kensob Posted April 23, 2010 Share Posted April 23, 2010 Jon Tom said Hello kensob You had some very nasty stuff on your machine (Backdoors and Rootkits). It may be the case that there are still a few things that need to be taken care of. If I were you I would create a thread in the HJT forum and ask the good people there to check your system: http://forums.pcpitstop.com/index.php?showforum=25 Include a link to this thread or alternatively post the MBAM log in the new thread. Then wait for a Trusted HJT Advisor to get in touch. They will ask you to perform some system scans and then advise you if anything else needs to be done. JonTom Here are the results of the scan. Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Database version: 4021 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 4/22/2010 8:38:59 AM mbam-log-2010-04-22 (08-38-59).txt Scan type: Quick scan Objects scanned: 113818 Time elapsed: 8 minute(s), 41 second(s) Memory Processes Infected: 1 Memory Modules Infected: 1 Registry Keys Infected: 8 Registry Values Infected: 2 Registry Data Items Infected: 3 Folders Infected: 0 Files Infected: 7 Memory Processes Infected: C:\Documents and Settings\MYNAME\Local Settings\Application Data\vma.exe (Rogue.MultipleAV) -> Unloaded process successfully. Memory Modules Infected: c:\WINDOWS\system32\6to4v32.dll (Backdoor.Bot) -> Delete on reboot. Registry Keys Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6to4 (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{98279c38-de4b-4bcf-93c9-8ec26069d6f4} (Adware.SelectRebates) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\PRAGMA (Rootkit.TDSS) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\YVIBBBHA8C (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\B1RQJ7YJ0U (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\QZAIB7KITK (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{98279c38-de4b-4bcf-93c9-8ec26069d6f4} (Adware.SelectRebates) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\winid (Malware.Trace) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 93.188.162.185,93.188.161.153 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{252e4288-fd55-4506-a456-9208c6be7cc8}\NameServer (Trojan.DNSChanger) -> Data: 93.188.162.185,93.188.161.153 -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{c6bef952-dc8f-4435-8004-795aa3183414}\NameServer (Trojan.DNSChanger) -> Data: 93.188.162.185,93.188.161.153 -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: c:\WINDOWS\system32\6to4v32.dll (Backdoor.Bot) -> Delete on reboot. C:\Program Files\Internet Explorer\ws2_32.dll (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\system32\scsichk.sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\Jpadia.exe (Trojan.CodecPack) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Favorites\_favdata.dat (Malware.Trace) -> Quarantined and deleted successfully. C:\Documents and Settings\MYNAME\Local Settings\Application Data\vma.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully. C:\WINDOWS\system32\certstore.dat (Trojan.Agent) -> Quarantined and deleted successfully. Link to post Share on other sites
schrauber Posted April 24, 2010 Share Posted April 24, 2010 Hello, kensob Welcome to the PCPitstop Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems. Please take note of some guidelines for this fix: Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix. If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken. Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post. Please set your system to show all files.Click Start, open My Computer, select the Tools menu and click Folder Options. Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders. Uncheck: Hide file extensions for known file types Uncheck the Hide protected operating system files (recommended) option. Click Yes to confirm. Please download OTL from one of the following mirrors:This is THE Mirror Save it to your desktop. Double click on the icon on your desktop. Under the Custom Scan box paste this innetsvcs %SYSTEMDRIVE%\*.exe /md5start eventlog.dll scecli.dll netlogon.dll cngaudit.dll sceclt.dll ntelogon.dll logevent.dll iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys /md5stop %systemroot%\*. /mp /s CREATERESTOREPOINT Push the Quick Scan button. Two reports will open, copy and paste them in a reply here: OTL.txt <-- Will be opened Extra.txt <-- Will be minimized Download GMER from Here. Note the file's name and save it to your root folder, such as C:\. Disconnect from the Internet and close all running programs. Temporarily disable any real-time active protection so your security program drivers will not conflict with this file. Click on this link to see a list of programs that should be disabled. Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator") Allow the driver to load if asked. You may be prompted to scan immediately if it detects rootkit activity. If you are prompted to scan your system click "No", save the log and post back the results. If not prompted, click the "Rootkit/Malware" tab. On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked. Select all drives that are connected to your system to be scanned. Click the Scan button to begin. (Please be patient as it can take some time to complete) When the scan is finished, click Save to save the scan results to your Desktop. Save the file as Results.log and copy/paste the contents in your next reply. Exit the program and re-enable all active protection when done. Link to post Share on other sites
kensob Posted April 25, 2010 Author Share Posted April 25, 2010 Hello, kensob Welcome to the PCPitstop Forums. My name is Thomas (Tom is fine), and I will be helping you fixing your problems. Please take note of some guidelines for this fix: Refrain from making any changes to your computer including installing/uninstall programs, deleting files, modifying the registry, and running scanners or tools. Doing so could cause changes to the directions I have to give you and prolong the time required. Further more, you should not be taking any advice relating to this computer from any other source throughout the course of this fix. If you do not understand any step(s) provided, please do not hesitate to ask before continuing. I would much rather clarify instructions or explain them differently than have something important broken. Even if things appear to be better, it might not mean we are finished. Please continue to follow my instructions and reply back until I give you the "all clean". We do not want to clean you part-way, only to have the system re-infect itself. Do not start a new topic. The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post. Please set your system to show all files.Click Start, open My Computer, select the Tools menu and click Folder Options. Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders. Uncheck: Hide file extensions for known file types Uncheck the Hide protected operating system files (recommended) option. Click Yes to confirm. Please download OTL from one of the following mirrors:This is THE Mirror Save it to your desktop. Double click on the icon on your desktop. Under the Custom Scan box paste this innetsvcs %SYSTEMDRIVE%\*.exe /md5start eventlog.dll scecli.dll netlogon.dll cngaudit.dll sceclt.dll ntelogon.dll logevent.dll iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys /md5stop %systemroot%\*. /mp /s CREATERESTOREPOINT Push the Quick Scan button. Two reports will open, copy and paste them in a reply here: OTL.txt <-- Will be opened Extra.txt <-- Will be minimized Download GMER from Here. Note the file's name and save it to your root folder, such as C:\.Disconnect from the Internet and close all running programs. Temporarily disable any real-time active protection so your security program drivers will not conflict with this file. Click on this link to see a list of programs that should be disabled. Double-click on the downloaded file to start the program. (If running Vista, right click on it and select "Run as an Administrator") Allow the driver to load if asked. You may be prompted to scan immediately if it detects rootkit activity. If you are prompted to scan your system click "No", save the log and post back the results. If not prompted, click the "Rootkit/Malware" tab. On the right-side, all items to be scanned should be checked by default except for "Show All". Leave that box unchecked. Select all drives that are connected to your system to be scanned. Click the Scan button to begin. (Please be patient as it can take some time to complete) When the scan is finished, click Save to save the scan results to your Desktop. Save the file as Results.log and copy/paste the contents in your next reply. Exit the program and re-enable all active protection when done. Link to post Share on other sites
kensob Posted April 25, 2010 Author Share Posted April 25, 2010 OTL logfile created on: 4/24/2010 10:33:53 PM - Run 1 OTL by OldTimer - Version 3.2.2.0 Folder = C:\Documents and Settings\KSOBECKI\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 51.00% Memory free 4.00 Gb Paging File | 3.00 Gb Available in Paging File | 78.00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 231.87 Gb Total Space | 199.23 Gb Free Space | 85.92% Space Free | Partition Type: NTFS Drive D: | 1.00 Gb Total Space | 0.97 Gb Free Space | 97.24% Space Free | Partition Type: FAT32 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: KENHPLT Current User Name: KSOBECKI Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 90 Days Output = Standard Quick Scan ========== Processes (SafeList) ========== PRC - [2010/04/24 22:12:17 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe PRC - [2010/02/11 15:36:12 | 000,300,400 | ---- | M] (Eastman Kodak Company) -- C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe PRC - [2010/02/08 12:09:00 | 001,634,304 | ---- | M] (Eastman Kodak Company) -- C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe PRC - [2009/02/26 15:07:10 | 001,443,144 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe PRC - [2009/02/26 15:07:08 | 001,799,496 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe PRC - [2009/02/01 23:37:00 | 002,440,120 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe PRC - [2008/12/18 16:47:22 | 000,115,560 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe PRC - [2008/12/18 16:46:30 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe PRC - [2008/06/02 13:32:16 | 000,018,944 | ---- | M] (Hewlett-Packard Development Company, L.P) -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe PRC - [2008/05/30 12:36:20 | 000,256,512 | ---- | M] (SafeBoot International) -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe PRC - [2008/05/20 20:47:18 | 000,065,296 | ---- | M] (Bioscrypt Inc.) -- c:\Program Files\Hewlett-Packard\IAM\Bin\asghost.exe PRC - [2008/05/15 18:11:12 | 001,176,824 | ---- | M] (AuthenTec, Inc.) -- c:\Program Files\Fingerprint Sensor\AtService.exe PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2008/04/04 11:09:56 | 001,044,480 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe PRC - [2007/12/11 15:15:04 | 000,012,800 | ---- | M] (Agere Systems) -- C:\WINDOWS\system32\agrsmsvc.exe PRC - [2007/05/15 19:08:40 | 000,182,576 | ---- | M] (ActivIdentity) -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe ========== Modules (SafeList) ========== MOD - [2010/04/24 22:12:17 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe MOD - [2008/03/25 08:17:04 | 000,076,048 | ---- | M] (Bioscrypt Inc.) -- C:\WINDOWS\system32\APSHook.dll ========== Win32 Services (SafeList) ========== SRV - [2010/02/11 15:36:12 | 000,300,400 | ---- | M] (Eastman Kodak Company) [Auto | Running] -- C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe -- (Kodak AiO Network Discovery Service) SRV - [2009/02/26 15:07:08 | 001,799,496 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService) SRV - [2009/02/01 23:37:00 | 002,440,120 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus) SRV - [2009/02/01 21:43:02 | 000,320,840 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE -- (SNAC) SRV - [2008/12/18 16:46:30 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Stopped] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (EraserSvc10923) SRV - [2008/12/18 16:46:30 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr) SRV - [2008/12/18 16:46:30 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr) SRV - [2008/12/10 15:46:58 | 003,093,880 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate) SRV - [2008/06/02 13:32:16 | 000,018,944 | ---- | M] (Hewlett-Packard Development Company, L.P) [Auto | Running] -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe -- (HP ProtectTools Service) SRV - [2008/05/30 12:36:20 | 000,256,512 | ---- | M] (SafeBoot International) [Auto | Running] -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe -- (HpFkCryptService) SRV - [2008/05/20 20:42:40 | 000,111,888 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll -- (ASBroker) SRV - [2008/05/20 20:42:34 | 000,137,488 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASChnl.dll -- (ASChannel) SRV - [2008/05/15 18:11:12 | 001,176,824 | ---- | M] (AuthenTec, Inc.) [Auto | Running] -- c:\Program Files\Fingerprint Sensor\AtService.exe -- (ATService) SRV - [2007/12/11 15:15:04 | 000,012,800 | ---- | M] (Agere Systems) [Auto | Running] -- C:\WINDOWS\system32\agrsmsvc.exe -- (AgereModemAudio) SRV - [2007/05/15 19:08:40 | 000,182,576 | ---- | M] (ActivIdentity) [Auto | Running] -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe -- (accoca) SRV - [2006/01/06 15:07:26 | 000,077,824 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\hphipm11.exe -- (Pml Driver HPH11) ========== Driver Services (SafeList) ========== DRV - [2010/04/24 22:29:16 | 000,024,064 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfaudio.sys -- (SFAUDIO) DRV - [2010/02/16 05:00:00 | 001,324,720 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100424.020\NAVEX15.SYS -- (NAVEX15) DRV - [2010/02/16 05:00:00 | 000,084,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100424.020\NAVENG.SYS -- (NAVENG) DRV - [2009/08/27 04:00:00 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl) DRV - [2009/08/27 04:00:00 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv) DRV - [2009/03/23 12:32:31 | 000,123,952 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent) DRV - [2008/12/19 15:08:12 | 000,319,792 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\srtspl.sys -- (SRTSPL) DRV - [2008/12/19 15:08:12 | 000,280,112 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\srtsp.sys -- (SRTSP) DRV - [2008/12/19 15:08:12 | 000,043,824 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srtspx.sys -- (SRTSPX) DRV - [2008/09/09 14:54:42 | 000,421,424 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv) DRV - [2008/08/21 11:13:56 | 000,191,536 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI) DRV - [2008/08/21 11:13:56 | 000,027,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV) DRV - [2008/05/30 12:37:06 | 000,051,376 | ---- | M] (SafeBoot N.V.