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
  • Click Scan (This scan can take several hours, so please be patient)
  • Once the scan is completed, you may close the window
  • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic

 

Please open OTL, set the extra registry tab to use safe list and hit the run scan button, post back with the 2 logfiles.

Link to post
Share on other sites

ComboFix 10-04-29.05 - KSOBECKI 04/30/2010 7:00.5.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1789.771 [GMT -4:00]

Running from: c:\documents and settings\KSOBECKI\Desktop\schrauber.exe

Command switches used :: c:\documents and settings\KSOBECKI\Desktop\CFScript.txt

AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

* Created a new restore point

.

 

((((((((((((((((((((((((( Files Created from 2010-03-28 to 2010-04-30 )))))))))))))))))))))))))))))))

.

 

2010-04-29 02:19 . 2010-04-29 02:27 -------- d-----w- C:\schrauber

2010-04-28 01:53 . 2010-04-28 02:00 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995

2010-04-26 17:48 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys

2010-04-26 17:48 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys

2010-04-26 17:48 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys

2010-04-26 17:48 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\dllcache\changer.sys

2010-04-26 17:48 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys

2010-04-26 17:48 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\dllcache\i2omgmt.sys

2010-04-26 12:33 . 2010-04-26 12:33 -------- d-----w- c:\documents and settings\KSOBECKI\Local Settings\Application Data\Mozilla

2010-04-25 22:21 . 2010-04-25 21:33 24064 ----a-w- c:\windows\system32\drivers\sfaudio.sys

2010-04-25 02:16 . 2010-04-25 02:16 293376 ----a-w- C:\nvmx55zj.exe

2010-04-23 14:23 . 2010-02-08 16:06 409600 ----a-w- c:\windows\system32\EKIJ5000MON.dll

2010-04-23 14:23 . 2010-02-08 16:06 196608 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\EKIJ5000PPR.dll

2010-04-23 14:23 . 2010-02-08 16:05 131072 ----a-w- c:\windows\system32\EKIJCOINST07.dll

2010-04-23 14:22 . 2010-04-23 14:22 -------- d-----w- c:\program files\MSXML 6.0

2010-04-23 14:15 . 2010-02-22 16:01 53248 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.XmlSerializers.dll

2010-04-23 14:15 . 2010-02-22 16:01 19968 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.dll

2010-04-23 14:15 . 2010-02-22 16:01 36864 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Interop.WindowsInstaller.dll

2010-04-22 14:50 . 2010-04-22 14:50 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer

2010-04-22 12:28 . 2010-04-22 12:28 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Malwarebytes

2010-04-22 12:27 . 2010-03-30 04:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-04-22 12:27 . 2010-03-30 04:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-22 12:15 . 2010-04-22 12:15 552 ----a-w- c:\windows\system32\d3d8caps.dat

2010-04-22 12:15 . 2010-04-22 12:15 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2010-04-20 19:05 . 2008-04-14 00:12 82432 ----a-w- c:\windows\system32\dllcache\ws2_32.dll

2010-04-12 19:50 . 2007-08-24 16:13 142 ----a-w- c:\windows\wpd99.drv

2010-04-12 19:50 . 2010-04-12 19:50 51716 ----a-w- c:\windows\system32\pdf995mon.dll

2010-04-12 19:50 . 2010-04-12 19:50 249856 ----a-w- c:\windows\system32\pdfmona.dll

2010-04-09 02:03 . 2010-04-09 02:03 1924976 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe

2010-04-08 23:53 . 2010-04-08 23:53 0 ----a-w- c:\windows\nsreg.dat

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-04-29 02:20 . 2010-03-30 20:37 -------- d-----w- c:\program files\QuickTime

2010-04-29 02:20 . 2009-03-23 16:31 -------- d-----w- c:\program files\Common Files\Symantec Shared

2010-04-28 02:13 . 2010-01-01 16:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-04-28 01:53 . 2009-04-14 11:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak

2010-04-26 15:15 . 2009-12-30 23:12 1324 ----a-w- c:\windows\system32\d3d9caps.dat

2010-04-23 16:37 . 2009-09-17 21:33 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Temp

2010-04-23 14:26 . 2010-03-01 12:54 -------- d-----w- c:\program files\Kodak

2010-04-15 12:48 . 2009-04-03 15:21 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2010-04-15 02:36 . 2008-06-22 04:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-04-13 00:48 . 2009-04-07 00:26 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\TaxCut

2010-04-12 19:50 . 2009-04-06 16:12 -------- d-----w- c:\program files\PDF995

2010-04-06 15:29 . 2009-05-14 23:32 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Skype

2010-04-02 02:17 . 2009-04-02 00:57 -------- d-----w- c:\program files\CCleaner

2010-03-30 20:37 . 2010-03-30 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer

2010-03-23 22:59 . 2010-03-23 22:59 2934896 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Downloads\HRBlockOH.exe

2010-03-23 22:41 . 2010-03-08 01:16 -------- d-----w- c:\program files\DeductionPro 2009

2010-03-23 20:24 . 2010-03-23 20:24 21195208 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US65016901xupd.exe

2010-03-21 21:44 . 2010-03-21 21:44 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Apple Computer

2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Common Files\Apple

2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Apple Software Update

2010-03-11 12:38 . 2004-08-04 08:00 832512 ----a-w- c:\windows\system32\wininet.dll

2010-03-11 12:38 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll

2010-03-11 12:38 . 2004-08-04 08:00 17408 ----a-w- c:\windows\system32\corpol.dll

2010-03-09 11:09 . 2004-08-04 08:00 430080 ----a-w- c:\windows\system32\vbscript.dll

2010-03-08 01:18 . 2010-03-08 01:17 19486488 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US30026501xupd.exe

2010-03-08 01:16 . 2008-06-22 03:38 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-03-08 01:15 . 2010-03-08 01:14 -------- d-----w- c:\program files\HRBlock2009

2010-03-08 01:13 . 2009-04-06 16:09 -------- d-----w- c:\documents and settings\All Users\Application Data\TaxCut

2010-03-01 13:03 . 2009-09-17 22:51 -------- d-----w- c:\documents and settings\All Users\Application Data\kds_kodak

2010-03-01 13:02 . 2009-09-17 22:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Eastman Kodak Company

2010-02-24 13:11 . 2004-08-04 08:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-16 14:08 . 2004-08-04 08:00 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-16 13:25 . 2004-08-04 08:00 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-02-12 04:33 . 2004-08-04 08:00 100864 ----a-w- c:\windows\system32\6to4svc.dll

2010-02-11 12:02 . 2004-08-04 08:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys

.

 

((((((((((((((((((((((((((((( [email protected]_02.00.41 )))))))))))))))))))))))))))))))))))))))))

.

+ 2010-04-28 02:17 . 2010-04-28 02:17 16384 c:\windows\Temp\Perflib_Perfdata_290.dat

+ 2010-04-23 14:23 . 2010-02-08 16:09 1634304 c:\windows\system32\spool\drivers\w32x86\3\ekij5000mui.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" [2008-04-14 53760]

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc]

2007-05-15 23:08 112640 ----a-w- c:\windows\system32\ackpbsc.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock]

2007-05-15 23:08 281088 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]

2008-05-21 00:42 111888 ----a-w- c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\system32\APSHook.dll

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]

@="Service"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-03-24 18:17 952768 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\adobearm.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2010-04-04 05:42 36272 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"DisableNotifications"= 1 (0x1)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\mqsvc.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"=

"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"=

"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\AIM\\aim.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\WINDOWS\\system32\\fxsclnt.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\Program Files\\Kodak\\AiO\\Center\\AiOHomeCenter.exe"=

"c:\\Program Files\\Kodak\\AiO\\Center\\Kodak.Statistics.exe"=

"c:\\Program Files\\Kodak\\AiO\\Center\\NetworkPrinterDiscovery.exe"=

"c:\\Program Files\\Kodak\\AiO\\Firmware\\KodakAiOUpdater.exe"=

"c:\\Documents and Settings\\All Users\\Application Data\\Kodak\\Installer\\Setup.exe"=

"c:\\WINDOWS\\system32\\spoolsv.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1723:TCP"= 1723:TCP:VPN

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"9322:TCP"= 9322:TCP:EKDiscovery

 

R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [6/21/2008 11:24 PM 174600]

R0 Amddfltr;Amd Disk Lower Filter Driver;c:\windows\system32\drivers\Amddfltr.sys [6/21/2008 11:49 PM 15416]