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SbAlg.sys -- (SbAlg) DRV - [2008/05/30 12:37:02 | 000,012,928 | ---- | M] (SafeBoot International) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\SbFsLock.sys -- (SbFsLock) DRV - [2008/05/30 12:37:00 | 000,012,496 | ---- | M] (SafeBoot International) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\rsvlock.sys -- (RsvLock) DRV - [2008/05/30 12:36:58 | 000,108,752 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SafeBoot.sys -- (SafeBoot) DRV - [2008/05/27 09:55:48 | 000,174,600 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\ahcix86.sys -- (ahcix86) DRV - [2008/05/23 09:51:02 | 000,024,624 | ---- | M] (Hewlett-Packard Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\hpdskflt.sys -- (hpdskflt) DRV - [2008/05/23 09:50:16 | 000,028,592 | ---- | M] (Hewlett-Packard Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Accelerometer.sys -- (Accelerometer) DRV - [2008/05/15 20:33:44 | 002,881,536 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2008/05/15 16:29:32 | 000,475,520 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATSwpWDF.sys -- (ATSwpWDF) DRV - [2008/05/08 10:02:52 | 000,203,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rmcast.sys -- (RMCAST) DRV - [2008/04/28 18:22:10 | 000,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey) DRV - [2008/04/13 14:40:50 | 000,149,376 | ---- | M] (M-Systems) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\tffsport.sys -- (tffsport) DRV - [2008/04/13 14:39:44 | 000,092,544 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mqac.sys -- (MQAC) DRV - [2008/04/13 12:36:05 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2008/04/11 12:19:42 | 000,338,944 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService) DRV - [2008/04/10 17:27:34 | 001,804,160 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC) DRV - [2008/03/27 14:14:06 | 000,224,672 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP) DRV - [2008/03/21 14:35:14 | 001,287,552 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX) DRV - [2008/03/12 11:43:26 | 000,015,416 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Amddfltr.sys -- (Amddfltr) DRV - [2008/02/29 19:13:38 | 001,202,560 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2007/11/29 14:35:44 | 000,163,328 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) Broadcom NetLink DRV - [2007/06/18 20:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr) DRV - [2007/04/16 19:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM) DRV - [2007/04/04 15:16:20 | 000,041,216 | ---- | M] (Infineon Technologies AG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ifxtpm.sys -- (IFXTPM) DRV - [2006/01/06 15:07:27 | 000,018,928 | ---- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hphius11.sys -- (Dot4Usb HPH11) DRV - [2006/01/06 15:07:27 | 000,016,112 | ---- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hphipr11.sys -- (Dot4Print HPH11) DRV - [2006/01/06 15:07:26 | 000,050,896 | ---- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hphid411.sys -- (Dot4 HPH11) DRV - [2001/08/17 15:10:28 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA) DRV - [2001/08/17 11:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\Extensions\\{E3278AD6-FAF3-496F-906E-18B81B7B083E}: C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\{E3278AD6-FAF3-496F-906E-18B81B7B083E} [2010/04/20 15:40:35 | 000,000,000 | ---D | M] [2010/04/22 10:12:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Extensions [2010/01/05 13:08:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Extensions\[email protected] O1 HOSTS File: ([2010/04/22 10:32:41 | 000,392,702 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 13564 more lines... O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation) O4 - HKLM..\Run: [Conime] C:\WINDOWS\system32\conime.exe (Microsoft Corporation) O4 - HKLM..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\Cpqset.exe () O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company) O4 - HKLM..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.) O4 - HKLM..\Run: [startCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll (Apple Inc.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1237572595955 (MUWebControl Class) O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager) O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0...oUploader55.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (APSHook.dll) - C:\WINDOWS\System32\APSHook.dll (Bioscrypt Inc.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\ackpbsc: DllName - c:\WINDOWS\system32\ackpbsc.dll - C:\WINDOWS\system32\ackpbsc.dll (ActivIdentity) O20 - Winlogon\Notify\acunlock: DllName - c:\Program Files\ActivIdentity\ActivClient\acunlock.dll - c:\Program Files\ActivIdentity\ActivClient\acunlock.dll (ActivIdentity) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\OneCard: DllName - c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll - c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll (Bioscrypt Inc.) O24 - Desktop BackupWallPaper: C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: Ias - C:\WINDOWS\system32\ias [2008/06/21 23:26:35 | 000,000,000 | ---D | M] NetSvcs: Iprip - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: SSHNAS - File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point (69256455022182400) ========== Files/Folders - Created Within 90 Days ========== [2010/04/24 22:12:12 | 000,562,688 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe [2010/04/24 22:07:13 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\KSOBECKI\Recent [2010/04/23 10:23:51 | 000,409,600 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJ5000MON.dll [2010/04/23 10:23:51 | 000,131,072 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJCOINST07.dll [2010/04/23 10:22:08 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 6.0 [2010/04/22 10:50:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple Computer [2010/04/22 08:28:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Application Data\Malwarebytes [2010/04/22 08:27:53 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/04/22 08:27:51 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010/04/22 08:27:51 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010/04/22 08:27:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2010/04/22 08:15:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe [2010/04/21 08:46:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun [2010/04/20 15:46:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia [2010/04/20 15:40:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\{E3278AD6-FAF3-496F-906E-18B81B7B083E} [2010/04/20 15:10:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe [2010/04/20 15:05:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Application Data\F0C8A70282C3527304FD7E600530EA1C [2010/04/12 15:54:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Application Data\pdf995 [2010/04/12 15:50:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\pdf995 [2010/04/12 15:50:39 | 000,249,856 | ---- | C] (TODO: <Company name>) -- C:\WINDOWS\System32\pdfmona.dll [2010/04/08 19:53:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Mozilla [2010/03/30 16:37:08 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime [2010/03/30 16:37:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Apple Computer [2010/03/21 17:44:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Application Data\Apple Computer [2010/03/21 08:50:49 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple [2010/03/21 08:50:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Apple [2010/03/21 08:50:21 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update [2010/03/21 08:50:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Apple Computer [2010/03/07 21:16:43 | 000,000,000 | ---D | C] -- C:\Program Files\DeductionPro 2009 [2010/03/07 21:14:36 | 000,000,000 | ---D | C] -- C:\Program Files\HRBlock2009 [2010/03/01 09:02:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Eastman_Kodak_Company [2010/03/01 08:56:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\KODAK [2010/03/01 08:56:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Eastman Kodak Company [2010/03/01 08:54:17 | 000,000,000 | ---D | C] -- C:\Program Files\Kodak [2009/03/20 20:16:56 | 000,180,224 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll [2007/07/05 04:28:52 | 000,176,128 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 90 Days ========== [2010/04/24 22:31:02 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010/04/24 22:30:16 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010/04/24 22:30:06 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010/04/24 22:29:44 | 1875,759,104 | -HS- | M] () -- C:\hiberfil.sys [2010/04/24 22:29:16 | 000,024,064 | ---- | M] () -- C:\WINDOWS\System32\drivers\sfaudio.sys [2010/04/24 22:16:06 | 000,293,376 | ---- | M] () -- C:\nvmx55zj.exe [2010/04/24 22:12:17 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe [2010/04/23 17:43:16 | 006,815,744 | -H-- | M] () -- C:\Documents and Settings\KSOBECKI\NTUSER.DAT [2010/04/23 16:56:40 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\ntuser.ini [2010/04/23 16:56:33 | 004,299,956 | -H-- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\IconCache.db [2010/04/23 13:24:13 | 000,013,426 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841 [2010/04/23 13:24:13 | 000,013,426 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\q841 [2010/04/23 12:22:07 | 000,407,552 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\My Documents\Order Sofo Foods Samples 4-23-10.xls [2010/04/23 12:21:55 | 001,349,120 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\My Documents\Copy of National Account Price list for orders shipping 03 22 10 - 04 02 10.xls [2010/04/23 10:26:44 | 000,000,775 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\KODAK AiO Home Center.lnk [2010/04/23 09:27:48 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010/04/22 20:57:16 | 000,020,686 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\March.docx [2010/04/22 10:32:41 | 000,392,702 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010/04/22 08:27:56 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010/04/22 08:19:01 | 000,011,868 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60 [2010/04/22 08:19:01 | 000,011,868 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\34f60 [2010/04/22 08:15:40 | 000,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat [2010/04/21 02:48:33 | 000,000,094 | ---- | M] () -- C:\WINDOWS\wininit.ini [2010/04/20 17:43:14 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Jcirejifigocixa.dat [2010/04/20 16:58:28 | 000,001,661 | ---- | M] () -- C:\WINDOWS\lsrslt.ini [2010/04/20 15:42:26 | 000,571,308 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010/04/20 15:42:26 | 000,477,702 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010/04/20 15:42:26 | 000,082,990 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010/04/20 15:40:36 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Psapewisurase.bin [2010/04/19 21:44:37 | 000,306,176 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\My Documents\Copy of House of Raeford Contract Request Form Final.xls [2010/04/13 16:31:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010/04/12 15:54:43 | 000,000,028 | ---- | M] () -- C:\WINDOWS\pdf995.ini [2010/04/12 15:50:39 | 000,249,856 | ---- | M] (TODO: <Company name>) -- C:\WINDOWS\System32\pdfmona.dll [2010/04/12 15:50:39 | 000,051,716 | ---- | M] () -- C:\WINDOWS\System32\pdf995mon.dll [2010/04/08 19:53:37 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat [2010/03/30 00:46:30 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/03/30 00:45:52 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010/03/22 11:51:13 | 000,046,592 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/03/07 21:16:58 | 000,001,479 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\DeductionPro 2009.lnk [2010/03/07 21:16:03 | 000,001,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\H&R Block 2009.lnk [2010/02/18 14:53:07 | 000,000,560 | ---- | M] () -- C:\hpfr5550.xml [2010/02/16 18:25:35 | 000,011,396 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\Year to year Sofo.docx [2010/02/16 17:51:29 | 000,034,602 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\2008 Cases Sofo.docx [2010/02/16 17:40:35 | 000,035,521 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\2009 Cases Sofo.docx [2010/02/08 15:17:51 | 000,028,408 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\s0p17h4102T.docx [2010/02/08 12:06:00 | 000,409,600 | ---- | M] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJ5000MON.dll [2010/02/08 12:05:00 | 000,131,072 | ---- | M] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJCOINST07.dll [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2010/04/24 22:16:03 | 000,293,376 | ---- | C] () -- C:\nvmx55zj.exe [2010/04/23 12:21:53 | 001,349,120 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\My Documents\Copy of National Account Price list for orders shipping 03 22 10 - 04 02 10.xls [2010/04/23 10:26:44 | 000,000,775 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\KODAK AiO Home Center.lnk [2010/04/23 10:14:02 | 000,035,634 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\c4u.log [2010/04/23 08:23:59 | 000,407,552 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\My Documents\Order Sofo Foods Samples 4-23-10.xls [2010/04/23 07:52:23 | 000,013,426 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841 [2010/04/23 07:52:23 | 000,013,426 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\q841 [2010/04/22 08:27:56 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010/04/22 08:17:00 | 1875,759,104 | -HS- | C] () -- C:\hiberfil.sys [2010/04/22 08:15:40 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat [2010/04/21 21:49:19 | 000,011,868 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60 [2010/04/21 21:49:19 | 000,011,868 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\34f60 [2010/04/20 17:38:45 | 000,000,094 | ---- | C] () -- C:\WINDOWS\wininit.ini [2010/04/20 16:58:28 | 000,001,661 | ---- | C] () -- C:\WINDOWS\lsrslt.ini [2010/04/20 15:40:36 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Jcirejifigocixa.dat [2010/04/20 15:40:36 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Psapewisurase.bin [2010/04/19 21:44:32 | 000,306,176 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\My Documents\Copy of House of Raeford Contract Request Form Final.xls [2010/04/12 15:54:43 | 000,000,028 | ---- | C] () -- C:\WINDOWS\pdf995.ini [2010/04/12 15:50:40 | 000,000,142 | ---- | C] () -- C:\WINDOWS\wpd99.drv [2010/04/12 15:50:39 | 000,051,716 | ---- | C] () -- C:\WINDOWS\System32\pdf995mon.dll [2010/04/08 19:53:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2010/03/21 08:50:26 | 000,000,284 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010/03/07 21:22:47 | 000,002,414 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\DeductionPro2009.log [2010/03/07 21:16:58 | 000,001,479 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\DeductionPro 2009.lnk [2010/03/07 21:16:03 | 000,001,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\H&R Block 2009.lnk [2010/02/16 18:25:35 | 000,011,396 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\Desktop\Year to year Sofo.docx [2010/02/16 17:51:29 | 000,034,602 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\Desktop\2008 Cases Sofo.docx [2010/02/16 17:40:35 | 000,035,521 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\Desktop\2009 Cases Sofo.docx [2010/02/08 15:17:51 | 000,028,408 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\Desktop\s0p17h4102T.docx [2010/01/21 22:49:12 | 000,000,044 | ---- | C] () -- C:\WINDOWS\SMWizard.INI [2009/09/17 19:09:54 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll [2009/04/29 12:46:02 | 000,000,034 | ---- | C] () -- C:\WINDOWS\hpfsched.ini [2009/04/29 12:40:27 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\hpodinet.dll [2009/04/10 12:37:43 | 000,176,235 | ---- | C] () -- C:\WINDOWS\System32\Primomonnt.dll [2008/06/22 00:28:19 | 000,028,510 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2008/05/30 12:36:58 | 000,108,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\SafeBoot.sys [2008/04/28 12:13:33 | 000,000,310 | ---- | C] () -- C:\WINDOWS\primopdf.ini [2008/04/10 13:27:34 | 001,804,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys [2008/03/28 06:14:02 | 000,024,064 | ---- | C] () -- C:\WINDOWS\System32\drivers\sfaudio.sys [2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini [2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini [2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini [2007/05/10 02:16:40 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys [2006/05/19 22:39:58 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini [2005/04/03 18:30:00 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\scardsyn.dll [2004/08/07 09:19:16 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2004/08/07 09:12:40 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini [1998/05/06 23:10:00 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\ODMA32.dll ========== LOP Check ========== [2009/10/13 21:12:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM [2010/03/01 09:02:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Eastman Kodak Company [2010/03/01 09:03:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\kds_kodak [2010/04/12 20:48:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\pdf995 [2009/12/31 18:54:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SITEguard [2010/01/01 13:03:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\STOPzilla! [2010/03/07 21:13:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TaxCut [2010/01/06 14:02:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint [2008/06/22 00:33:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{174892B1-CBE7-44F5-86FF-AB555EFD73A3} [2009/10/13 21:13:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\acccore [2009/04/03 11:29:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2010/04/21 21:21:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\F0C8A70282C3527304FD7E600530EA1C [2010/01/05 13:08:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Flickr [2010/01/07 19:50:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\MSNInstaller [2010/04/12 15:54:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\pdf995 [2010/04/12 20:48:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\TaxCut [2010/04/23 12:37:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Temp [2009/04/30 18:13:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Windows Desktop Search [2009/08/02 08:40:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Windows Search ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*.exe > [2010/04/24 22:16:06 | 000,293,376 | ---- | M] () -- C:\nvmx55zj.exe < MD5 for: AGP440.SYS > [2004/08/04 09:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\i386\sp2.cab:AGP440.sys [2004/08/04 04:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys [2009/03/20 14:31:16 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2009/03/20 14:31:16 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys [2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys [2008/04/13 14:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys < MD5 for: AHCIX86.SYS > [2008/05/27 09:55:48 | 000,174,600 | ---- | M] (AMD Technologies Inc.) MD5=15DA079FF09BE5FA6602041EE286DE80 -- C:\SwSetup\HDD1\ahcix86.sys [2008/05/27 09:55:48 | 000,174,600 | ---- | M] (AMD Technologies Inc.) MD5=15DA079FF09BE5FA6602041EE286DE80 -- C:\SwSetup\HDD1\RAID7xx\x86\ahcix86.sys [2008/05/27 09:55:48 | 000,174,600 | ---- | M] (AMD Technologies Inc.) MD5=15DA079FF09BE5FA6602041EE286DE80 -- C:\WINDOWS\system32\drivers\ahcix86.sys < MD5 for: ATAPI.SYS > [2004/08/04 09:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\i386\sp2.cab:atapi.sys [2004/08/04 04:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys [2009/03/20 14:31:16 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2009/03/20 14:31:16 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys [2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys [2008/04/13 14:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys [2004/08/03 20:59:44 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys < MD5 for: EVENTLOG.DLL > [2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll [2008/04/13 20:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll [2004/08/04 04:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll < MD5 for: NETLOGON.DLL > [2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll [2008/04/13 20:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll [2004/08/04 04:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll < MD5 for: SCECLI.DLL > [2004/08/04 04:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll [2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll [2008/04/13 20:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll < %systemroot%\*. /mp /s > < End of report > OTL Extras logfile created on: 4/24/2010 10:33:53 PM - Run 1 OTL by OldTimer - Version 3.2.2.0 Folder = C:\Documents and Settings\KSOBECKI\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 51.00% Memory free 4.00 Gb Paging File | 3.00 Gb Available in Paging File | 78.00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 231.87 Gb Total Space | 199.23 Gb Free Space | 85.92% Space Free | Partition Type: NTFS Drive D: | 1.00 Gb Total Space | 0.97 Gb Free Space | 97.24% Space Free | Partition Type: FAT32 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: KENHPLT Current User Name: KSOBECKI Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: On Skip Microsoft Files: On File Age = 90 Days Output = Standard Quick Scan ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusOverride" = 0 "FirewallOverride" = 0 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 "DoNotAllowExceptions" = 0 "DisableNotifications" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DoNotAllowExceptions" = 0 "DisableNotifications" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1723:TCP" = 1723:TCP:*:Enabled:VPN "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 "3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009 "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 "9322:TCP" = 9322:TCP:*:Enabled:EKDiscovery ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation) "C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe" = C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe:*:Enabled:SMC Service -- (Symantec Corporation) "C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE" = C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE:*:Enabled:SNAC Service -- (Symantec Corporation) "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" = C:\Program Files\Common Files\Symantec Shared\ccApp.exe:*:Enabled:Symantec Email -- (Symantec Corporation) "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.) "C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -- (AOL LLC) "C:\Program Files\AIM6\aim6.exe" = C:\Program Files\AIM6\aim6.exe:*:Enabled:AIM -- File not found "C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AIM -- (AOL LLC) "C:\Program Files\Ares\Ares.exe" = C:\Program Files\Ares\Ares.exe:*:Enabled:Ares p2p for windows -- File not found "C:\WINDOWS\system32\fxsclnt.exe" = C:\WINDOWS\system32\fxsclnt.exe:*:Enabled:Microsoft Fax Console -- (Microsoft Corporation) "C:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe" = C:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe:*:Enabled:Kodak.AiO.HomeCenter -- (Eastman Kodak Company) "C:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe" = C:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe:*:Enabled:Kodak.AiO.Statistics -- (Eastman Kodak Company) "C:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe" = C:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe:*:Enabled:Kodak.AiO.SetupUtility -- (Eastman Kodak Company) "C:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe" = C:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe:*:Enabled:Kodak.AiO.FwUpdater -- (Eastman Kodak Company) "C:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe" = C:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe:*:Enabled:Kodak.AiO.Installer -- (Eastman Kodak Company) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{04788045-DEF3-4911-91B5-384A6915F21B}" = TaxCut Ohio 2008 "{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center "{05B62241-5495-46EF-5086-DBE0F37F052C}" = Catalyst Control Center Localization Korean "{0645A454-AD44-4F0D-99CF-6B762735AD1F}" = aioprnt "{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour "{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer "{0F98662A-EA83-414F-8766-3FCE46A32641}" = Credential Manager for HP ProtectTools "{10934A28-0CC6-4B98-A14F-76B3546003AF}" = ksDIP "{154E4F71-DFC0-4B31-8D99-F97615031B02}" = HP Webcam Application "{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0 "{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java 6 Update 14 "{27FE77BD-2E0A-385C-C2CC-8367D877356F}" = CCC Help Norwegian "{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com "{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime "{2CD54AED-740B-1418-464E-CC8E15AD1E4F}" = Catalyst Control Center Localization Swedish "{2D0EE88B-8720-50A7-7F31-503B4300A8C5}" = Catalyst Control Center Localization French "{2D87E961-577B-492B-AD54-1368680FB9A7}" = Bing Maps 3D "{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 E1 "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{35EB3E58-F46C-CB48-C623-16A455C37C5D}" = CCC Help Turkish "{36C491D0-A196-F49C-C63C-3509D7A2B91D}" = CCC Help Finnish "{37AF26EB-ACCD-4F9C-A13E-81483F932203}" = Catalyst Control Center - Branding "{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = HP Webcam "{45E6BF4C-6DC8-B1BB-517C-5F2C1D055A9B}" = CCC Help Hungarian "{48072101-4DFE-9DC2-9F5D-DE0EF7193C98}" = CCC Help Korean "{48B41C3A-9A92-4B81-B653-C97FEB85C910}" = C4USelfUpdater "{49798684-CC48-AF5C-E513-9FFF61EFD3A6}" = CCC Help Japanese "{4BFA6EEB-AAED-4334-8E98-A907DE4DD5CF}" = AMD Driver Support for HP 3D DriverGuard "{4CF11D44-43B7-1359-B438-972C69D7AD6F}" = CCC Help Spanish "{4ED20E34-D511-A85B-D7E5-755AE64D5F6C}" = CCC Help Portuguese "{53A19323-917A-4822-B27E-A57D1EF6E9FC}" = H&R Block Deluxe + Efile + State 2009 "{553255F3-78FD-4 Link to post Share on other sites
kensob Posted April 25, 2010 Author Share Posted April 25, 2010 GMER 1.0.15.15281 - http://www.gmer.net Rootkit quick scan 2010-04-24 23:17:32 Windows 5.1.2600 Service Pack 3 Running: nvmx55zj.exe; Driver: C:\DOCUME~1\KSOBECKI\LOCALS~1\Temp\uwldqpow.sys ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) Device -> \Driver\ahcix86 \Device\Harddisk0\DR0 89BF1AC8 ---- Files - GMER 1.0.15 ---- File C:\WINDOWS\system32\drivers\ahcix86.sys suspicious modification ---- EOF - GMER 1.0.15 ---- Link to post Share on other sites
schrauber Posted April 25, 2010 Share Posted April 25, 2010 Hi, Please go here and have a look how you can disable your security software. Download Combofix from any of the links below but rename it to <schrauber> before saving it to your desktop. Link 1 Link 2 -------------------------------------------------------------------- Double click on the renamed Combofix.exe & follow the prompts. When finished, it will produce a report for you. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply. This tool is not a toy and not for everyday use. ComboFix SHOULD NOT be used unless requested by a forum helper If you need help, see this link: http://www.bleepingcomputer.com/combofix/how-to-use-combofix Link to post Share on other sites
kensob Posted April 25, 2010 Author Share Posted April 25, 2010 I tried to shut off the Symantec EndPoint but every time I did.....it locked the computer. I ran it while it was on. ComboFix 10-04-21.01 - KSOBECKI 04/25/2010 18:25:41.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1789.1084 [GMT -4:00] Running from: c:\documents and settings\KSOBECKI\Desktop\schrauber.exe AV: Symantec Endpoint Protection *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Documents\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ken\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ken\My Pictures\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Berkley Square\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Cedar Point 2010\Cedar Point 2007\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Cedar Point 2010\Cedar Point 2008\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Cedar Point 2010\Cedar Point 2009\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Cedar Point 2010\Geauga Lake 2007\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Clark County Schools\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Holiday World 2008\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Holiday World 2008\Holiday World 2007\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Others\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Toledo Public Schools 2010-2011\Toledo Public Schools 2009-2010\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Toledo Public Schools 2010-2011\Toledo Public Schools 2009-2010\Toledo Public Schools 2008-2009\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Toledo Public Schools 2010-2011\Toledo Public Schools 2009-2010\Toledo Public Schools 2008-2009\Toledo Public Schools 2007-08\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Toledo Zoo 2010\Toledo Zoo 2007\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Toledo Zoo 2010\Toledo Zoo 2008\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Toledo Zoo 2010\Toledo Zoo 2009\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Washington Local 2009-2010\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Washington Local 2009-2010\Washington Local 2008-09\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Washington Local 2009-2010\Washington Local 2008-09\Washington Local 2007-08\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Western Michigan 09-10\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Western Michigan 09-10\Western Michigan 08-09\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Bid Forms\Western Michigan 09-10\Western Michigan 08-09\Western Michigan 07-08\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Cavendish\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Command\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Durable Foil\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Heartland\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\HOR\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\LaPreferida\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Liguria Foods\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Lipari\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Naturally Fresh\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Graphics Packaging\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Lance\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\LBP\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\LBP\CARRABBA'S PHOTOS\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\LBP\HURRICANE\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\Archive\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kandj120\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kandj120\Archive\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kandj120\Archive\Messages\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kandj120\Archive\Messages\cat_fezz13x\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kandj120\Archive\Messages\khalkru\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Conferences\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\bluelady488\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\grobak130\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\kitten_pd\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\lmhallengren\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\mojohands2\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\monarchtoo\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\notcattrell\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\ohioskipatroller\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\salongoddess2004\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\spookyjill2\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\ts07563\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Messages\victoria02256\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Mobile Messages\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\Archive\Mobile Messages\+14193059845\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\ayoungsenior\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\bacardi350\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\bluelady488\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\grobak130\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\just4lisaa\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\kitten_pd\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\lmhallengren\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\mojohands2\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\monarchtoo\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\notcattrell\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\ohioskipatroller\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\search469\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\spookyjill2\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\twiztid32\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Messages\victoria02256\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Mobile