R0 SafeBoot;SafeBoot;c:\windows\system32\drivers\SafeBoot.sys [5/30/2008 12:36 PM 108752]

R0 SbAlg;SbAlg;c:\windows\system32\drivers\SbAlg.sys [5/30/2008 12:37 PM 51376]

R0 SbFsLock;SbFsLock;c:\windows\system32\drivers\SbFsLock.sys [5/30/2008 12:37 PM 12928]

R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\drivers\tffsport.sys [4/25/2009 8:54 PM 149376]

R1 RsvLock;RsvLock;c:\windows\system32\drivers\rsvlock.sys [5/30/2008 12:37 PM 12496]

R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [5/15/2007 7:08 PM 182576]

R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336]

R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336]

R2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [5/15/2008 6:11 PM 1176824]

R2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [6/2/2008 1:32 PM 18944]

R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [5/30/2008 12:36 PM 256512]

R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [5/15/2008 4:29 PM 475520]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [4/20/2010 7:22 AM 102448]

R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [4/4/2007 3:16 PM 41216]

S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\ekdiscovery.exe [2/11/2010 3:36 PM 300400]

S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [6/22/2008 12:50 AM 193840]

S3 memchek;memchek;c:\windows\system32\memchek.sys [8/4/2004 4:00 AM 2432]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Cognizance REG_MULTI_SZ ASBroker ASChannel

.

Contents of the 'Scheduled Tasks' folder

 

2010-04-13 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\KSOBECKI\Application Data\Mozilla\Firefox\Profiles\220ltht1.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

 

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-04-30 07:06

Windows 5.1.2600 Service Pack 3 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

 

- - - - - - - > 'winlogon.exe'(952)

c:\windows\system32\ackpbsc.dll

c:\windows\system32\aclog.dll

c:\windows\system32\ACLIBEAY.dll

c:\windows\system32\acevtsub.dll

c:\windows\system32\asphat32.dll

c:\windows\system32\acerrmes.dll

c:\windows\system32\aspcom.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll

c:\windows\system32\Ati2evxx.dll

c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll

c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll

c:\program files\ActivIdentity\ActivClient\acunlock.dll

c:\windows\system32\aipingui.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll

c:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dll

c:\program files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll

 

- - - - - - - > 'explorer.exe'(41656)

c:\windows\system32\WININET.dll

c:\windows\system32\APSHook.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Completion time: 2010-04-30 07:08:19

ComboFix-quarantined-files.txt 2010-04-30 11:08

ComboFix2.txt 2010-04-29 02:27

ComboFix3.txt 2010-04-28 02:05

ComboFix4.txt 2010-04-26 18:38

 

Pre-Run: 213,766,815,744 bytes free

Post-Run: 213,722,521,600 bytes free

 

- - End Of File - - 1034606270ED3937E6A2D1D29436EAE4

Link to post
Share on other sites

I am sorry but it went to a second page and when I scrolled down there I just saw your last post and thought that was the end.

 

I will post the requested logs in separate replies with the first one here.

 

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

 

Database version: 4052

 

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

 

5/1/2010 7:05:43 AM

mbam-log-2010-05-01 (07-05-43).txt

 

Scan type: Quick scan

Objects scanned: 124278

Time elapsed: 11 minute(s), 24 second(s)

 

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

 

Memory Processes Infected:

(No malicious items detected)

 

Memory Modules Infected:

(No malicious items detected)

 

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a2ba40a0-74f1-52bd-f411-00b15a2c8953} (Trojan.Ertfor) -> Quarantined and deleted successfully.

 

Registry Values Infected:

(No malicious items detected)

 

Registry Data Items Infected:

(No malicious items detected)

 

Folders Infected:

(No malicious items detected)

 

Files Infected:

(No malicious items detected)

Link to post
Share on other sites

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined

C:\Qoobox\Quarantine\C\WINDOWS\PRAGMAsbcofvcpci\PRAGMAd.sys.vir a variant of Win32/Rootkit.Kryptik.AZ trojan cleaned by deleting - quarantined

C:\Qoobox\Quarantine\C\WINDOWS\system32\tafqgkzvxu.exe.vir Win32/Adware.GooochiBiz.AE.Gen application deleted - quarantined

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1\A0000110.dll probably a variant of Win32/Agent trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1\A0000129.sys a variant of Win32/Rootkit.Kryptik.AZ trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1\A0000130.dll a variant of Win32/Wimpixo.AA trojan cleaned by deleting - quarantined

C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1\A0000135.exe Win32/Adware.GooochiBiz.AE.Gen application deleted - quarantined

 

OTL logfile created on: 5/1/2010 8:51:52 AM - Run 3

OTL by OldTimer - Version 3.2.2.0 Folder = C:\Documents and Settings\KSOBECKI\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 40.00% Memory free

4.00 Gb Paging File | 3.00 Gb Available in Paging File | 72.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 231.87 Gb Total Space | 198.90 Gb Free Space | 85.78% Space Free | Partition Type: NTFS

Drive D: | 1.00 Gb Total Space | 0.97 Gb Free Space | 97.24% Space Free | Partition Type: FAT32

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: KENHPLT

Current User Name: KSOBECKI

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

 

========== Processes (SafeList) ==========

 

PRC - [2010/04/24 22:12:17 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe

PRC - [2009/02/26 15:07:10 | 001,443,144 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe

PRC - [2009/02/26 15:07:08 | 001,799,496 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

PRC - [2009/02/01 23:37:00 | 002,440,120 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

PRC - [2008/12/18 16:46:30 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

PRC - [2008/06/02 13:32:16 | 000,018,944 | ---- | M] (Hewlett-Packard Development Company, L.P) -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe

PRC - [2008/05/30 12:36:20 | 000,256,512 | ---- | M] (SafeBoot International) -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe

PRC - [2008/05/20 20:47:18 | 000,065,296 | ---- | M] (Bioscrypt Inc.) -- c:\Program Files\Hewlett-Packard\IAM\Bin\asghost.exe

PRC - [2008/05/15 18:11:12 | 001,176,824 | ---- | M] (AuthenTec, Inc.) -- c:\Program Files\Fingerprint Sensor\AtService.exe

PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2007/12/11 15:15:04 | 000,012,800 | ---- | M] (Agere Systems) -- C:\WINDOWS\system32\agrsmsvc.exe

PRC - [2007/05/15 19:08:40 | 000,182,576 | ---- | M] (ActivIdentity) -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe

 

 

========== Modules (SafeList) ==========

 

MOD - [2010/04/24 22:12:17 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe

MOD - [2008/03/25 08:17:04 | 000,076,048 | ---- | M] (Bioscrypt Inc.) -- C:\WINDOWS\system32\APSHook.dll

 

 

========== Win32 Services (SafeList) ==========

 

SRV - [2010/02/11 15:36:12 | 000,300,400 | ---- | M] (Eastman Kodak Company) [Auto | Stopped] -- C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe -- (Kodak AiO Network Discovery Service)

SRV - [2009/02/26 15:07:08 | 001,799,496 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService)

SRV - [2009/02/01 23:37:00 | 002,440,120 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus)

SRV - [2009/02/01 21:43:02 | 000,320,840 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE -- (SNAC)

SRV - [2008/12/18 16:46:30 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)

SRV - [2008/12/18 16:46:30 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)

SRV - [2008/12/10 15:46:58 | 003,093,880 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)

SRV - [2008/06/02 13:32:16 | 000,018,944 | ---- | M] (Hewlett-Packard Development Company, L.P) [Auto | Running] -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe -- (HP ProtectTools Service)

SRV - [2008/05/30 12:36:20 | 000,256,512 | ---- | M] (SafeBoot International) [Auto | Running] -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe -- (HpFkCryptService)

SRV - [2008/05/20 20:42:40 | 000,111,888 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll -- (ASBroker)

SRV - [2008/05/20 20:42:34 | 000,137,488 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASChnl.dll -- (ASChannel)

SRV - [2008/05/15 18:11:12 | 001,176,824 | ---- | M] (AuthenTec, Inc.) [Auto | Running] -- c:\Program Files\Fingerprint Sensor\AtService.exe -- (ATService)

SRV - [2007/12/11 15:15:04 | 000,012,800 | ---- | M] (Agere Systems) [Auto | Running] -- C:\WINDOWS\system32\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2007/05/15 19:08:40 | 000,182,576 | ---- | M] (ActivIdentity) [Auto | Running] -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe -- (accoca)

SRV - [2006/01/06 15:07:26 | 000,077,824 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\hphipm11.exe -- (Pml Driver HPH11)

 

 

========== Driver Services (SafeList) ==========

 

DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)

DRV - [2010/02/16 05:00:00 | 001,324,720 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100430.036\NAVEX15.SYS -- (NAVEX15)

DRV - [2010/02/16 05:00:00 | 000,084,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100430.036\NAVENG.SYS -- (NAVENG)

DRV - [2009/08/27 04:00:00 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)

DRV - [2009/08/27 04:00:00 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)

DRV - [2009/03/23 12:32:31 | 000,123,952 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)

DRV - [2008/12/19 15:08:12 | 000,319,792 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\srtspl.sys -- (SRTSPL)

DRV - [2008/12/19 15:08:12 | 000,280,112 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\srtsp.sys -- (SRTSP)

DRV - [2008/12/19 15:08:12 | 000,043,824 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srtspx.sys -- (SRTSPX)

DRV - [2008/09/09 14:54:42 | 000,421,424 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)

DRV - [2008/08/21 11:13:56 | 000,191,536 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)

DRV - [2008/08/21 11:13:56 | 000,027,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)

DRV - [2008/05/30 12:37:06 | 000,051,376 | ---- | M] (SafeBoot N.V.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SbAlg.sys -- (SbAlg)

DRV - [2008/05/30 12:37:02 | 000,012,928 | ---- | M] (SafeBoot International) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\SbFsLock.sys -- (SbFsLock)

DRV - [2008/05/30 12:37:00 | 000,012,496 | ---- | M] (SafeBoot International) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\rsvlock.sys -- (RsvLock)

DRV - [2008/05/30 12:36:58 | 000,108,752 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SafeBoot.sys -- (SafeBoot)

DRV - [2008/05/27 09:55:48 | 000,174,600 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\ahcix86.sys -- (ahcix86)

DRV - [2008/05/23 09:51:02 | 000,024,624 | ---- | M] (Hewlett-Packard Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\hpdskflt.sys -- (hpdskflt)

DRV - [2008/05/23 09:50:16 | 000,028,592 | ---- | M] (Hewlett-Packard Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Accelerometer.sys -- (Accelerometer)

DRV - [2008/05/15 20:33:44 | 002,881,536 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2008/05/15 16:29:32 | 000,475,520 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATSwpWDF.sys -- (ATSwpWDF)

DRV - [2008/05/08 10:02:52 | 000,203,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rmcast.sys -- (RMCAST)

DRV - [2008/04/28 18:22:10 | 000,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey)

DRV - [2008/04/13 14:40:58 | 000,008,192 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\changer.sys -- (Changer)

DRV - [2008/04/13 14:40:50 | 000,149,376 | ---- | M] (M-Systems) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\tffsport.sys -- (tffsport)

DRV - [2008/04/13 14:40:26 | 000,034,688 | ---- | M] (Toshiba Corp.) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\lbrtfdc.sys -- (lbrtfdc)

DRV - [2008/04/13 14:39:44 | 000,092,544 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mqac.sys -- (MQAC)

DRV - [2008/04/13 12:36:05 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)

DRV - [2008/04/11 12:19:42 | 000,338,944 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService)

DRV - [2008/04/10 17:27:34 | 001,804,160 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)

DRV - [2008/03/27 14:14:06 | 000,224,672 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP)

DRV - [2008/03/21 14:35:14 | 001,287,552 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)

DRV - [2008/03/12 11:43:26 | 000,015,416 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Amddfltr.sys -- (Amddfltr)

DRV - [2008/02/29 19:13:38 | 001,202,560 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2007/11/29 14:35:44 | 000,163,328 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) Broadcom NetLink

DRV - [2007/06/18 20:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)

DRV - [2007/04/16 19:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)

DRV - [2007/04/04 15:16:20 | 000,041,216 | ---- | M] (Infineon Technologies AG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ifxtpm.sys -- (IFXTPM)

DRV - [2006/01/06 15:07:27 | 000,018,928 | ---- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hphius11.sys -- (Dot4Usb HPH11)

DRV - [2006/01/06 15:07:27 | 000,016,112 | ---- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hphipr11.sys -- (Dot4Print HPH11)

DRV - [2006/01/06 15:07:26 | 000,050,896 | ---- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hphid411.sys -- (Dot4 HPH11)

DRV - [2001/08/17 15:10:28 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA)

DRV - [2001/08/17 11:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)

 

 

========== Standard Registry (SafeList) ==========

 

 

========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://search.msn.com/spbasic.htm

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/27 09:28:05 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/26 08:33:07 | 000,000,000 | ---D | M]

 

[2010/04/26 08:33:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Extensions

[2010/01/05 13:08:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Extensions\[email protected]

[2010/04/30 15:47:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Firefox\Profiles\220ltht1.default\extensions

[2010/04/27 09:10:08 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Firefox\Profiles\220ltht1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010/04/26 08:33:07 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

 

O1 HOSTS File: ([2010/04/27 22:00:27 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll (Apple Inc.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1237572595955 (MUWebControl Class)

O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0...oUploader55.cab (Facebook Photo Uploader 5 Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14)

O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\WINDOWS\system32\APSHook.dll) - C:\WINDOWS\system32\APSHook.dll (Bioscrypt Inc.)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\ackpbsc: DllName - c:\WINDOWS\system32\ackpbsc.dll - C:\WINDOWS\system32\ackpbsc.dll (ActivIdentity)

O20 - Winlogon\Notify\acunlock: DllName - c:\Program Files\ActivIdentity\ActivClient\acunlock.dll - c:\Program Files\ActivIdentity\ActivClient\acunlock.dll (ActivIdentity)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O20 - Winlogon\Notify\OneCard: DllName - c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll - c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll (Bioscrypt Inc.)

O24 - Desktop BackupWallPaper: C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

========== Files/Folders - Created Within 30 Days ==========

 

[2010/05/01 06:59:58 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2010/04/30 23:19:13 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\KSOBECKI\Recent

[2010/04/30 08:45:28 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2010/04/28 22:19:48 | 000,000,000 | ---D | C] -- C:\schrauber

[2010/04/27 21:53:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\pdf995

[2010/04/26 13:48:28 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\drivers\lbrtfdc.sys

[2010/04/26 13:48:28 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\dllcache\lbrtfdc.sys

[2010/04/26 13:48:23 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\changer.sys

[2010/04/26 13:48:23 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\changer.sys

[2010/04/26 13:48:20 | 000,008,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\i2omgmt.sys

[2010/04/26 08:33:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Mozilla

[2010/04/26 08:33:05 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[2010/04/25 18:21:26 | 000,024,064 | ---- | C] (Sonic Focus, Inc) -- C:\WINDOWS\System32\drivers\sfaudio.sys

[2010/04/25 18:18:53 | 000,000,000 | RHSD | C] -- C:\cmdcons

[2010/04/25 18:17:13 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2010/04/25 18:17:12 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2010/04/25 18:17:12 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2010/04/25 18:17:12 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2010/04/25 18:16:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010/04/25 17:36:43 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010/04/24 22:12:12 | 000,562,688 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe

[2010/04/23 10:23:51 | 000,409,600 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJ5000MON.dll

[2010/04/23 10:23:51 | 000,131,072 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJCOINST07.dll

[2010/04/23 10:22:08 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 6.0

[2010/04/22 10:50:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple Computer

[2010/04/22 08:28:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Application Data\Malwarebytes

[2010/04/22 08:27:53 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/04/22 08:27:51 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/04/22 08:27:51 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010/04/22 08:27:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2010/04/22 08:15:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe

[2010/04/21 08:46:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun

[2010/04/20 15:46:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia

[2010/04/20 15:10:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe

[2010/04/20 15:05:58 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ws2_32.dll

[2010/04/12 15:50:39 | 000,249,856 | ---- | C] (TODO: <Company name>) -- C:\WINDOWS\System32\pdfmona.dll

[2009/03/20 20:16:56 | 000,180,224 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll

[2007/07/05 04:28:52 | 000,176,128 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 

========== Files - Modified Within 30 Days ==========

 

[2010/05/01 08:22:55 | 007,077,888 | -H-- | M] () -- C:\Documents and Settings\KSOBECKI\NTUSER.DAT

[2010/04/30 08:54:56 | 000,053,248 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/04/30 07:08:19 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010/04/30 07:06:09 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini

[2010/04/30 06:59:17 | 003,924,193 | R--- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\schrauber.exe