Messages\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Mobile Messages\+14193059845\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\Archive\Mobile Messages\+16143320333\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\kensob99\My Icons\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\kensob99\My Icons\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\Archive\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\Archive\Messages\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\Archive\Messages\cmhguitarist\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\Archive\Messages\ohiocpl2008\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\Archive\Messages\sidneyfunguy63\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\My Icons\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\Archive\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\Archive\Messages\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\Archive\Messages\bob_45036\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\Archive\Messages\cmhguitarist\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\Archive\Messages\greeneyedbabe111\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\Archive\Messages\jlshoe1963\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\Archive\Messages\sidneyfunguy63\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\Archive\Profiles\shellyh44\shellyh44\My Icons\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\kandj120\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\kandj120\My Icons\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\kensob99\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\kensob99\Archive\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\kensob99\Archive\Mobile Messages\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\kensob99\Archive\Mobile Messages\+16143320333\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Profiles\kensob99\My Icons\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Riverside\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Sanfacon\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Others\Tennessee Pride\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Pastorelli\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Ritchie\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Smith Family\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Smithfield\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Sofo Foods\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Sofo Foods\2006 Show\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Sofo Foods\2007 Show\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Sofo Foods\2008 Show\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Sofo Foods\2009 Show\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Tradex\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Upstate Farms\_desktop.ini c:\documents and settings\All Users\Documents\My Documents\Ritchie\Vincent Giordano\_desktop.ini c:\documents and settings\All Users\Documents\My Music\_desktop.ini c:\documents and settings\All Users\Documents\My Music\My Playlists\_desktop.ini c:\documents and settings\All Users\Documents\My Music\Sample Music\_desktop.ini c:\documents and settings\All Users\Documents\My Music\Sample Playlists\_desktop.ini c:\documents and settings\All Users\Documents\My Music\Sample Playlists\0009B52B\_desktop.ini c:\documents and settings\All Users\Documents\My Music\Sync Playlists\_desktop.ini c:\documents and settings\All Users\Documents\My Music\Sync Playlists\14EDBA\_desktop.ini c:\documents and settings\All Users\Documents\My Pictures\_desktop.ini c:\documents and settings\All Users\Documents\My Pictures\Sample Pictures\_desktop.ini c:\documents and settings\All Users\Documents\My Videos\_desktop.ini c:\documents and settings\KSOBECKI\Application Data\F0C8A70282C3527304FD7E600530EA1C c:\documents and settings\KSOBECKI\Application Data\F0C8A70282C3527304FD7E600530EA1C\enemies-names.txt c:\documents and settings\KSOBECKI\Application Data\F0C8A70282C3527304FD7E600530EA1C\lsrslt.ini c:\documents and settings\KSOBECKI\Local Settings\Application Data\{E3278AD6-FAF3-496F-906E-18B81B7B083E} c:\documents and settings\KSOBECKI\Local Settings\Application Data\{E3278AD6-FAF3-496F-906E-18B81B7B083E}\chrome.manifest c:\documents and settings\KSOBECKI\Local Settings\Application Data\{E3278AD6-FAF3-496F-906E-18B81B7B083E}\chrome\content\_cfg.js c:\documents and settings\KSOBECKI\Local Settings\Application Data\{E3278AD6-FAF3-496F-906E-18B81B7B083E}\chrome\content\overlay.xul c:\documents and settings\KSOBECKI\Local Settings\Application Data\{E3278AD6-FAF3-496F-906E-18B81B7B083E}\install.rdf c:\recycler\S-1-5-21-1708537768-602609370-725345543-500 c:\recycler\S-1-5-21-625955303-583744707-3302112861-500 Infected copy of c:\windows\system32\drivers\sfaudio.sys was found and disinfected Restored copy from - Kitty had a snack . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_6TO4 ((((((((((((((((((((((((( Files Created from 2010-03-25 to 2010-04-25 ))))))))))))))))))))))))))))))) . 2010-04-25 22:21 . 2010-04-25 21:33 24064 ----a-w- c:\windows\system32\drivers\sfaudio.sys 2010-04-25 02:16 . 2010-04-25 02:16 293376 ----a-w- C:\nvmx55zj.exe 2010-04-23 14:23 . 2010-02-08 16:06 409600 ----a-w- c:\windows\system32\EKIJ5000MON.dll 2010-04-23 14:23 . 2010-02-08 16:06 196608 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\EKIJ5000PPR.dll 2010-04-23 14:23 . 2010-02-08 16:05 131072 ----a-w- c:\windows\system32\EKIJCOINST07.dll 2010-04-23 14:22 . 2010-04-23 14:22 -------- d-----w- c:\program files\MSXML 6.0 2010-04-23 14:15 . 2010-02-22 16:01 53248 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.XmlSerializers.dll 2010-04-23 14:15 . 2010-02-22 16:01 19968 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.dll 2010-04-23 14:15 . 2010-02-22 16:01 36864 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Interop.WindowsInstaller.dll 2010-04-22 14:50 . 2010-04-22 14:50 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer 2010-04-22 12:28 . 2010-04-22 12:28 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Malwarebytes 2010-04-22 12:27 . 2010-03-30 04:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-04-22 12:27 . 2010-03-30 04:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-04-22 12:15 . 2010-04-22 12:15 552 ----a-w- c:\windows\system32\d3d8caps.dat 2010-04-22 12:15 . 2010-04-22 12:15 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe 2010-04-20 19:40 . 2010-04-20 21:43 120 ----a-w- c:\windows\Jcirejifigocixa.dat 2010-04-20 19:40 . 2010-04-20 19:40 0 ----a-w- c:\windows\Psapewisurase.bin 2010-04-20 19:05 . 2008-04-14 00:12 82432 ----a-w- c:\windows\system32\dllcache\ws2_32.dll 2010-04-12 19:54 . 2010-04-12 19:54 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\pdf995 2010-04-12 19:50 . 2010-04-13 00:48 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995 2010-04-12 19:50 . 2007-08-24 16:13 142 ----a-w- c:\windows\wpd99.drv 2010-04-12 19:50 . 2010-04-12 19:50 51716 ----a-w- c:\windows\system32\pdf995mon.dll 2010-04-12 19:50 . 2010-04-12 19:50 249856 ----a-w- c:\windows\system32\pdfmona.dll 2010-04-09 02:03 . 2010-04-09 02:03 1924976 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe 2010-04-08 23:53 . 2010-04-08 23:53 0 ----a-w- c:\windows\nsreg.dat 2010-04-08 23:53 . 2010-04-08 23:53 -------- d-----w- c:\documents and settings\KSOBECKI\Local Settings\Application Data\Mozilla 2010-03-30 20:37 . 2010-03-30 20:37 -------- d-----w- c:\program files\QuickTime 2010-03-30 20:37 . 2010-03-30 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-25 22:36 . 2009-04-14 11:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak 2010-04-23 16:37 . 2009-09-17 21:33 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Temp 2010-04-23 16:29 . 2010-01-01 16:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-04-23 14:26 . 2010-03-01 12:54 -------- d-----w- c:\program files\Kodak 2010-04-23 13:27 . 2009-12-30 23:12 1324 ----a-w- c:\windows\system32\d3d9caps.dat 2010-04-15 12:48 . 2009-04-03 15:21 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS 2010-04-15 02:36 . 2008-06-22 04:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2010-04-13 00:48 . 2009-04-07 00:26 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\TaxCut 2010-04-12 19:50 . 2009-04-06 16:12 -------- d-----w- c:\program files\PDF995 2010-04-06 15:29 . 2009-05-14 23:32 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Skype 2010-04-02 02:17 . 2009-04-02 00:57 -------- d-----w- c:\program files\CCleaner 2010-03-23 22:59 . 2010-03-23 22:59 2934896 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Downloads\HRBlockOH.exe 2010-03-23 22:41 . 2010-03-08 01:16 -------- d-----w- c:\program files\DeductionPro 2009 2010-03-23 20:24 . 2010-03-23 20:24 21195208 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US65016901xupd.exe 2010-03-21 21:44 . 2010-03-21 21:44 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Apple Computer 2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Common Files\Apple 2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Apple Software Update 2010-03-11 12:38 . 2004-08-04 08:00 832512 ----a-w- c:\windows\system32\wininet.dll 2010-03-11 12:38 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-03-11 12:38 . 2004-08-04 08:00 17408 ----a-w- c:\windows\system32\corpol.dll 2010-03-09 11:09 . 2004-08-04 08:00 430080 ----a-w- c:\windows\system32\vbscript.dll 2010-03-08 01:18 . 2010-03-08 01:17 19486488 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US30026501xupd.exe 2010-03-08 01:16 . 2008-06-22 03:38 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-03-08 01:15 . 2010-03-08 01:14 -------- d-----w- c:\program files\HRBlock2009 2010-03-08 01:13 . 2009-04-06 16:09 -------- d-----w- c:\documents and settings\All Users\Application Data\TaxCut 2010-03-01 13:03 . 2009-09-17 22:51 -------- d-----w- c:\documents and settings\All Users\Application Data\kds_kodak 2010-03-01 13:02 . 2009-09-17 22:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Eastman Kodak Company 2010-02-24 13:11 . 2004-08-04 08:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-02-16 14:08 . 2004-08-04 08:00 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-02-16 13:25 . 2004-08-04 08:00 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe 2010-02-12 04:33 . 2004-08-04 08:00 100864 ----a-w- c:\windows\system32\6to4svc.dll 2010-02-11 12:02 . 2004-08-04 08:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-27 1040384] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752] "Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2008-05-14 61440] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1044480] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-12-18 115560] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888] "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768] "Conime"="c:\windows\system32\conime.exe" [2008-04-14 27648] "EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2010-02-08 1634304] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc] 2007-05-15 23:08 112640 ----a-w- c:\windows\system32\ackpbsc.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock] 2007-05-15 23:08 281088 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard] 2008-05-21 00:42 111888 ----a-w- c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\system32\APSHook.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-03-24 18:17 952768 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2010-04-04 05:42 36272 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableNotifications"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\mqsvc.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"= "c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"= "c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\WINDOWS\\system32\\fxsclnt.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\WINDOWS\\system32\\spoolsv.exe"= "c:\\Program Files\\Kodak\\AiO\\Center\\AiOHomeCenter.exe"= "c:\\Program Files\\Kodak\\AiO\\Center\\Kodak.Statistics.exe"= "c:\\Program Files\\Kodak\\AiO\\Center\\NetworkPrinterDiscovery.exe"= "c:\\Program Files\\Kodak\\AiO\\Firmware\\KodakAiOUpdater.exe"= "c:\\Documents and Settings\\All Users\\Application Data\\Kodak\\Installer\\Setup.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1723:TCP"= 1723:TCP:VPN "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "9322:TCP"= 9322:TCP:EKDiscovery R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [6/21/2008 11:24 PM 174600] R0 Amddfltr;Amd Disk Lower Filter Driver;c:\windows\system32\drivers\Amddfltr.sys [6/21/2008 11:49 PM 15416] R0 SafeBoot;SafeBoot;c:\windows\system32\drivers\SafeBoot.sys [5/30/2008 12:36 PM 108752] R0 SbAlg;SbAlg;c:\windows\system32\drivers\SbAlg.sys [5/30/2008 12:37 PM 51376] R0 SbFsLock;SbFsLock;c:\windows\system32\drivers\SbFsLock.sys [5/30/2008 12:37 PM 12928] R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\drivers\tffsport.sys [4/25/2009 8:54 PM 149376] R1 RsvLock;RsvLock;c:\windows\system32\drivers\rsvlock.sys [5/30/2008 12:37 PM 12496] R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [5/15/2007 7:08 PM 182576] R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336] R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336] R2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [5/15/2008 6:11 PM 1176824] R2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [6/2/2008 1:32 PM 18944] R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [5/30/2008 12:36 PM 256512] R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\ekdiscovery.exe [2/11/2010 3:36 PM 300400] R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [5/15/2008 4:29 PM 475520] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [4/20/2010 7:22 AM 102448] R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [4/4/2007 3:16 PM 41216] S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [6/22/2008 12:50 AM 193840] S3 scsichk;scsichk;\??\c:\windows\system32\scsichk.sys --> c:\windows\system32\scsichk.sys [?] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] Cognizance REG_MULTI_SZ ASBroker ASChannel . Contents of the 'Scheduled Tasks' folder 2010-04-13 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 . - - - - ORPHANS REMOVED - - - - WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) SafeBoot-Symantec Antvirus ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-04-25 18:37 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe???????????????????????|?M?|?????M?|[email protected] scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(948) c:\windows\system32\ackpbsc.dll c:\windows\system32\aclog.dll c:\windows\system32\ACLIBEAY.dll c:\windows\system32\acevtsub.dll c:\windows\system32\asphat32.dll c:\windows\system32\acerrmes.dll c:\windows\system32\aspcom.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll c:\windows\system32\Ati2evxx.dll c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll c:\program files\ActivIdentity\ActivClient\acunlock.dll c:\windows\system32\aipingui.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll c:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll - - - - - - - > 'explorer.exe'(6316) c:\windows\system32\WININET.dll c:\windows\system32\APSHook.dll c:\windows\system32\ieframe.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe c:\windows\system32\Ati2evxx.exe c:\program files\Common Files\Symantec Shared\ccSvcHst.exe c:\windows\System32\SCardSvr.exe c:\windows\system32\msdtc.exe c:\windows\system32\agrsmsvc.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Symantec\Symantec Endpoint Protection\Rtvscan.exe c:\windows\system32\SearchIndexer.exe c:\windows\system32\mqsvc.exe c:\windows\system32\mqtgsvc.exe c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe c:\program files\Hewlett-Packard\IAM\Bin\AsGHost.exe c:\program files\Symantec\Symantec Endpoint Protection\SmcGui.exe c:\program files\Hewlett-Packard\Shared\HpqToaster.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe . ************************************************************************** . Completion time: 2010-04-25 18:42:22 - machine was rebooted ComboFix-quarantined-files.txt 2010-04-25 22:42 Pre-Run: 213,825,617,920 bytes free Post-Run: 213,846,351,872 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer - - End Of File - - 13554D69C40CCAC8B8FB83B3FAD336E1 Link to post Share on other sites