[2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/04/29 07:39:11 | 000,048,745 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\My Documents\s0p17h4102T.docx

[2010/04/29 07:35:17 | 000,056,293 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\April.docx

[2010/04/29 06:32:10 | 000,006,591 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Application Data\PrimoPDFSet.xml

[2010/04/27 22:00:27 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2010/04/27 22:00:18 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/04/27 21:53:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/04/27 21:53:16 | 1875,759,104 | -HS- | M] () -- C:\hiberfil.sys

[2010/04/27 21:51:41 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\ntuser.ini

[2010/04/26 15:58:12 | 000,256,512 | ---- | M] () -- C:\WINDOWS\PEV.exe

[2010/04/26 13:56:51 | 005,364,298 | -H-- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\IconCache.db

[2010/04/26 13:49:20 | 000,007,600 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\w1vjs2h771

[2010/04/26 13:49:20 | 000,007,600 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\w1vjs2h771

[2010/04/26 11:15:13 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010/04/26 08:06:14 | 000,000,791 | ---- | M] () -- C:\WINDOWS\orun32.ini

[2010/04/25 18:19:04 | 000,000,293 | RHS- | M] () -- C:\boot.ini

[2010/04/25 17:33:01 | 000,024,064 | ---- | M] (Sonic Focus, Inc) -- C:\WINDOWS\System32\drivers\sfaudio.sys

[2010/04/24 22:16:06 | 000,293,376 | ---- | M] () -- C:\nvmx55zj.exe

[2010/04/24 22:12:17 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe

[2010/04/23 13:24:13 | 000,013,426 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841

[2010/04/23 13:24:13 | 000,013,426 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\q841

[2010/04/23 10:26:44 | 000,000,775 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\KODAK AiO Home Center.lnk

[2010/04/22 08:27:56 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/04/22 08:19:01 | 000,011,868 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60

[2010/04/22 08:19:01 | 000,011,868 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\34f60

[2010/04/22 08:15:40 | 000,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat

[2010/04/21 02:48:33 | 000,000,094 | ---- | M] () -- C:\WINDOWS\wininit.ini

[2010/04/20 16:58:28 | 000,001,661 | ---- | M] () -- C:\WINDOWS\lsrslt.ini

[2010/04/20 15:42:26 | 000,571,308 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010/04/20 15:42:26 | 000,477,702 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010/04/20 15:42:26 | 000,082,990 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010/04/13 16:31:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2010/04/12 15:54:43 | 000,000,028 | ---- | M] () -- C:\WINDOWS\pdf995.ini

[2010/04/12 15:50:39 | 000,249,856 | ---- | M] (TODO: <Company name>) -- C:\WINDOWS\System32\pdfmona.dll

[2010/04/12 15:50:39 | 000,051,716 | ---- | M] () -- C:\WINDOWS\System32\pdf995mon.dll

[2010/04/08 19:53:37 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 

========== Files Created - No Company Name ==========

 

[2010/04/29 07:39:11 | 000,048,745 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\My Documents\s0p17h4102T.docx

[2010/04/26 13:48:03 | 000,007,600 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\w1vjs2h771

[2010/04/26 13:48:03 | 000,007,600 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\w1vjs2h771

[2010/04/25 18:19:04 | 000,000,223 | ---- | C] () -- C:\Boot.bak

[2010/04/25 18:18:57 | 000,260,272 | ---- | C] () -- C:\cmldr

[2010/04/25 18:17:13 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010/04/25 18:17:12 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010/04/25 18:17:12 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010/04/25 18:17:12 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010/04/25 18:17:12 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010/04/25 17:28:07 | 003,924,193 | R--- | C] () -- C:\Documents and Settings\KSOBECKI\Desktop\schrauber.exe

[2010/04/24 22:16:03 | 000,293,376 | ---- | C] () -- C:\nvmx55zj.exe

[2010/04/23 10:26:44 | 000,000,775 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\KODAK AiO Home Center.lnk

[2010/04/23 10:14:02 | 000,035,634 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\c4u.log

[2010/04/23 07:52:23 | 000,013,426 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841

[2010/04/23 07:52:23 | 000,013,426 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\q841

[2010/04/22 08:27:56 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/04/22 08:17:00 | 1875,759,104 | -HS- | C] () -- C:\hiberfil.sys

[2010/04/22 08:15:40 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat

[2010/04/21 21:49:19 | 000,011,868 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60

[2010/04/21 21:49:19 | 000,011,868 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\34f60

[2010/04/20 17:38:45 | 000,000,094 | ---- | C] () -- C:\WINDOWS\wininit.ini

[2010/04/20 16:58:28 | 000,001,661 | ---- | C] () -- C:\WINDOWS\lsrslt.ini

[2010/04/12 15:54:43 | 000,000,028 | ---- | C] () -- C:\WINDOWS\pdf995.ini

[2010/04/12 15:50:40 | 000,000,142 | ---- | C] () -- C:\WINDOWS\wpd99.drv

[2010/04/12 15:50:39 | 000,051,716 | ---- | C] () -- C:\WINDOWS\System32\pdf995mon.dll

[2010/04/08 19:53:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2010/01/21 22:49:12 | 000,000,044 | ---- | C] () -- C:\WINDOWS\SMWizard.INI

[2009/09/17 19:09:54 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini

[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll

[2009/04/29 12:46:02 | 000,000,034 | ---- | C] () -- C:\WINDOWS\hpfsched.ini

[2009/04/29 12:40:27 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\hpodinet.dll

[2009/04/10 12:37:43 | 000,176,235 | ---- | C] () -- C:\WINDOWS\System32\Primomonnt.dll

[2008/06/22 00:28:19 | 000,028,510 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini

[2008/05/30 12:36:58 | 000,108,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\SafeBoot.sys

[2008/04/28 12:13:33 | 000,000,310 | ---- | C] () -- C:\WINDOWS\primopdf.ini

[2008/04/10 13:27:34 | 001,804,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys

[2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini

[2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini

[2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini

[2007/05/10 02:16:40 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys

[2006/05/19 22:39:58 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini

[2005/04/03 18:30:00 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\scardsyn.dll

[2004/08/07 09:19:16 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2004/08/07 09:12:40 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini

[1998/05/06 23:10:00 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\ODMA32.dll

< End of report >

 

OTL Extras logfile created on: 5/1/2010 8:51:56 AM - Run 3

OTL by OldTimer - Version 3.2.2.0 Folder = C:\Documents and Settings\KSOBECKI\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 40.00% Memory free

4.00 Gb Paging File | 3.00 Gb Available in Paging File | 72.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 231.87 Gb Total Space | 198.90 Gb Free Space | 85.78% Space Free | Partition Type: NTFS

Drive D: | 1.00 Gb Total Space | 0.97 Gb Free Space | 97.24% Space Free | Partition Type: FAT32

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: KENHPLT

Current User Name: KSOBECKI

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

 

========== Extra Registry (SafeList) ==========

 

 

========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 

========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusOverride" = 0

"FirewallOverride" = 0

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 0

"DoNotAllowExceptions" = 0

"DisableNotifications" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

"DisableNotifications" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"1723:TCP" = 1723:TCP:*:Enabled:VPN

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"9322:TCP" = 9322:TCP:*:Enabled:EKDiscovery

 

========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)

"C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe" = C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe:*:Enabled:SMC Service -- (Symantec Corporation)

"C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE" = C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE:*:Enabled:SNAC Service -- (Symantec Corporation)

"C:\Program Files\Common Files\Symantec Shared\ccApp.exe" = C:\Program Files\Common Files\Symantec Shared\ccApp.exe:*:Enabled:Symantec Email -- (Symantec Corporation)

"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)

"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -- (AOL LLC)

"C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AIM -- (AOL LLC)

"C:\WINDOWS\system32\fxsclnt.exe" = C:\WINDOWS\system32\fxsclnt.exe:*:Enabled:Microsoft Fax Console -- (Microsoft Corporation)

"C:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe" = C:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe:*:Enabled:Kodak.AiO.HomeCenter -- (Eastman Kodak Company)

"C:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe" = C:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe:*:Enabled:Kodak.AiO.Statistics -- (Eastman Kodak Company)

"C:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe" = C:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe:*:Enabled:Kodak.AiO.SetupUtility -- (Eastman Kodak Company)

"C:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe" = C:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe:*:Enabled:Kodak.AiO.FwUpdater -- (Eastman Kodak Company)

"C:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe" = C:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe:*:Enabled:Kodak.AiO.Installer -- (Eastman Kodak Company)

 

 

========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{04788045-DEF3-4911-91B5-384A6915F21B}" = TaxCut Ohio 2008

"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center

"{05B62241-5495-46EF-5086-DBE0F37F052C}" = Catalyst Control Center Localization Korean

"{0645A454-AD44-4F0D-99CF-6B762735AD1F}" = aioprnt

"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour

"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer

"{0F98662A-EA83-414F-8766-3FCE46A32641}" = Credential Manager for HP ProtectTools

"{10934A28-0CC6-4B98-A14F-76B3546003AF}" = ksDIP

"{154E4F71-DFC0-4B31-8D99-F97615031B02}" = HP Webcam Application

"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0

"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java 6 Update 14

"{27FE77BD-2E0A-385C-C2CC-8367D877356F}" = CCC Help Norwegian

"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com

"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime

"{2CD54AED-740B-1418-464E-CC8E15AD1E4F}" = Catalyst Control Center Localization Swedish

"{2D0EE88B-8720-50A7-7F31-503B4300A8C5}" = Catalyst Control Center Localization French

"{2D87E961-577B-492B-AD54-1368680FB9A7}" = Bing Maps 3D

"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 E1

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{35EB3E58-F46C-CB48-C623-16A455C37C5D}" = CCC Help Turkish

"{36C491D0-A196-F49C-C63C-3509D7A2B91D}" = CCC Help Finnish

"{37AF26EB-ACCD-4F9C-A13E-81483F932203}" = Catalyst Control Center - Branding

"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = HP Webcam

"{45E6BF4C-6DC8-B1BB-517C-5F2C1D055A9B}" = CCC Help Hungarian

"{48072101-4DFE-9DC2-9F5D-DE0EF7193C98}" = CCC Help Korean

"{48B41C3A-9A92-4B81-B653-C97FEB85C910}" = C4USelfUpdater

"{49798684-CC48-AF5C-E513-9FFF61EFD3A6}" = CCC Help Japanese

"{4BFA6EEB-AAED-4334-8E98-A907DE4DD5CF}" = AMD Driver Support for HP 3D DriverGuard

"{4CF11D44-43B7-1359-B438-972C69D7AD6F}" = CCC Help Spanish

"{4ED20E34-D511-A85B-D7E5-755AE64D5F6C}" = CCC Help Portuguese

"{53A19323-917A-4822-B27E-A57D1EF6E9FC}" = H&R Block Deluxe + Efile + State 2009

"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support

"{56BA241F-580C-43D2-8403-947241AAE633}" = center

"{57B186F6-E6A7-A997-92E6-3E8C6189F497}" = Catalyst Control Center Localization Japanese

"{5AB422C9-E804-1331-233E-E44D8BBC1862}" = CCC Help German

"{5ED80CF6-D54D-5F9B-2B9C-E3B6F927879D}" = CCC Help Czech

"{60AFC32A-B82F-3818-E90B-A71446BBCCD6}" = Catalyst Control Center Localization Greek

"{6162653F-D1AB-6708-C73B-8411296900AE}" = Catalyst Control Center Localization Portuguese

"{6179EAEB-0C72-0241-DC0B-0258E86B982A}" = ccc-core-preinstall

"{64FBF438-35D1-8A01-FB00-36911B07FC72}" = Catalyst Control Center Graphics Light

"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{6B4469FE-20FA-9E1D-6634-CF971706BD24}" = Catalyst Control Center Localization Chinese Traditional

"{6C17DE97-6A5A-FA9C-0F4C-8B027E6AC014}" = CCC Help Russian

"{6FCA773E-903A-5C83-D379-DD53F9EFD794}" = Catalyst Control Center Localization Turkish

"{70CEFEBA-F757-4DBE-8A21-027C326137CE}" = HP Software Setup 5.00.A.7

"{747626CF-7958-290F-A7D8-6EE6549C8614}" = Catalyst Control Center Localization Hungarian

"{75D7BB3A-9AB7-4ad1-AD5E-0059B90C624B}" = HP ProtectTools Security Manager Suite

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7B459B8C-D870-2C14-9BA7-ABFFBCE7CD34}" = CCC Help Italian

"{7BE1B3CE-5476-B847-4719-4421AEC5C663}" = CCC Help Thai

"{7FD8231E-3991-48D7-A2C8-2C42A7075FB1}" = HP User Guide Bluetooth Addendum 0062

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{8595812B-9104-4196-B629-FD298D819399}" = HP User Guides 0097

"{875FDD1A-4259-9361-572C-780AC637C81A}" = Catalyst Control Center Localization Czech

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8F676C36-74D3-9B7B-00FC-733EE5AFDA95}" = CCC Help Chinese Traditional

"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12

"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007

"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007

"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007

"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007

"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007

"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007

"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007

"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007

"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007

"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007

"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007

"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007

"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)

"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)

"{97F4D62E-5AEB-4649-BABF-4712C6EF6845}" = DeductionPro 2009

"{9ADABDDE-9644-461B-9E73-83FA3EFCAB50}" = HP Wireless Assistant

"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR

"{A2CB5EC7-E64F-5E35-2A23-63CB198649F5}" = CCC Help Greek

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser

"{A777845E-F260-4572-787B-2BD08E560C78}" = Catalyst Control Center Localization Spanish

"{A7A1BCB9-B9EE-3DBB-6F1C-570C532B9190}" = CCC Help French

"{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support

"{A9884559-F231-7727-95F4-41FDB052A536}" = Catalyst Control Center Localization Russian

"{AB785290-EA80-7A10-B2C6-98919E514A68}" = Catalyst Control Center Graphics Full New

"{AC194855-F7AC-4D04-B4C9-07BA46FCB697}" = ActivClient 6.1 x86

"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2

"{AEA355A4-997D-A49D-A57A-CF537FFFEC84}" = Skins

"{B18A542F-C99B-73C9-6552-73E1216E8834}" = CCC Help Dutch

"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B5764B71-4BCE-206A-DE15-2E05469AA74C}" = Catalyst Control Center Localization Polish

"{B817499D-2D52-2F37-DF6F-40735748FA88}" = CCC Help English

"{BBB33AD6-BCF7-4002-B6A0-6DC679AE5C18}" = TaxCut Premium + State + Efile 2008

"{BC66641A-3279-BB5E-BEAB-99B39D13B3BD}" = CCC Help Polish

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver

"{C1B0BDC8-0624-4036-90D1-F7DF0EE8C96D}" = Symantec Endpoint Protection

"{C3D86DED-91D7-A890-5E9E-D14D993B5E9E}" = Catalyst Control Center Localization Dutch

"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries

"{C4BEF3C4-9DF1-6D99-6C46-BBBF8E4B07A5}" = ccc-core-static

"{C616F2BE-6A02-4E90-ABC8-B468E8575072}" = H&R Block Ohio 2009

"{C6BB4BD5-15D5-0B2D-CF4A-49BDCD7B3AC3}" = Catalyst Control Center Localization Norwegian

"{C90BE263-E9B8-AD82-C517-3197FA4DA9C4}" = CCC Help Danish

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CBC24502-5EB5-45B6-9E56-E6A2F6AFA367}" = HP JavaCard for HP ProtectTools

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D405A9E1-5D02-46FB-A2B3-796F1F218B32}" = HP ProtectTools Security Manager

"{D9C94F63-6B2C-9BFA-F37C-E48E1B6133E1}" = CCC Help Swedish

"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq

"{DE6B7599-D3EF-4436-8836-BAA0B0D7768D}" = aiofw

"{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK AiO Home Center

"{E19DF3EF-351E-EE5E-623B-1A99C8C3EB5F}" = Catalyst Control Center Graphics Full Existing

"{E2EF1380-9963-C7F9-3478-1046EC008C02}" = Catalyst Control Center Localization Chinese Standard

"{E5C1C126-1687-4868-A3DD-B807176E4970}" = HP 3D DriveGuard

"{E78D8DE3-E3CD-E89C-D5A0-D8FFE5F6E7F9}" = CCC Help Chinese Standard

"{EA7D5022-7744-4D28-0E83-2DF9678C27B6}" = Catalyst Control Center Core Implementation

"{EDD0A584-1ABB-8E7B-97AB-743C7E35EEA7}" = Catalyst Control Center Localization German

"{EFBC8D78-75EA-4BB1-0CC6-172BFDF4B70F}" = Catalyst Control Center Localization Danish

"{F01701B8-2C94-282D-9339-23AFBEDBE3E2}" = Catalyst Control Center Localization Italian

"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX

"{F0BE302E-6B30-B816-4EA3-23CD6A23B08D}" = ccc-utility

"{F173C2B3-296F-458C-98FF-1676A42EBA02}" = HP Wallpaper

"{F657EF23-08BB-4C8D-B688-78C20FA657EA}" = Drive Encryption for HP ProtectTools

"{F940B4EC-8504-CEE5-F36C-C2F5471D9E87}" = Catalyst Control Center Localization Thai

"{FBAA2B2F-002D-45BB-291

Link to post
Share on other sites

Hi,

 

Posted Image Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. NOT supported for use in 9x or ME

 

Upgrading Java:

  • Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 20.
  • Click the "Download" button to the right.
  • Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
  • Click on Continue.
  • Click on the link to download Windows Offline Installation (jre-6u20-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u20-windows-i586.exe and select "Run as an Administrator.")