schrauber Posted April 27, 2010 Share Posted April 27, 2010 Hi, Open notepad and copy/paste the text in the quotebox below into it: http://forums.pcpitstop.com/index.php?act=...25&t=184902 Collect:: c:\windows\Jcirejifigocixa.dat c:\windows\Psapewisurase.bin c:\windows\system32\scsichk.sys Folder:: c:\documents and settings\KSOBECKI\Application Data\pdf995 c:\documents and settings\All Users\Application Data\pdf995 Driver:: scsichk Save this as CFScript.txt Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you. Post that log in your next reply. **Note** When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis. Ensure you are connected to the internet and click OK on the message box. Link to post Share on other sites
kensob Posted April 28, 2010 Author Share Posted April 28, 2010 ComboFix 10-04-26.05 - KSOBECKI 04/27/2010 21:46:40.3.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1789.999 [GMT -4:00] Running from: c:\documents and settings\KSOBECKI\Desktop\schrauber.exe Command switches used :: c:\documents and settings\KSOBECKI\Desktop\CFScript.txt AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} file zipped: c:\windows\Jcirejifigocixa.dat file zipped: c:\windows\Psapewisurase.bin . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\pdf995 c:\documents and settings\All Users\Application Data\pdf995\pdfsync.ini c:\documents and settings\All Users\Application Data\pdf995\queue.ini c:\documents and settings\KSOBECKI\Application Data\pdf995 c:\documents and settings\KSOBECKI\Application Data\pdf995\pdf995server.ini c:\documents and settings\KSOBECKI\Application Data\pdf995\res\pdf995.ini c:\documents and settings\KSOBECKI\Application Data\pdf995\temp.ps c:\documents and settings\KSOBECKI\Local Settings\Application Data\Windows Server C:\feed.txt c:\windows\Jcirejifigocixa.dat c:\windows\Psapewisurase.bin c:\windows\system32\ctfmon .exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SCSICHK -------\Service_scsichk ((((((((((((((((((((((((( Files Created from 2010-03-28 to 2010-04-28 ))))))))))))))))))))))))))))))) . 2010-04-28 01:53 . 2010-04-28 02:00 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995 2010-04-26 17:48 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys 2010-04-26 17:48 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys 2010-04-26 17:48 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys 2010-04-26 17:48 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\dllcache\changer.sys 2010-04-26 17:48 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys 2010-04-26 17:48 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\dllcache\i2omgmt.sys 2010-04-26 12:33 . 2010-04-26 12:33 -------- d-----w- c:\documents and settings\KSOBECKI\Local Settings\Application Data\Mozilla 2010-04-25 22:21 . 2010-04-25 21:33 24064 ----a-w- c:\windows\system32\drivers\sfaudio.sys 2010-04-25 02:16 . 2010-04-25 02:16 293376 ----a-w- C:\nvmx55zj.exe 2010-04-23 14:23 . 2010-02-08 16:06 409600 ----a-w- c:\windows\system32\EKIJ5000MON.dll 2010-04-23 14:23 . 2010-02-08 16:06 196608 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\EKIJ5000PPR.dll 2010-04-23 14:23 . 2010-02-08 16:05 131072 ----a-w- c:\windows\system32\EKIJCOINST07.dll 2010-04-23 14:22 . 2010-04-23 14:22 -------- d-----w- c:\program files\MSXML 6.0 2010-04-23 14:15 . 2010-02-22 16:01 53248 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.XmlSerializers.dll 2010-04-23 14:15 . 2010-02-22 16:01 19968 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.dll 2010-04-23 14:15 . 2010-02-22 16:01 36864 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Interop.WindowsInstaller.dll 2010-04-22 14:50 . 2010-04-22 14:50 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer 2010-04-22 12:28 . 2010-04-22 12:28 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Malwarebytes 2010-04-22 12:27 . 2010-03-30 04:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-04-22 12:27 . 2010-03-30 04:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-04-22 12:15 . 2010-04-22 12:15 552 ----a-w- c:\windows\system32\d3d8caps.dat 2010-04-22 12:15 . 2010-04-22 12:15 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe 2010-04-20 19:05 . 2008-04-14 00:12 82432 ----a-w- c:\windows\system32\dllcache\ws2_32.dll 2010-04-12 19:50 . 2007-08-24 16:13 142 ----a-w- c:\windows\wpd99.drv 2010-04-12 19:50 . 2010-04-12 19:50 51716 ----a-w- c:\windows\system32\pdf995mon.dll 2010-04-12 19:50 . 2010-04-12 19:50 249856 ----a-w- c:\windows\system32\pdfmona.dll 2010-04-09 02:03 . 2010-04-09 02:03 1924976 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe 2010-04-08 23:53 . 2010-04-08 23:53 0 ----a-w- c:\windows\nsreg.dat 2010-03-30 20:37 . 2010-04-27 11:53 -------- d-----w- c:\program files\QuickTime 2010-03-30 20:37 . 2010-03-30 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-28 01:53 . 2009-04-14 11:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak 2010-04-28 01:10 . 2009-03-23 16:31 -------- d-----w- c:\program files\Common Files\Symantec Shared 2010-04-28 01:02 . 2010-01-01 16:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-04-26 15:15 . 2009-12-30 23:12 1324 ----a-w- c:\windows\system32\d3d9caps.dat 2010-04-23 16:37 . 2009-09-17 21:33 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Temp 2010-04-23 14:26 . 2010-03-01 12:54 -------- d-----w- c:\program files\Kodak 2010-04-15 12:48 . 2009-04-03 15:21 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS 2010-04-15 02:36 . 2008-06-22 04:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2010-04-13 00:48 . 2009-04-07 00:26 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\TaxCut 2010-04-12 19:50 . 2009-04-06 16:12 -------- d-----w- c:\program files\PDF995 2010-04-06 15:29 . 2009-05-14 23:32 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Skype 2010-04-02 02:17 . 2009-04-02 00:57 -------- d-----w- c:\program files\CCleaner 2010-03-23 22:59 . 2010-03-23 22:59 2934896 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Downloads\HRBlockOH.exe 2010-03-23 22:41 . 2010-03-08 01:16 -------- d-----w- c:\program files\DeductionPro 2009 2010-03-23 20:24 . 2010-03-23 20:24 21195208 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US65016901xupd.exe 2010-03-21 21:44 . 2010-03-21 21:44 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Apple Computer 2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Common Files\Apple 2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Apple Software Update 2010-03-11 12:38 . 2004-08-04 08:00 832512 ----a-w- c:\windows\system32\wininet.dll 2010-03-11 12:38 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-03-11 12:38 . 2004-08-04 08:00 17408 ----a-w- c:\windows\system32\corpol.dll 2010-03-09 11:09 . 2004-08-04 08:00 430080 ----a-w- c:\windows\system32\vbscript.dll 2010-03-08 01:18 . 2010-03-08 01:17 19486488 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US30026501xupd.exe 2010-03-08 01:16 . 2008-06-22 03:38 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-03-08 01:15 . 2010-03-08 01:14 -------- d-----w- c:\program files\HRBlock2009 2010-03-08 01:13 . 2009-04-06 16:09 -------- d-----w- c:\documents and settings\All Users\Application Data\TaxCut 2010-03-01 13:03 . 2009-09-17 22:51 -------- d-----w- c:\documents and settings\All Users\Application Data\kds_kodak 2010-03-01 13:02 . 2009-09-17 22:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Eastman Kodak Company 2010-02-24 13:11 . 2004-08-04 08:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-02-16 14:08 . 2004-08-04 08:00 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-02-16 13:25 . 2004-08-04 08:00 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe 2010-02-12 04:33 . 2004-08-04 08:00 100864 ----a-w- c:\windows\system32\6to4svc.dll 2010-02-11 12:02 . 2004-08-04 08:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys . <pre> c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe c:\program files\Analog Devices\Core\smax4pnp .exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\clistart .exe c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe c:\program files\Common Files\Symantec Shared\ccapp .exe c:\program files\Hewlett-Packard\Default Settings\cpqset .exe c:\program files\Hewlett-Packard\HP Wireless Assistant\hpwamain .exe c:\program files\QuickTime\qttask .exe c:\program files\Synaptics\SynTP\syntpenh .exe c:\windows\system32\spool\drivers\w32x86\3\ekij5000mui .exe </pre> ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [N/A] "Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [N/A] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc] 2007-05-15 23:08 112640 ----a-w- c:\windows\system32\ackpbsc.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock] 2007-05-15 23:08 281088 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard] 2008-05-21 00:42 111888 ----a-w- c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\system32\APSHook.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-04-27 11:53 36864 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\adobearm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2010-04-27 11:53 36864 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableNotifications"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\mqsvc.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"= "c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"= "c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\WINDOWS\\system32\\fxsclnt.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Kodak\\AiO\\Center\\AiOHomeCenter.exe"= "c:\\Program Files\\Kodak\\AiO\\Center\\Kodak.Statistics.exe"= "c:\\Program Files\\Kodak\\AiO\\Center\\NetworkPrinterDiscovery.exe"= "c:\\Program Files\\Kodak\\AiO\\Firmware\\KodakAiOUpdater.exe"= "c:\\Documents and Settings\\All Users\\Application Data\\Kodak\\Installer\\Setup.exe"= "c:\\WINDOWS\\system32\\spoolsv.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1723:TCP"= 1723:TCP:VPN "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "9322:TCP"= 9322:TCP:EKDiscovery R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [6/21/2008 11:24 PM 174600] R0 Amddfltr;Amd Disk Lower Filter Driver;c:\windows\system32\drivers\Amddfltr.sys [6/21/2008 11:49 PM 15416] R0 SafeBoot;SafeBoot;c:\windows\system32\drivers\SafeBoot.sys [5/30/2008 12:36 PM 108752] R0 SbAlg;SbAlg;c:\windows\system32\drivers\SbAlg.sys [5/30/2008 12:37 PM 51376] R0 SbFsLock;SbFsLock;c:\windows\system32\drivers\SbFsLock.sys [5/30/2008 12:37 PM 12928] R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\drivers\tffsport.sys [4/25/2009 8:54 PM 149376] R1 RsvLock;RsvLock;c:\windows\system32\drivers\rsvlock.sys [5/30/2008 12:37 PM 12496] R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [5/15/2007 7:08 PM 182576] R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336] R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336] R2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [5/15/2008 6:11 PM 1176824] R2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [6/2/2008 1:32 PM 18944] R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [5/30/2008 12:36 PM 256512] R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\ekdiscovery.exe [2/11/2010 3:36 PM 300400] R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [5/15/2008 4:29 PM 475520] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [4/20/2010 7:22 AM 102448] R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [4/4/2007 3:16 PM 41216] S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [6/22/2008 12:50 AM 193840] S3 memchek;memchek;c:\windows\system32\memchek.sys [8/4/2004 4:00 AM 2432] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] Cognizance REG_MULTI_SZ ASBroker ASChannel . Contents of the 'Scheduled Tasks' folder 2010-04-13 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\KSOBECKI\Application Data\Mozilla\Firefox\Profiles\220ltht1.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-04-27 22:00 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe???????????????????????|?M?|?????M?|[email protected] scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(952) c:\windows\system32\ackpbsc.dll c:\windows\system32\aclog.dll c:\windows\system32\ACLIBEAY.dll c:\windows\system32\acevtsub.dll c:\windows\system32\asphat32.dll c:\windows\system32\acerrmes.dll c:\windows\system32\aspcom.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll c:\windows\system32\Ati2evxx.dll c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll c:\program files\ActivIdentity\ActivClient\acunlock.dll c:\windows\system32\aipingui.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll c:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll - - - - - - - > 'explorer.exe'(5748) c:\windows\system32\WININET.dll c:\windows\system32\APSHook.dll c:\windows\system32\ieframe.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe c:\windows\system32\Ati2evxx.exe c:\program files\Common Files\Symantec Shared\ccSvcHst.exe c:\windows\System32\SCardSvr.exe c:\windows\system32\msdtc.exe c:\windows\system32\agrsmsvc.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Symantec\Symantec Endpoint Protection\Rtvscan.exe c:\windows\system32\SearchIndexer.exe c:\windows\system32\mqsvc.exe c:\windows\system32\mqtgsvc.exe c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe c:\program files\Hewlett-Packard\IAM\Bin\AsGHost.exe c:\program files\Symantec\Symantec Endpoint Protection\SmcGui.exe c:\windows\system32\rundll32.exe c:\windows\system32\SearchProtocolHost.exe c:\windows\system32\SearchFilterHost.exe . ************************************************************************** . Completion time: 2010-04-27 22:05:33 - machine was rebooted ComboFix-quarantined-files.txt 2010-04-28 02:05 ComboFix2.txt 2010-04-26 18:38 Pre-Run: 213,911,220,224 bytes free Post-Run: 213,889,757,184 bytes free - - End Of File - - 33FF553A7358152F5918AE3FDF248486 Link to post Share on other sites
schrauber Posted April 28, 2010 Share Posted April 28, 2010 Hi, 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: RenV:: c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe c:\program files\Analog Devices\Core\smax4pnp .exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\clistart .exe c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe c:\program files\Common Files\Symantec Shared\ccapp .exe c:\program files\Hewlett-Packard\Default Settings\cpqset .exe c:\program files\Hewlett-Packard\HP Wireless Assistant\hpwamain .exe c:\program files\QuickTime\qttask .exe c:\program files\Synaptics\SynTP\syntpenh .exe c:\windows\system32\spool\drivers\w32x86\3\ekij5000mui .exe Save this as CFScript.txt, in the same location as ComboFix.exe Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. Link to post Share on other sites