 

 

 

Run OTL

  • Under the Custom Scans/Fixes box at the bottom, paste in the following
    :OTL
    [2010/04/26 13:49:20 | 000,007,600 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\w1vjs2h771
    [2010/04/26 13:49:20 | 000,007,600 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\w1vjs2h771
    [2010/04/23 13:24:13 | 000,013,426 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841
    [2010/04/23 13:24:13 | 000,013,426 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\q841
    [2010/04/22 08:19:01 | 000,011,868 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60
    [2010/04/22 08:19:01 | 000,011,868 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\34f60
    [2010/04/29 07:39:11 | 000,048,745 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\My Documents\s0p17h4102T.docx
    [2010/04/26 13:48:03 | 000,007,600 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\w1vjs2h771
    [2010/04/26 13:48:03 | 000,007,600 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\w1vjs2h771
    [2010/04/23 07:52:23 | 000,013,426 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841
    [2010/04/23 07:52:23 | 000,013,426 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\q841
    [2010/04/21 21:49:19 | 000,011,868 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60
    [2010/04/21 21:49:19 | 000,011,868 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\34f60
    
  • Then click the Run Fix button at the top
  • Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"
  • Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
================================Follow up scan=================================
  • Double click on OTL to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Standard Registry box change it to All.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open one notepad window. OTL.Txt a This is saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.

How is it running now?

Link to post
Share on other sites

It is running much much better. Thank you. Here are the logs you requested.

 

========== OTL ==========

C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\w1vjs2h771 moved successfully.

C:\Documents and Settings\All Users\Application Data\w1vjs2h771 moved successfully.

C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841 moved successfully.

C:\Documents and Settings\All Users\Application Data\q841 moved successfully.

C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60 moved successfully.

C:\Documents and Settings\All Users\Application Data\34f60 moved successfully.

C:\Documents and Settings\All Users\Documents\My Documents\s0p17h4102T.docx moved successfully.

File C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\w1vjs2h771 not found.

File C:\Documents and Settings\All Users\Application Data\w1vjs2h771 not found.

File C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841 not found.

File C:\Documents and Settings\All Users\Application Data\q841 not found.

File C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60 not found.

File C:\Documents and Settings\All Users\Application Data\34f60 not found.

 

OTL by OldTimer - Version 3.2.2.0 log created on 05012010_222539

 

 

OTL logfile created on: 5/1/2010 10:27:11 PM - Run 4

OTL by OldTimer - Version 3.2.2.0 Folder = C:\Documents and Settings\KSOBECKI\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 40.00% Memory free

4.00 Gb Paging File | 3.00 Gb Available in Paging File | 73.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 231.87 Gb Total Space | 198.75 Gb Free Space | 85.72% Space Free | Partition Type: NTFS

Drive D: | 1.00 Gb Total Space | 0.97 Gb Free Space | 97.23% Space Free | Partition Type: FAT32

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: KENHPLT

Current User Name: KSOBECKI

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 

========== Processes (SafeList) ==========

 

PRC - C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (Symantec Corporation)

PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation)

PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)

PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)

PRC - c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe (Hewlett-Packard Development Company, L.P)

PRC - c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe (SafeBoot International)

PRC - c:\Program Files\Hewlett-Packard\IAM\Bin\asghost.exe (Bioscrypt Inc.)

PRC - c:\Program Files\Fingerprint Sensor\AtService.exe (AuthenTec, Inc.)

PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

PRC - C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)

PRC - c:\Program Files\ActivIdentity\ActivClient\accoca.exe (ActivIdentity)

 

 

========== Modules (SafeList) ==========

 

MOD - C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\WINDOWS\system32\APSHook.dll (Bioscrypt Inc.)

 

 

========== Win32 Services (SafeList) ==========

 

SRV - (Kodak AiO Network Discovery Service) -- C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe (Eastman Kodak Company)

SRV - (SmcService) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation)

SRV - (Symantec AntiVirus) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)

SRV - (SNAC) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE (Symantec Corporation)

SRV - (ccSetMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)

SRV - (ccEvtMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)

SRV - (LiveUpdate) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE (Symantec Corporation)

SRV - (HP ProtectTools Service) -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe (Hewlett-Packard Development Company, L.P)

SRV - (HpFkCryptService) -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe (SafeBoot International)

SRV - (ASBroker) -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll (Bioscrypt Inc.)

SRV - (ASChannel) -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASChnl.dll (Bioscrypt Inc.)

SRV - (ATService) -- c:\Program Files\Fingerprint Sensor\AtService.exe (AuthenTec, Inc.)

SRV - (AgereModemAudio) -- C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems)

SRV - (accoca) -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe (ActivIdentity)

SRV - (Pml Driver HPH11) -- C:\WINDOWS\system32\hphipm11.exe (HP)

 

 

========== Driver Services (SafeList) ==========

 

DRV - (catchme) -- File not found

DRV - (NAVEX15) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100430.036\NAVEX15.SYS (Symantec Corporation)

DRV - (NAVENG) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100430.036\NAVENG.SYS (Symantec Corporation)

DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)

DRV - (EraserUtilRebootDrv) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)

DRV - (SymEvent) -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation)

DRV - (SRTSPL) -- C:\WINDOWS\system32\drivers\srtspl.sys (Symantec Corporation)

DRV - (SRTSP) -- C:\WINDOWS\system32\drivers\srtsp.sys (Symantec Corporation)

DRV - (SRTSPX) -- C:\WINDOWS\system32\drivers\srtspx.sys (Symantec Corporation)

DRV - (SPBBCDrv) -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)

DRV - (SYMTDI) -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)

DRV - (SYMREDRV) -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)

DRV - (SbAlg) -- C:\WINDOWS\system32\drivers\SbAlg.sys (SafeBoot N.V.)

DRV - (SbFsLock) -- C:\WINDOWS\system32\drivers\SbFsLock.sys (SafeBoot International)

DRV - (RsvLock) -- C:\WINDOWS\system32\drivers\rsvlock.sys (SafeBoot International)

DRV - (SafeBoot) -- C:\WINDOWS\system32\drivers\SafeBoot.sys ()

DRV - (ahcix86) -- C:\WINDOWS\System32\DRIVERS\ahcix86.sys (AMD Technologies Inc.)

DRV - (hpdskflt) -- C:\WINDOWS\system32\DRIVERS\hpdskflt.sys (Hewlett-Packard Corporation)

DRV - (Accelerometer) -- C:\WINDOWS\system32\drivers\Accelerometer.sys (Hewlett-Packard Corporation)

DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)

DRV - (ATSwpWDF) -- C:\WINDOWS\system32\drivers\ATSwpWDF.sys (AuthenTec, Inc.)

DRV - (RMCAST) -- C:\WINDOWS\system32\drivers\rmcast.sys (Microsoft Corporation)

DRV - (HBtnKey) -- C:\WINDOWS\system32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)

DRV - (Changer) -- C:\WINDOWS\system32\drivers\changer.sys (Microsoft Corporation)

DRV - (tffsport) -- C:\WINDOWS\system32\DRIVERS\tffsport.sys (M-Systems)

DRV - (lbrtfdc) -- C:\WINDOWS\system32\drivers\lbrtfdc.sys (Toshiba Corp.)

DRV - (MQAC) -- C:\WINDOWS\system32\drivers\mqac.sys (Microsoft Corporation)

DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider)

DRV - (ADIHdAudAddService) -- C:\WINDOWS\system32\drivers\ADIHdAud.sys (Analog Devices, Inc.)

DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\WINDOWS\system32\drivers\snp2uvc.sys ()

DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)

DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)

DRV - (Amddfltr) -- C:\WINDOWS\system32\DRIVERS\Amddfltr.sys (Advanced Micro Devices)

DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems)

DRV - (b57w2k) Broadcom NetLink -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)

DRV - (HpqKbFiltr) -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.)

DRV - (AmdPPM) -- C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices)

DRV - (IFXTPM) -- C:\WINDOWS\system32\drivers\ifxtpm.sys (Infineon Technologies AG)

DRV - (Dot4Usb HPH11) -- C:\WINDOWS\system32\drivers\hphius11.sys (HP)

DRV - (Dot4Print HPH11) -- C:\WINDOWS\system32\drivers\hphipr11.sys (HP)

DRV - (Dot4 HPH11) -- C:\WINDOWS\system32\drivers\hphid411.sys (HP)

DRV - (SMCIRDA) -- C:\WINDOWS\system32\drivers\smcirda.sys (SMC)

DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.)

 

 

========== Standard Registry (All) ==========

 

 

========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://search.msn.com/spbasic.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/06/24 22:30:06 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2010/05/01 22:21:45 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/27 09:28:05 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/05/01 22:22:03 | 000,000,000 | ---D | M]

 

[2010/04/26 08:33:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Extensions

[2010/04/26 08:33:31 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

[2010/01/05 13:08:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Extensions\[email protected]

[2010/04/30 15:47:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Firefox\Profiles\220ltht1.default\extensions

[2010/04/27 09:10:08 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Firefox\Profiles\220ltht1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010/05/01 22:22:05 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2010/04/26 08:33:07 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2010/05/01 22:22:05 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010/04/01 13:58:18 | 000,023,000 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll

[2010/04/01 13:58:19 | 000,138,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll

[2010/05/01 22:21:44 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

[2010/04/01 13:58:20 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll

[2010/04/01 11:56:18 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml

[2010/04/01 11:56:18 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml

[2010/04/01 11:56:18 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml

[2010/04/01 11:56:18 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml

[2010/04/01 11:56:18 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml

[2010/04/01 11:56:18 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml

[2010/04/01 11:56:18 | 000,001,096 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml

 

O1 HOSTS File: ([2010/04/27 22:00:27 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)

O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NofolderOptions = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0

O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll (Apple Inc.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)

O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1237572595955 (MUWebControl Class)

O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager)

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0...oUploader55.cab (Facebook Photo Uploader 5 Control)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 72.240.13.6 72.240.13.5 72.240.1.206

O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)

O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp - No CLSID value found

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)

O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)

O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - AppInit_DLLs: (C:\WINDOWS\system32\APSHook.dll) - C:\WINDOWS\system32\APSHook.dll (Bioscrypt Inc.)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\Userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)

O20 - Winlogon\Notify\ackpbsc: DllName - c:\WINDOWS\system32\ackpbsc.dll - C:\WINDOWS\system32\ackpbsc.dll (ActivIdentity)

O20 - Winlogon\Notify\acunlock: DllName - c:\Program Files\ActivIdentity\ActivClient\acunlock.dll - c:\Program Files\ActivIdentity\ActivClient\acunlock.dll (ActivIdentity)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)

O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)

O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)

O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)

O20 - Winlogon\Notify\OneCard: DllName - c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll - c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll (Bioscrypt Inc.)

O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)

O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation)

O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)

O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O24 - Desktop Components:0 (My Current Home Page) - About:Home

O24 - Desktop BackupWallPaper: C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)

O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)

O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

========== Files/Folders - Created Within 30 Days ==========

 

[2010/05/01 22:25:39 | 000,000,000 | ---D | C] -- C:\_OTL

[2010/05/01 22:22:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun

[2010/05/01 22:22:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2010/05/01 22:22:03 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll

[2010/05/01 22:22:03 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2010/05/01 22:22:03 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2010/05/01 22:22:03 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2010/05/01 22:22:03 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl

[2010/05/01 22:20:22 | 016,295,712 | ---- | C] (Sun Microsystems, Inc.) -- C:\Documents and Settings\KSOBECKI\Desktop\jre-6u20-windows-i586.exe

[2010/05/01 06:59:58 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2010/04/30 23:19:13 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\KSOBECKI\Recent

[2010/04/30 08:45:28 | 000,000,000 | -HSD | C] -- C:\RECYCLER

[2010/04/28 22:19:48 | 000,000,000 | ---D | C] -- C:\schrauber

[2010/04/27 21:53:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\pdf995

[2010/04/26 13:48:28 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\drivers\lbrtfdc.sys

[2010/04/26 13:48:28 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\dllcache\lbrtfdc.sys

[2010/04/26 13:48:23 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\changer.sys

[2010/04/26 13:48:23 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\changer.sys

[2010/04/26 13:48:20 | 000,008,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\i2omgmt.sys

[2010/04/26 08:33:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Mozilla

[2010/04/26 08:33:05 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[2010/04/25 18:21:26 | 000,024,064 | ---- | C] (Sonic Focus, Inc) -- C:\WINDOWS\System32\drivers\sfaudio.sys

[2010/04/25 18:18:53 | 000,000,000 | RHSD | C] -- C:\cmdcons

[2010/04/25 18:17:13 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe

[2010/04/25 18:17:12 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe

[2010/04/25 18:17:12 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe

[2010/04/25 18:17:12 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe

[2010/04/25 18:16:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010/04/25 17:36:43 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010/04/24 22:12:12 | 000,562,688 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe

[2010/04/23 10:23:51 | 000,409,600 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJ5000MON.dll

[2010/04/23 10:23:51 | 000,131,072 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJCOINST07.dll

[2010/04/23 10:22:08 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 6.0

[2010/04/22 10:50:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple Computer

[2010/04/22 08:28:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Application Data\Malwarebytes

[2010/04/22 08:27:53 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/04/22 08:27:51 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/04/22 08:27:51 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010/04/22 08:27:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes

[2010/04/22 08:15:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe

[2010/04/21 08:46:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun

[2010/04/20 15:46:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia

[2010/04/20 15:10:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe

[2010/04/20 15:05:58 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ws2_32.dll

[2010/04/12 15:50:39 | 000,249,856 | ---- | C] (TODO: <Company name>) -- C:\WINDOWS\System32\pdfmona.dll

[2009/03/20 20:16:56 | 000,180,224 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll

[2007/07/05 04:28:52 | 000,176,128 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 

========== Files - Modified Within 30 Days ==========

 

[2010/05/01 22:21:43 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2010/05/01 22:21:43 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2010/05/01 22:21:43 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2010/05/01 22:21:43 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl

[2010/05/01 22:21:42 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll

[2010/05/01 22:21:03 | 016,295,712 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\KSOBECKI\Desktop\jre-6u20-windows-i586.exe

[2010/05/01 09:48:09 | 000,022,371 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\April.docx

[2010/05/01 08:22:55 | 007,077,888 | -H-- | M] () -- C:\Documents and Settings\KSOBECKI\NTUSER.DAT

[2010/04/30 08:54:56 | 000,053,248 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/04/30 07:08:19 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010/04/30 07:06:09 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini

[2010/04/30 06:59:17 | 003,924,193 | R--- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\schrauber.exe

[2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys

[2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2010/04/29 06:32:10 | 000,006,591 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Application Data\PrimoPDFSet.xml

[2010/04/27 22:00:27 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2010/04/27 22:00:18 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/04/27 21:53:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/04/27 21:53:16 | 1875,759,104 | -HS- | M] () -- C:\hiberfil.sys

[2010/04/27 21:51:41 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\ntuser.ini

[2010/04/26 15:58:12 | 000,256,512 | ---- | M] () -- C:\WINDOWS\PEV.exe

[2010/04/26 13:56:51 | 005,364,298 | -H-- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\IconCache.db

[2010/04/26 11:15:13 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat

[2010/04/26 08:06:14 | 000,000,791 | ---- | M] () -- C:\WINDOWS\orun32.ini

[2010/04/25 18:19:04 | 000,000,293 | RHS- | M] () -- C:\boot.ini

[2010/04/25 17:33:01 | 000,024,064 | ---- | M] (Sonic Focus, Inc) -- C:\WINDOWS\System32\drivers\sfaudio.sys

[2010/04/24 22:16:06 | 000,293,376 | ---- | M] () -- C:\nvmx55zj.exe

[2010/04/24 22:12:17 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe

[2010/04/23 10:26:44 | 000,000,775 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\KODAK AiO Home Center.lnk