kensob Posted April 29, 2010 Author Share Posted April 29, 2010 ComboFix 10-04-28.03 - KSOBECKI 04/28/2010 22:20:42.4.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1789.921 [GMT -4:00] Running from: c:\documents and settings\KSOBECKI\Desktop\schrauber.exe Command switches used :: c:\documents and settings\KSOBECKI\Desktop\CFScript.txt AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} . ((((((((((((((((((((((((( Files Created from 2010-03-28 to 2010-04-29 ))))))))))))))))))))))))))))))) . 2010-04-28 01:53 . 2010-04-28 02:00 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995 2010-04-26 17:48 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys 2010-04-26 17:48 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys 2010-04-26 17:48 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys 2010-04-26 17:48 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\dllcache\changer.sys 2010-04-26 17:48 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys 2010-04-26 17:48 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\dllcache\i2omgmt.sys 2010-04-26 12:33 . 2010-04-26 12:33 -------- d-----w- c:\documents and settings\KSOBECKI\Local Settings\Application Data\Mozilla 2010-04-25 22:21 . 2010-04-25 21:33 24064 ----a-w- c:\windows\system32\drivers\sfaudio.sys 2010-04-25 02:16 . 2010-04-25 02:16 293376 ----a-w- C:\nvmx55zj.exe 2010-04-23 14:23 . 2010-02-08 16:06 409600 ----a-w- c:\windows\system32\EKIJ5000MON.dll 2010-04-23 14:23 . 2010-02-08 16:06 196608 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\EKIJ5000PPR.dll 2010-04-23 14:23 . 2010-02-08 16:05 131072 ----a-w- c:\windows\system32\EKIJCOINST07.dll 2010-04-23 14:22 . 2010-04-23 14:22 -------- d-----w- c:\program files\MSXML 6.0 2010-04-23 14:15 . 2010-02-22 16:01 53248 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.XmlSerializers.dll 2010-04-23 14:15 . 2010-02-22 16:01 19968 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.dll 2010-04-23 14:15 . 2010-02-22 16:01 36864 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Interop.WindowsInstaller.dll 2010-04-22 14:50 . 2010-04-22 14:50 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer 2010-04-22 12:28 . 2010-04-22 12:28 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Malwarebytes 2010-04-22 12:27 . 2010-03-30 04:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-04-22 12:27 . 2010-03-30 04:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-04-22 12:15 . 2010-04-22 12:15 552 ----a-w- c:\windows\system32\d3d8caps.dat 2010-04-22 12:15 . 2010-04-22 12:15 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe 2010-04-20 19:05 . 2008-04-14 00:12 82432 ----a-w- c:\windows\system32\dllcache\ws2_32.dll 2010-04-12 19:50 . 2007-08-24 16:13 142 ----a-w- c:\windows\wpd99.drv 2010-04-12 19:50 . 2010-04-12 19:50 51716 ----a-w- c:\windows\system32\pdf995mon.dll 2010-04-12 19:50 . 2010-04-12 19:50 249856 ----a-w- c:\windows\system32\pdfmona.dll 2010-04-09 02:03 . 2010-04-09 02:03 1924976 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe 2010-04-08 23:53 . 2010-04-08 23:53 0 ----a-w- c:\windows\nsreg.dat 2010-03-30 20:37 . 2010-04-29 02:20 -------- d-----w- c:\program files\QuickTime 2010-03-30 20:37 . 2010-03-30 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-29 02:20 . 2009-03-23 16:31 -------- d-----w- c:\program files\Common Files\Symantec Shared 2010-04-28 02:13 . 2010-01-01 16:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-04-28 01:53 . 2009-04-14 11:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak 2010-04-26 15:15 . 2009-12-30 23:12 1324 ----a-w- c:\windows\system32\d3d9caps.dat 2010-04-23 16:37 . 2009-09-17 21:33 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Temp 2010-04-23 14:26 . 2010-03-01 12:54 -------- d-----w- c:\program files\Kodak 2010-04-15 12:48 . 2009-04-03 15:21 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS 2010-04-15 02:36 . 2008-06-22 04:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2010-04-13 00:48 . 2009-04-07 00:26 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\TaxCut 2010-04-12 19:50 . 2009-04-06 16:12 -------- d-----w- c:\program files\PDF995 2010-04-06 15:29 . 2009-05-14 23:32 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Skype 2010-04-02 02:17 . 2009-04-02 00:57 -------- d-----w- c:\program files\CCleaner 2010-03-23 22:59 . 2010-03-23 22:59 2934896 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Downloads\HRBlockOH.exe 2010-03-23 22:41 . 2010-03-08 01:16 -------- d-----w- c:\program files\DeductionPro 2009 2010-03-23 20:24 . 2010-03-23 20:24 21195208 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US65016901xupd.exe 2010-03-21 21:44 . 2010-03-21 21:44 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Apple Computer 2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Common Files\Apple 2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Apple Software Update 2010-03-11 12:38 . 2004-08-04 08:00 832512 ----a-w- c:\windows\system32\wininet.dll 2010-03-11 12:38 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-03-11 12:38 . 2004-08-04 08:00 17408 ----a-w- c:\windows\system32\corpol.dll 2010-03-09 11:09 . 2004-08-04 08:00 430080 ----a-w- c:\windows\system32\vbscript.dll 2010-03-08 01:18 . 2010-03-08 01:17 19486488 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US30026501xupd.exe 2010-03-08 01:16 . 2008-06-22 03:38 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-03-08 01:15 . 2010-03-08 01:14 -------- d-----w- c:\program files\HRBlock2009 2010-03-08 01:13 . 2009-04-06 16:09 -------- d-----w- c:\documents and settings\All Users\Application Data\TaxCut 2010-03-01 13:03 . 2009-09-17 22:51 -------- d-----w- c:\documents and settings\All Users\Application Data\kds_kodak 2010-03-01 13:02 . 2009-09-17 22:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Eastman Kodak Company 2010-02-24 13:11 . 2004-08-04 08:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-02-16 14:08 . 2004-08-04 08:00 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-02-16 13:25 . 2004-08-04 08:00 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe 2010-02-12 04:33 . 2004-08-04 08:00 100864 ----a-w- c:\windows\system32\6to4svc.dll 2010-02-11 12:02 . 2004-08-04 08:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys . ((((((((((((((((((((((((((((( [email protected]_02.00.41 ))))))))))))))))))))))))))))))))))))))))) . + 2010-04-28 02:17 . 2010-04-28 02:17 16384 c:\windows\Temp\Perflib_Perfdata_290.dat + 2010-04-23 14:23 . 2010-02-08 16:09 1634304 c:\windows\system32\spool\drivers\w32x86\3\ekij5000mui.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc] 2007-05-15 23:08 112640 ----a-w- c:\windows\system32\ackpbsc.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock] 2007-05-15 23:08 281088 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard] 2008-05-21 00:42 111888 ----a-w- c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\system32\APSHook.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-03-24 18:17 952768 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\adobearm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2010-04-04 05:42 36272 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableNotifications"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\mqsvc.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"= "c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"= "c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\WINDOWS\\system32\\fxsclnt.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Kodak\\AiO\\Center\\AiOHomeCenter.exe"= "c:\\Program Files\\Kodak\\AiO\\Center\\Kodak.Statistics.exe"= "c:\\Program Files\\Kodak\\AiO\\Center\\NetworkPrinterDiscovery.exe"= "c:\\Program Files\\Kodak\\AiO\\Firmware\\KodakAiOUpdater.exe"= "c:\\Documents and Settings\\All Users\\Application Data\\Kodak\\Installer\\Setup.exe"= "c:\\WINDOWS\\system32\\spoolsv.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1723:TCP"= 1723:TCP:VPN "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "9322:TCP"= 9322:TCP:EKDiscovery R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [6/21/2008 11:24 PM 174600] R0 Amddfltr;Amd Disk Lower Filter Driver;c:\windows\system32\drivers\Amddfltr.sys [6/21/2008 11:49 PM 15416] R0 SafeBoot;SafeBoot;c:\windows\system32\drivers\SafeBoot.sys [5/30/2008 12:36 PM 108752] R0 SbAlg;SbAlg;c:\windows\system32\drivers\SbAlg.sys [5/30/2008 12:37 PM 51376] R0 SbFsLock;SbFsLock;c:\windows\system32\drivers\SbFsLock.sys [5/30/2008 12:37 PM 12928] R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\drivers\tffsport.sys [4/25/2009 8:54 PM 149376] R1 RsvLock;RsvLock;c:\windows\system32\drivers\rsvlock.sys [5/30/2008 12:37 PM 12496] R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [5/15/2007 7:08 PM 182576] R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336] R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336] R2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [5/15/2008 6:11 PM 1176824] R2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [6/2/2008 1:32 PM 18944] R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [5/30/2008 12:36 PM 256512] R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [5/15/2008 4:29 PM 475520] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [4/20/2010 7:22 AM 102448] R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [4/4/2007 3:16 PM 41216] S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\ekdiscovery.exe [2/11/2010 3:36 PM 300400] S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [6/22/2008 12:50 AM 193840] S3 memchek;memchek;c:\windows\system32\memchek.sys [8/4/2004 4:00 AM 2432] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] Cognizance REG_MULTI_SZ ASBroker ASChannel . Contents of the 'Scheduled Tasks' folder 2010-04-13 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\KSOBECKI\Application Data\Mozilla\Firefox\Profiles\220ltht1.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . ************************************************************************** scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(952) c:\windows\system32\ackpbsc.dll c:\windows\system32\aclog.dll c:\windows\system32\ACLIBEAY.dll c:\windows\system32\acevtsub.dll c:\windows\system32\asphat32.dll c:\windows\system32\acerrmes.dll c:\windows\system32\aspcom.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll c:\windows\system32\Ati2evxx.dll c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll c:\program files\ActivIdentity\ActivClient\acunlock.dll c:\windows\system32\aipingui.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll c:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll - - - - - - - > 'explorer.exe'(23844) c:\windows\system32\WININET.dll c:\windows\system32\APSHook.dll c:\windows\system32\ieframe.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Completion time: 2010-04-28 22:27:27 ComboFix-quarantined-files.txt 2010-04-29 02:27 ComboFix2.txt 2010-04-28 02:05 ComboFix3.txt 2010-04-26 18:38 Pre-Run: 213,855,825,920 bytes free Post-Run: 213,819,035,648 bytes free - - End Of File - - 2B8558AD49A8D08963D255200BE7A525 Link to post Share on other sites
schrauber Posted April 29, 2010 Share Posted April 29, 2010 Looks good. How is it running? Please update your version of Malwarebytes and run a quick scan, post back with the content of the logfile. Please run a free online scan with the ESET Online Scanner Note: You will need to use Internet Explorer for this scan Tick the box next to YES, I accept the Terms of Use Click Start When asked, allow the ActiveX control to install Click Start Make sure that the options Remove found threats and the option Scan unwanted applications is checked Click Scan (This scan can take several hours, so please be patient) Once the scan is completed, you may close the window Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt Copy and paste that log as a reply to this topic Please open OTL, set the extra registry tab to use safe list and hit the run scan button, post back with the 2 logfiles. Link to post Share on other sites
kensob Posted April 30, 2010 Author Share Posted April 30, 2010 ComboFix 10-04-29.05 - KSOBECKI 04/30/2010 7:00.5.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1789.771 [GMT -4:00] Running from: c:\documents and settings\KSOBECKI\Desktop\schrauber.exe Command switches used :: c:\documents and settings\KSOBECKI\Desktop\CFScript.txt AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C} * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2010-03-28 to 2010-04-30 ))))))))))))))))))))))))))))))) . 2010-04-29 02:19 . 2010-04-29 02:27 -------- d-----w- C:\schrauber 2010-04-28 01:53 . 2010-04-28 02:00 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995 2010-04-26 17:48 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys 2010-04-26 17:48 . 2008-04-13 18:40 34688 ----a-w- c:\windows\system32\dllcache\lbrtfdc.sys 2010-04-26 17:48 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys 2010-04-26 17:48 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\dllcache\changer.sys 2010-04-26 17:48 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys 2010-04-26 17:48 . 2008-04-13 18:41 8576 ----a-w- c:\windows\system32\dllcache\i2omgmt.sys 2010-04-26 12:33 . 2010-04-26 12:33 -------- d-----w- c:\documents and settings\KSOBECKI\Local Settings\Application Data\Mozilla 2010-04-25 22:21 . 2010-04-25 21:33 24064 ----a-w- c:\windows\system32\drivers\sfaudio.sys 2010-04-25 02:16 . 2010-04-25 02:16 293376 ----a-w- C:\nvmx55zj.exe 2010-04-23 14:23 . 2010-02-08 16:06 409600 ----a-w- c:\windows\system32\EKIJ5000MON.dll 2010-04-23 14:23 . 2010-02-08 16:06 196608 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\EKIJ5000PPR.dll 2010-04-23 14:23 . 2010-02-08 16:05 131072 ----a-w- c:\windows\system32\EKIJCOINST07.dll 2010-04-23 14:22 . 2010-04-23 14:22 -------- d-----w- c:\program files\MSXML 6.0 2010-04-23 14:15 . 2010-02-22 16:01 53248 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.XmlSerializers.dll 2010-04-23 14:15 . 2010-02-22 16:01 19968 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Serializable.dll 2010-04-23 14:15 . 2010-02-22 16:01 36864 ----a-w- c:\documents and settings\All Users\Application Data\Kodak\Installer\Interop.WindowsInstaller.dll 2010-04-22 14:50 . 2010-04-22 14:50 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer 2010-04-22 12:28 . 2010-04-22 12:28 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Malwarebytes 2010-04-22 12:27 . 2010-03-30 04:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-04-22 12:27 . 2010-04-22 12:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-04-22 12:27 . 2010-03-30 04:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-04-22 12:15 . 2010-04-22 12:15 552 ----a-w- c:\windows\system32\d3d8caps.dat 2010-04-22 12:15 . 2010-04-22 12:15 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe 2010-04-20 19:05 . 2008-04-14 00:12 82432 ----a-w- c:\windows\system32\dllcache\ws2_32.dll 2010-04-12 19:50 . 2007-08-24 16:13 142 ----a-w- c:\windows\wpd99.drv 2010-04-12 19:50 . 2010-04-12 19:50 51716 ----a-w- c:\windows\system32\pdf995mon.dll 2010-04-12 19:50 . 2010-04-12 19:50 249856 ----a-w- c:\windows\system32\pdfmona.dll 2010-04-09 02:03 . 2010-04-09 02:03 1924976 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe 2010-04-08 23:53 . 2010-04-08 23:53 0 ----a-w- c:\windows\nsreg.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-04-29 02:20 . 2010-03-30 20:37 -------- d-----w- c:\program files\QuickTime 2010-04-29 02:20 . 2009-03-23 16:31 -------- d-----w- c:\program files\Common Files\Symantec Shared 2010-04-28 02:13 . 2010-01-01 16:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2010-04-28 01:53 . 2009-04-14 11:07 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak 2010-04-26 15:15 . 2009-12-30 23:12 1324 ----a-w- c:\windows\system32\d3d9caps.dat 2010-04-23 16:37 . 2009-09-17 21:33 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Temp 2010-04-23 14:26 . 2010-03-01 12:54 -------- d-----w- c:\program files\Kodak 2010-04-15 12:48 . 2009-04-03 15:21 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS 2010-04-15 02:36 . 2008-06-22 04:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2010-04-13 00:48 . 2009-04-07 00:26 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\TaxCut 2010-04-12 19:50 . 2009-04-06 16:12 -------- d-----w- c:\program files\PDF995 2010-04-06 15:29 . 2009-05-14 23:32 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Skype 2010-04-02 02:17 . 2009-04-02 00:57 -------- d-----w- c:\program files\CCleaner 2010-03-30 20:37 . 2010-03-30 20:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer 2010-03-23 22:59 . 2010-03-23 22:59 2934896 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Downloads\HRBlockOH.exe 2010-03-23 22:41 . 2010-03-08 01:16 -------- d-----w- c:\program files\DeductionPro 2009 2010-03-23 20:24 . 2010-03-23 20:24 21195208 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US65016901xupd.exe 2010-03-21 21:44 . 2010-03-21 21:44 -------- d-----w- c:\documents and settings\KSOBECKI\Application Data\Apple Computer 2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Common Files\Apple 2010-03-21 12:50 . 2010-03-21 12:50 -------- d-----w- c:\program files\Apple Software Update 2010-03-11 12:38 . 2004-08-04 08:00 832512 ----a-w- c:\windows\system32\wininet.dll 2010-03-11 12:38 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2010-03-11 12:38 . 2004-08-04 08:00 17408 ----a-w- c:\windows\system32\corpol.dll 2010-03-09 11:09 . 2004-08-04 08:00 430080 ----a-w- c:\windows\system32\vbscript.dll 2010-03-08 01:18 . 2010-03-08 01:17 19486488 ----a-w- c:\documents and settings\All Users\Application Data\TaxCut\2009\Update\US30026501xupd.exe 2010-03-08 01:16 . 2008-06-22 03:38 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-03-08 01:15 . 2010-03-08 01:14 -------- d-----w- c:\program files\HRBlock2009 2010-03-08 01:13 . 2009-04-06 16:09 -------- d-----w- c:\documents and settings\All Users\Application Data\TaxCut 2010-03-01 13:03 . 