[2010/04/22 08:27:56 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/04/22 08:15:40 | 000,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat

[2010/04/21 02:48:33 | 000,000,094 | ---- | M] () -- C:\WINDOWS\wininit.ini

[2010/04/20 16:58:28 | 000,001,661 | ---- | M] () -- C:\WINDOWS\lsrslt.ini

[2010/04/20 15:42:26 | 000,571,308 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010/04/20 15:42:26 | 000,477,702 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010/04/20 15:42:26 | 000,082,990 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010/04/13 16:31:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job

[2010/04/12 15:54:43 | 000,000,028 | ---- | M] () -- C:\WINDOWS\pdf995.ini

[2010/04/12 15:50:39 | 000,249,856 | ---- | M] (TODO: <Company name>) -- C:\WINDOWS\System32\pdfmona.dll

[2010/04/12 15:50:39 | 000,051,716 | ---- | M] () -- C:\WINDOWS\System32\pdf995mon.dll

[2010/04/08 19:53:37 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

 

========== Files Created - No Company Name ==========

 

[2010/04/25 18:19:04 | 000,000,223 | ---- | C] () -- C:\Boot.bak

[2010/04/25 18:18:57 | 000,260,272 | ---- | C] () -- C:\cmldr

[2010/04/25 18:17:13 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe

[2010/04/25 18:17:12 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe

[2010/04/25 18:17:12 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe

[2010/04/25 18:17:12 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe

[2010/04/25 18:17:12 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe

[2010/04/25 17:28:07 | 003,924,193 | R--- | C] () -- C:\Documents and Settings\KSOBECKI\Desktop\schrauber.exe

[2010/04/24 22:16:03 | 000,293,376 | ---- | C] () -- C:\nvmx55zj.exe

[2010/04/23 10:26:44 | 000,000,775 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\KODAK AiO Home Center.lnk

[2010/04/23 10:14:02 | 000,035,634 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\c4u.log

[2010/04/22 08:27:56 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk

[2010/04/22 08:17:00 | 1875,759,104 | -HS- | C] () -- C:\hiberfil.sys

[2010/04/22 08:15:40 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat

[2010/04/20 17:38:45 | 000,000,094 | ---- | C] () -- C:\WINDOWS\wininit.ini

[2010/04/20 16:58:28 | 000,001,661 | ---- | C] () -- C:\WINDOWS\lsrslt.ini

[2010/04/12 15:54:43 | 000,000,028 | ---- | C] () -- C:\WINDOWS\pdf995.ini

[2010/04/12 15:50:40 | 000,000,142 | ---- | C] () -- C:\WINDOWS\wpd99.drv

[2010/04/12 15:50:39 | 000,051,716 | ---- | C] () -- C:\WINDOWS\System32\pdf995mon.dll

[2010/04/08 19:53:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2010/01/21 22:49:12 | 000,000,044 | ---- | C] () -- C:\WINDOWS\SMWizard.INI

[2009/09/17 19:09:54 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini

[2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll

[2009/04/29 12:46:02 | 000,000,034 | ---- | C] () -- C:\WINDOWS\hpfsched.ini

[2009/04/29 12:40:27 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\hpodinet.dll

[2009/04/10 12:37:43 | 000,176,235 | ---- | C] () -- C:\WINDOWS\System32\Primomonnt.dll

[2008/06/22 00:28:19 | 000,028,510 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini

[2008/05/30 12:36:58 | 000,108,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\SafeBoot.sys

[2008/04/28 12:13:33 | 000,000,310 | ---- | C] () -- C:\WINDOWS\primopdf.ini

[2008/04/10 13:27:34 | 001,804,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys

[2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini

[2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini

[2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini

[2007/05/10 02:16:40 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys

[2006/05/19 22:39:58 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini

[2005/04/03 18:30:00 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\scardsyn.dll

[2004/08/07 09:19:16 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2004/08/07 09:12:40 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini

[1998/05/06 23:10:00 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\ODMA32.dll

< End of report >

Link to post
Share on other sites

Hi,

 

Delete ComboFix and Clean Up

Click Start > Run > type combofix /Uninstall > OK (Note the space between combofix and /Uninstall)

Please advise if this step is missed for any reason as it performs some important actions.

 

 

 

 

 

Please run OTL one more time and hit Cleanup. This will remove OTL and all helper tools.

 

 

 

 

 

 

Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it Clean :)

 

Hiding Hidden Files

Please set your system to hide all hidden files.

Click Start, open My Computer, select the Tools menu and click Folder Options.

Select the View Tab. Under the Hidden files and folders heading, uncheck Show hidden files and folders.

Check: Hide file extensions for known file types

Check the Hide protected operating system files (recommended) option.

Click Yes to confirm.

 

Purging System Restore Points

Now you should Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

 

The easiest and safest way to do this is:

  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then go to Start > Run and type: Cleanmgr
  • Click "OK".
  • Click the "More Options" Tab.
  • Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.
One of the most common questions found when cleaning Spyware or other Malware is "how did my machine get infected?". There are a variety of reasons, but the most common ones are that you are going to sites that you are not practicing Safe Internet, you are not running the proper security software, and that your computer's security settings are set too low.

 

Below I have outlined a series of categories that outline how you can increase the security of your computer so that you will not be infected again in the future.

 

 

Practice Safe Internet

 

One of the main reasons people get infected in the first place is that they are not practicing Safe Internet. You practice Safe Internet when you educate yourself on how to properly use the Internet through the use of security tools and good practice. Knowing how you can get infected and what types of files and sites to avoid will be the most crucial step in keeping your computer malware free. The reality is that the majority of people who are infected with malware are ones who click on things they shouldn't be clicking on. Whether these things are files or sites it doesn't really matter. If something is out to get you, and you click on it, it most likely will. Below are a list of simple precautions to take to keep your computer clean and running securely:

  • If you receive an attachment from someone you do not know, DO NOT OPEN IT! Simple as that. Opening attachments from people you do not know is a very common method for viruses or worms to infect your computer.

     

  • If you receive an attachment and it ends with a .exe, .com, .bat, or .pif do not open the attachment unless you know for a fact that it is clean. For the casual computer user, you will almost never receive a valid attachment of this type.

     

  • If you receive an attachment from someone you know, and it looks suspicious, then it probably is. The email could be from someone you know infected with a malware that is trying to infect everyone in their address book.

     

  • If you are browsing the Internet and a popup appears saying that you are infected, ignore it!. These are, as far as I am concerned, scams that are being used to scare you into purchasing a piece of software.

     

    There are also programs that disguise themselves as Anti-Spyware or security products but are instead scams. For a list of these types of programs we recommend you visit this link: Rogue/Suspect Anti-Spyware Products & Web Sites

     

  • Another tactic to fool you on the web is when a site displays a popup that looks like a normal Windows message or alert. When you click on them, though, they instead bring you to another site that is trying to push a product on you. We suggest that you close these windows by clicking on the X instead of the OK button. Alternatively, you can check to see if it's a real alert by right-clicking on the window. If there is a menu that comes up saying Add to Favorites... you know it's a fake.

     

  • Do not go to adult sites. I know this may bother some of you, but the fact is that a large amount of malware is pushed through these types of sites. I am not saying all adult sites do this, but a lot do.

     

  • When using an Instant Messaging program be cautious about clicking on links people send to you. It is not uncommon for infections to send a message to everyone in the infected person's contact list that contains a link to an infection. Instead when you receive a message that contains a link, message back to the person asking if it is legit before you click on it.

     

  • Stay away from Warez and Crack sites! In addition to the obvious copyright issues, the downloads from these sites are typically overrun with infections.

     

  • Be careful of what you download off of web sites and Peer-2-Peer networks. Some sites disguise malware as legitimate software to trick you into installing them and Peer-2-Peer networks are crawling with it. If you want to download a piece of software a from a site, and are not sure if they are legitimate, you can use McAfee Siteadvisor to look up info on the site.

     

  • DO NOT INSTALL any software without first reading the End User License Agreement, otherwise known as the EULA. A tactic that some developers use is to offer their software for free, but have spyware and other programs you do not want bundled with it. This is where they make their money. By reading the agreement there is a good chance you can spot this and not install the software.
Visit Microsoft's Windows Update Site Frequently

 

It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

 

 

Make Internet Explorer 7 more secure

  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.

    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
Link to post
Share on other sites

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

 

If your the topic starter, and need this topic reopened, please contact me via pm with the address of the thread.

 

Everyone else please begin a New Topic.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
×
×
  • Create New...