2009-09-17 22:51 -------- d-----w- c:\documents and settings\All Users\Application Data\kds_kodak 2010-03-01 13:02 . 2009-09-17 22:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Eastman Kodak Company 2010-02-24 13:11 . 2004-08-04 08:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys 2010-02-16 14:08 . 2004-08-04 08:00 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe 2010-02-16 13:25 . 2004-08-04 08:00 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe 2010-02-12 04:33 . 2004-08-04 08:00 100864 ----a-w- c:\windows\system32\6to4svc.dll 2010-02-11 12:02 . 2004-08-04 08:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys . ((((((((((((((((((((((((((((( [email protected]_02.00.41 ))))))))))))))))))))))))))))))))))))))))) . + 2010-04-28 02:17 . 2010-04-28 02:17 16384 c:\windows\Temp\Perflib_Perfdata_290.dat + 2010-04-23 14:23 . 2010-02-08 16:09 1634304 c:\windows\system32\spool\drivers\w32x86\3\ekij5000mui.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2008-04-14 53760] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc] 2007-05-15 23:08 112640 ----a-w- c:\windows\system32\ackpbsc.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock] 2007-05-15 23:08 281088 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard] 2008-05-21 00:42 111888 ----a-w- c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\system32\APSHook.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-03-24 18:17 952768 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\adobearm.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2010-04-04 05:42 36272 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableNotifications"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\mqsvc.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"= "c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"= "c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM\\aim.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\WINDOWS\\system32\\fxsclnt.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Kodak\\AiO\\Center\\AiOHomeCenter.exe"= "c:\\Program Files\\Kodak\\AiO\\Center\\Kodak.Statistics.exe"= "c:\\Program Files\\Kodak\\AiO\\Center\\NetworkPrinterDiscovery.exe"= "c:\\Program Files\\Kodak\\AiO\\Firmware\\KodakAiOUpdater.exe"= "c:\\Documents and Settings\\All Users\\Application Data\\Kodak\\Installer\\Setup.exe"= "c:\\WINDOWS\\system32\\spoolsv.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1723:TCP"= 1723:TCP:VPN "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "9322:TCP"= 9322:TCP:EKDiscovery R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [6/21/2008 11:24 PM 174600] R0 Amddfltr;Amd Disk Lower Filter Driver;c:\windows\system32\drivers\Amddfltr.sys [6/21/2008 11:49 PM 15416] R0 SafeBoot;SafeBoot;c:\windows\system32\drivers\SafeBoot.sys [5/30/2008 12:36 PM 108752] R0 SbAlg;SbAlg;c:\windows\system32\drivers\SbAlg.sys [5/30/2008 12:37 PM 51376] R0 SbFsLock;SbFsLock;c:\windows\system32\drivers\SbFsLock.sys [5/30/2008 12:37 PM 12928] R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\drivers\tffsport.sys [4/25/2009 8:54 PM 149376] R1 RsvLock;RsvLock;c:\windows\system32\drivers\rsvlock.sys [5/30/2008 12:37 PM 12496] R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [5/15/2007 7:08 PM 182576] R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336] R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [8/4/2004 4:00 AM 14336] R2 ATService;AuthenTec Fingerprint Service;c:\program files\Fingerprint Sensor\AtService.exe [5/15/2008 6:11 PM 1176824] R2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [6/2/2008 1:32 PM 18944] R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [5/30/2008 12:36 PM 256512] R3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [5/15/2008 4:29 PM 475520] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [4/20/2010 7:22 AM 102448] R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [4/4/2007 3:16 PM 41216] S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\ekdiscovery.exe [2/11/2010 3:36 PM 300400] S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [6/22/2008 12:50 AM 193840] S3 memchek;memchek;c:\windows\system32\memchek.sys [8/4/2004 4:00 AM 2432] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] Cognizance REG_MULTI_SZ ASBroker ASChannel . Contents of the 'Scheduled Tasks' folder 2010-04-13 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.yahoo.com/ IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\KSOBECKI\Application Data\Mozilla\Firefox\Profiles\220ltht1.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - plugin: c:\program files\Virtual Earth 3D\npVE3D.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-04-30 07:06 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(952) c:\windows\system32\ackpbsc.dll c:\windows\system32\aclog.dll c:\windows\system32\ACLIBEAY.dll c:\windows\system32\acevtsub.dll c:\windows\system32\asphat32.dll c:\windows\system32\acerrmes.dll c:\windows\system32\aspcom.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll c:\windows\system32\Ati2evxx.dll c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll c:\program files\ActivIdentity\ActivClient\acunlock.dll c:\windows\system32\aipingui.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll c:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll - - - - - - - > 'explorer.exe'(41656) c:\windows\system32\WININET.dll c:\windows\system32\APSHook.dll c:\windows\system32\ieframe.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Completion time: 2010-04-30 07:08:19 ComboFix-quarantined-files.txt 2010-04-30 11:08 ComboFix2.txt 2010-04-29 02:27 ComboFix3.txt 2010-04-28 02:05 ComboFix4.txt 2010-04-26 18:38 Pre-Run: 213,766,815,744 bytes free Post-Run: 213,722,521,600 bytes free - - End Of File - - 1034606270ED3937E6A2D1D29436EAE4 Link to post Share on other sites
schrauber Posted April 30, 2010 Share Posted April 30, 2010 Did you see my last answer? Why did you post another Combofix logfile? Link to post Share on other sites
kensob Posted May 1, 2010 Author Share Posted May 1, 2010 I am sorry but it went to a second page and when I scrolled down there I just saw your last post and thought that was the end. I will post the requested logs in separate replies with the first one here. Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4052 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 5/1/2010 7:05:43 AM mbam-log-2010-05-01 (07-05-43).txt Scan type: Quick scan Objects scanned: 124278 Time elapsed: 11 minute(s), 24 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a2ba40a0-74f1-52bd-f411-00b15a2c8953} (Trojan.Ertfor) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Link to post Share on other sites
kensob Posted May 1, 2010 Author Share Posted May 1, 2010 C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\PRAGMAsbcofvcpci\PRAGMAd.sys.vir a variant of Win32/Rootkit.Kryptik.AZ trojan cleaned by deleting - quarantined C:\Qoobox\Quarantine\C\WINDOWS\system32\tafqgkzvxu.exe.vir Win32/Adware.GooochiBiz.AE.Gen application deleted - quarantined C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1\A0000110.dll probably a variant of Win32/Agent trojan cleaned by deleting - quarantined C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1\A0000129.sys a variant of Win32/Rootkit.Kryptik.AZ trojan cleaned by deleting - quarantined C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1\A0000130.dll a variant of Win32/Wimpixo.AA trojan cleaned by deleting - quarantined C:\System Volume Information\_restore{A80475B6-CF6D-4B3A-BD21-B16C67DB5304}\RP1\A0000135.exe Win32/Adware.GooochiBiz.AE.Gen application deleted - quarantined OTL logfile created on: 5/1/2010 8:51:52 AM - Run 3 OTL by OldTimer - Version 3.2.2.0 Folder = C:\Documents and Settings\KSOBECKI\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 40.00% Memory free 4.00 Gb Paging File | 3.00 Gb Available in Paging File | 72.00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 231.87 Gb Total Space | 198.90 Gb Free Space | 85.78% Space Free | Partition Type: NTFS Drive D: | 1.00 Gb Total Space | 0.97 Gb Free Space | 97.24% Space Free | Partition Type: FAT32 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: KENHPLT Current User Name: KSOBECKI Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Processes (SafeList) ========== PRC - [2010/04/24 22:12:17 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe PRC - [2009/02/26 15:07:10 | 001,443,144 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe PRC - [2009/02/26 15:07:08 | 001,799,496 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe PRC - [2009/02/01 23:37:00 | 002,440,120 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe PRC - [2008/12/18 16:46:30 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe PRC - [2008/06/02 13:32:16 | 000,018,944 | ---- | M] (Hewlett-Packard Development Company, L.P) -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe PRC - [2008/05/30 12:36:20 | 000,256,512 | ---- | M] (SafeBoot International) -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe PRC - [2008/05/20 20:47:18 | 000,065,296 | ---- | M] (Bioscrypt Inc.) -- c:\Program Files\Hewlett-Packard\IAM\Bin\asghost.exe PRC - [2008/05/15 18:11:12 | 001,176,824 | ---- | M] (AuthenTec, Inc.) -- c:\Program Files\Fingerprint Sensor\AtService.exe PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007/12/11 15:15:04 | 000,012,800 | ---- | M] (Agere Systems) -- C:\WINDOWS\system32\agrsmsvc.exe PRC - [2007/05/15 19:08:40 | 000,182,576 | ---- | M] (ActivIdentity) -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe ========== Modules (SafeList) ========== MOD - [2010/04/24 22:12:17 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe MOD - [2008/03/25 08:17:04 | 000,076,048 | ---- | M] (Bioscrypt Inc.) -- C:\WINDOWS\system32\APSHook.dll ========== Win32 Services (SafeList) ========== SRV - [2010/02/11 15:36:12 | 000,300,400 | ---- | M] (Eastman Kodak Company) [Auto | Stopped] -- C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe -- (Kodak AiO Network Discovery Service) SRV - [2009/02/26 15:07:08 | 001,799,496 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService) SRV - [2009/02/01 23:37:00 | 002,440,120 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus) SRV - [2009/02/01 21:43:02 | 000,320,840 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE -- (SNAC) SRV - [2008/12/18 16:46:30 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr) SRV - [2008/12/18 16:46:30 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr) SRV - [2008/12/10 15:46:58 | 003,093,880 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate) SRV - [2008/06/02 13:32:16 | 000,018,944 | ---- | M] (Hewlett-Packard Development Company, L.P) [Auto | Running] -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe -- (HP ProtectTools Service) SRV - [2008/05/30 12:36:20 | 000,256,512 | ---- | M] (SafeBoot International) [Auto | Running] -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe -- (HpFkCryptService) SRV - [2008/05/20 20:42:40 | 000,111,888 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll -- (ASBroker) SRV - [2008/05/20 20:42:34 | 000,137,488 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASChnl.dll -- (ASChannel) SRV - [2008/05/15 18:11:12 | 001,176,824 | ---- | M] (AuthenTec, Inc.) [Auto | Running] -- c:\Program Files\Fingerprint Sensor\AtService.exe -- (ATService) SRV - [2007/12/11 15:15:04 | 000,012,800 | ---- | M] (Agere Systems) [Auto | Running] -- C:\WINDOWS\system32\agrsmsvc.exe -- (AgereModemAudio) SRV - [2007/05/15 19:08:40 | 000,182,576 | ---- | M] (ActivIdentity) [Auto | Running] -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe -- (accoca) SRV - [2006/01/06 15:07:26 | 000,077,824 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\hphipm11.exe -- (Pml Driver HPH11) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme) DRV - [2010/02/16 05:00:00 | 001,324,720 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100430.036\NAVEX15.SYS -- (NAVEX15) DRV - [2010/02/16 05:00:00 | 000,084,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100430.036\NAVENG.SYS -- (NAVENG) DRV - [2009/08/27 04:00:00 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl) DRV - [2009/08/27 04:00:00 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv) DRV - [2009/03/23 12:32:31 | 000,123,952 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent) DRV - [2008/12/19 15:08:12 | 000,319,792 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\srtspl.sys -- (SRTSPL) DRV - [2008/12/19 15:08:12 | 000,280,112 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\srtsp.sys -- (SRTSP) DRV - [2008/12/19 15:08:12 | 000,043,824 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srtspx.sys -- (SRTSPX) DRV - [2008/09/09 14:54:42 | 000,421,424 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv) DRV - [2008/08/21 11:13:56 | 000,191,536 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI) DRV - [2008/08/21 11:13:56 | 000,027,696 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV) DRV - [2008/05/30 12:37:06 | 000,051,376 | ---- | M] (SafeBoot N.V.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SbAlg.sys -- (SbAlg) DRV - [2008/05/30 12:37:02 | 000,012,928 | ---- | M] (SafeBoot International) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\SbFsLock.sys -- (SbFsLock) DRV - [2008/05/30 12:37:00 | 000,012,496 | ---- | M] (SafeBoot International) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\rsvlock.sys -- (RsvLock) DRV - [2008/05/30 12:36:58 | 000,108,752 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SafeBoot.sys -- (SafeBoot) DRV - [2008/05/27 09:55:48 | 000,174,600 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\ahcix86.sys -- (ahcix86) DRV - [2008/05/23 09:51:02 | 000,024,624 | ---- | M] (Hewlett-Packard Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\hpdskflt.sys -- (hpdskflt) DRV - [2008/05/23 09:50:16 | 000,028,592 | ---- | M] (Hewlett-Packard Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Accelerometer.sys -- (Accelerometer) DRV - [2008/05/15 20:33:44 | 002,881,536 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2008/05/15 16:29:32 | 000,475,520 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATSwpWDF.sys -- (ATSwpWDF) DRV - [2008/05/08 10:02:52 | 000,203,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rmcast.sys -- (RMCAST) DRV - [2008/04/28 18:22:10 | 000,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey) DRV - [2008/04/13 14:40:58 | 000,008,192 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\changer.sys -- (Changer) DRV - [2008/04/13 14:40:50 | 000,149,376 | ---- | M] (M-Systems) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\tffsport.sys -- (tffsport) DRV - [2008/04/13 14:40:26 | 000,034,688 | ---- | M] (Toshiba Corp.) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\lbrtfdc.sys -- (lbrtfdc) DRV - [2008/04/13 14:39:44 | 000,092,544 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mqac.sys -- (MQAC) DRV - [2008/04/13 12:36:05 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2008/04/11 12:19:42 | 000,338,944 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService) DRV - [2008/04/10 17:27:34 | 001,804,160 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC) DRV - [2008/03/27 14:14:06 | 000,224,672 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP) DRV - [2008/03/21 14:35:14 | 001,287,552 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX) DRV - [2008/03/12 11:43:26 | 000,015,416 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Amddfltr.sys -- (Amddfltr) DRV - [2008/02/29 19:13:38 | 001,202,560 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2007/11/29 14:35:44 | 000,163,328 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) Broadcom NetLink DRV - [2007/06/18 20:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr) DRV - [2007/04/16 19:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM) DRV - [2007/04/04 15:16:20 | 000,041,216 | ---- | M] (Infineon Technologies AG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ifxtpm.sys -- (IFXTPM) DRV - [2006/01/06 15:07:27 | 000,018,928 | ---- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hphius11.sys -- (Dot4Usb HPH11) DRV - [2006/01/06 15:07:27 | 000,016,112 | ---- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hphipr11.sys -- (Dot4Print HPH11) DRV - [2006/01/06 15:07:26 | 000,050,896 | ---- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hphid411.sys -- (Dot4 HPH11) DRV - [2001/08/17 15:10:28 | 000,035,913 | ---- | M] (SMC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA) DRV - [2001/08/17 11:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://search.msn.com/spbasic.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/27 09:28:05 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/26 08:33:07 | 000,000,000 | ---D | M] [2010/04/26 08:33:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Extensions [2010/01/05 13:08:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Extensions\[email protected] [2010/04/30 15:47:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Firefox\Profiles\220ltht1.default\extensions [2010/04/27 09:10:08 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Firefox\Profiles\220ltht1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010/04/26 08:33:07 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions O1 HOSTS File: ([2010/04/27 22:00:27 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll (Apple Inc.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1237572595955 (MUWebControl Class) O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control) O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0...oUploader55.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_14) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\WINDOWS\system32\APSHook.dll) - C:\WINDOWS\system32\APSHook.dll (Bioscrypt Inc.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\ackpbsc: DllName - c:\WINDOWS\system32\ackpbsc.dll - C:\WINDOWS\system32\ackpbsc.dll (ActivIdentity) O20 - Winlogon\Notify\acunlock: DllName - c:\Program Files\ActivIdentity\ActivClient\acunlock.dll - c:\Program Files\ActivIdentity\ActivClient\acunlock.dll (ActivIdentity) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\OneCard: DllName - c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll - c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll (Bioscrypt Inc.) O24 - Desktop BackupWallPaper: C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010/05/01 06:59:58 | 000,000,000 | ---D | C] -- C:\Program Files\ESET [2010/04/30 23:19:13 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\KSOBECKI\Recent [2010/04/30 08:45:28 | 000,000,000 | -HSD | C] -- C:\RECYCLER [2010/04/28 22:19:48 | 000,000,000 | ---D | C] -- C:\schrauber [2010/04/27 21:53:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\pdf995 [2010/04/26 13:48:28 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\drivers\lbrtfdc.sys [2010/04/26 13:48:28 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\dllcache\lbrtfdc.sys [2010/04/26 13:48:23 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\changer.sys [2010/04/26 13:48:23 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\changer.sys [2010/04/26 13:48:20 | 000,008,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\i2omgmt.sys [2010/04/26 08:33:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Mozilla [2010/04/26 08:33:05 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2010/04/25 18:21:26 | 000,024,064 | ---- | C] (Sonic Focus, Inc) -- C:\WINDOWS\System32\drivers\sfaudio.sys [2010/04/25 18:18:53 | 000,000,000 | RHSD | C] -- C:\cmdcons [2010/04/25 18:17:13 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2010/04/25 18:17:12 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2010/04/25 18:17:12 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2010/04/25 18:17:12 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2010/04/25 18:16:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2010/04/25 17:36:43 | 000,000,000 | ---D | C] -- C:\Qoobox [2010/04/24 22:12:12 | 000,562,688 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe [2010/04/23 10:23:51 | 000,409,600 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJ5000MON.dll [2010/04/23 10:23:51 | 000,131,072 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJCOINST07.dll [2010/04/23 10:22:08 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 6.0 [2010/04/22 10:50:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple Computer [2010/04/22 08:28:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Application Data\Malwarebytes [2010/04/22 08:27:53 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/04/22 08:27:51 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010/04/22 08:27:51 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010/04/22 08:27:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2010/04/22 08:15:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe [2010/04/21 08:46:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun [2010/04/20 15:46:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia [2010/04/20 15:10:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe [2010/04/20 15:05:58 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ws2_32.dll [2010/04/12 15:50:39 | 000,249,856 | ---- | C] (TODO: <Company name>) -- C:\WINDOWS\System32\pdfmona.dll [2009/03/20 20:16:56 | 000,180,224 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll [2007/07/05 04:28:52 | 000,176,128 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010/05/01 08:22:55 | 007,077,888 | -H-- | M] () -- C:\Documents and Settings\KSOBECKI\NTUSER.DAT [2010/04/30 08:54:56 | 000,053,248 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/04/30 07:08:19 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010/04/30 07:06:09 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2010/04/30 06:59:17 | 003,924,193 | R--- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\schrauber.exe [2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010/04/29 07:39:11 | 000,048,745 | ---- | M] () -- C:\Documents and Settings\All Users\Documents\My Documents\s0p17h4102T.docx [2010/04/29 07:35:17 | 000,056,293 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\April.docx [2010/04/29 06:32:10 | 000,006,591 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Application Data\PrimoPDFSet.xml [2010/04/27 22:00:27 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010/04/27 22:00:18 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010/04/27 21:53:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010/04/27 21:53:16 | 1875,759,104 | -HS- | M] () -- C:\hiberfil.sys [2010/04/27 21:51:41 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\ntuser.ini [2010/04/26 15:58:12 | 000,256,512 | ---- | M] () -- C:\WINDOWS\PEV.exe [2010/04/26 13:56:51 | 005,364,298 | -H-- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\IconCache.db [2010/04/26 13:49:20 | 000,007,600 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\w1vjs2h771 [2010/04/26 13:49:20 | 000,007,600 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\w1vjs2h771 [2010/04/26 11:15:13 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010/04/26 08:06:14 | 000,000,791 | ---- | M] () -- C:\WINDOWS\orun32.ini [2010/04/25 18:19:04 | 000,000,293 | RHS- | M] () -- C:\boot.ini [2010/04/25 17:33:01 | 000,024,064 | ---- | M] (Sonic Focus, Inc) -- C:\WINDOWS\System32\drivers\sfaudio.sys [2010/04/24 22:16:06 | 000,293,376 | ---- | M] () -- C:\nvmx55zj.exe [2010/04/24 22:12:17 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe [2010/04/23 13:24:13 | 000,013,426 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841 [2010/04/23 13:24:13 | 000,013,426 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\q841 [2010/04/23 10:26:44 | 000,000,775 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\KODAK AiO Home Center.lnk [2010/04/22 08:27:56 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010/04/22 08:19:01 | 000,011,868 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60 [2010/04/22 08:19:01 | 000,011,868 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\34f60 [2010/04/22 08:15:40 | 000,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat [2010/04/21 02:48:33 | 000,000,094 | ---- | M] () -- C:\WINDOWS\wininit.ini [2010/04/20 16:58:28 | 000,001,661 | ---- | M] () -- C:\WINDOWS\lsrslt.ini [2010/04/20 15:42:26 | 000,571,308 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010/04/20 15:42:26 | 000,477,702 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010/04/20 15:42:26 | 000,082,990 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010/04/13 16:31:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010/04/12 15:54:43 | 000,000,028 | ---- | M] () -- C:\WINDOWS\pdf995.ini [2010/04/12 15:50:39 | 000,249,856 | ---- | M] (TODO: <Company name>) -- C:\WINDOWS\System32\pdfmona.dll [2010/04/12 15:50:39 | 000,051,716 | ---- | M] () -- C:\WINDOWS\System32\pdf995mon.dll [2010/04/08 19:53:37 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2010/04/29 07:39:11 | 000,048,745 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\My Documents\s0p17h4102T.docx [2010/04/26 13:48:03 | 000,007,600 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\w1vjs2h771 [2010/04/26 13:48:03 | 000,007,600 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\w1vjs2h771 [2010/04/25 18:19:04 | 000,000,223 | ---- | C] () -- C:\Boot.bak [2010/04/25 18:18:57 | 000,260,272 | ---- | C] () -- C:\cmldr [2010/04/25 18:17:13 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe [2010/04/25 18:17:12 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe [2010/04/25 18:17:12 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2010/04/25 18:17:12 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2010/04/25 18:17:12 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2010/04/25 17:28:07 | 003,924,193 | R--- | C] () -- C:\Documents and Settings\KSOBECKI\Desktop\schrauber.exe [2010/04/24 22:16:03 | 000,293,376 | ---- | C] () -- C:\nvmx55zj.exe [2010/04/23 10:26:44 | 000,000,775 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\KODAK AiO Home Center.lnk [2010/04/23 10:14:02 | 000,035,634 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\c4u.log [2010/04/23 07:52:23 | 000,013,426 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841 [2010/04/23 07:52:23 | 000,013,426 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\q841 [2010/04/22 08:27:56 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010/04/22 08:17:00 | 1875,759,104 | -HS- | C] () -- C:\hiberfil.sys [2010/04/22 08:15:40 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat [2010/04/21 21:49:19 | 000,011,868 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60 [2010/04/21 21:49:19 | 000,011,868 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\34f60 [2010/04/20 17:38:45 | 000,000,094 | ---- | C] () -- C:\WINDOWS\wininit.ini [2010/04/20 16:58:28 | 000,001,661 | ---- | C] () -- C:\WINDOWS\lsrslt.ini [2010/04/12 15:54:43 | 000,000,028 | ---- | C] () -- C:\WINDOWS\pdf995.ini [2010/04/12 15:50:40 | 000,000,142 | ---- | C] () -- C:\WINDOWS\wpd99.drv [2010/04/12 15:50:39 | 000,051,716 | ---- | C] () -- C:\WINDOWS\System32\pdf995mon.dll [2010/04/08 19:53:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2010/01/21 22:49:12 | 000,000,044 | ---- | C] () -- C:\WINDOWS\SMWizard.INI [2009/09/17 19:09:54 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll [2009/04/29 12:46:02 | 000,000,034 | ---- | C] () -- C:\WINDOWS\hpfsched.ini [2009/04/29 12:40:27 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\hpodinet.dll [2009/04/10 12:37:43 | 000,176,235 | ---- | C] () -- C:\WINDOWS\System32\Primomonnt.dll [2008/06/22 00:28:19 | 000,028,510 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2008/05/30 12:36:58 | 000,108,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\SafeBoot.sys [2008/04/28 12:13:33 | 000,000,310 | ---- | C] () -- C:\WINDOWS\primopdf.ini [2008/04/10 13:27:34 | 001,804,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys [2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini [2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini [2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini [2007/05/10 02:16:40 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys [2006/05/19 22:39:58 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini [2005/04/03 18:30:00 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\scardsyn.dll [2004/08/07 09:19:16 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2004/08/07 09:12:40 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini [1998/05/06 23:10:00 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\ODMA32.dll < End of report > OTL Extras logfile created on: 5/1/2010 8:51:56 AM - Run 3 OTL by OldTimer - Version 3.2.2.0 Folder = C:\Documents and Settings\KSOBECKI\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 40.00% Memory free 4.00 Gb Paging File | 3.00 Gb Available in Paging File | 72.00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 231.87 Gb Total Space | 198.90 Gb Free Space | 85.78% Space Free | Partition Type: NTFS Drive D: | 1.00 Gb Total Space | 0.97 Gb Free Space | 97.24% Space Free | Partition Type: FAT32 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: KENHPLT Current User Name: KSOBECKI Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusOverride" = 0 "FirewallOverride" = 0 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 "DoNotAllowExceptions" = 0 "DisableNotifications" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DoNotAllowExceptions" = 0 "DisableNotifications" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1723:TCP" = 1723:TCP:*:Enabled:VPN "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 "3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009 "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 "9322:TCP" = 9322:TCP:*:Enabled:EKDiscovery ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation) "C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe" = C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe:*:Enabled:SMC Service -- (Symantec Corporation) "C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE" = C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE:*:Enabled:SNAC Service -- (Symantec Corporation) "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" = C:\Program Files\Common Files\Symantec Shared\ccApp.exe:*:Enabled:Symantec Email -- (Symantec Corporation) "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.) "C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -- (AOL LLC) "C:\Program Files\AIM\aim.exe" = C:\Program Files\AIM\aim.exe:*:Enabled:AIM -- (AOL LLC) "C:\WINDOWS\system32\fxsclnt.exe" = C:\WINDOWS\system32\fxsclnt.exe:*:Enabled:Microsoft Fax Console -- (Microsoft Corporation) "C:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe" = C:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe:*:Enabled:Kodak.AiO.HomeCenter -- (Eastman Kodak Company) "C:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe" = C:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe:*:Enabled:Kodak.AiO.Statistics -- (Eastman Kodak Company) "C:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe" = C:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe:*:Enabled:Kodak.AiO.SetupUtility -- (Eastman Kodak Company) "C:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe" = C:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe:*:Enabled:Kodak.AiO.FwUpdater -- (Eastman Kodak Company) "C:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe" = C:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe:*:Enabled:Kodak.AiO.Installer -- (Eastman Kodak Company) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{04788045-DEF3-4911-91B5-384A6915F21B}" = TaxCut Ohio 2008 "{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center "{05B62241-5495-46EF-5086-DBE0F37F052C}" = Catalyst Control Center Localization Korean "{0645A454-AD44-4F0D-99CF-6B762735AD1F}" = aioprnt "{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour "{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer "{0F98662A-EA83-414F-8766-3FCE46A32641}" = Credential Manager for HP ProtectTools "{10934A28-0CC6-4B98-A14F-76B3546003AF}" = ksDIP "{154E4F71-DFC0-4B31-8D99-F97615031B02}" = HP Webcam Application "{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0 "{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java 6 Update 14 "{27FE77BD-2E0A-385C-C2CC-8367D877356F}" = CCC Help Norwegian "{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com "{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime "{2CD54AED-740B-1418-464E-CC8E15AD1E4F}" = Catalyst Control Center Localization Swedish "{2D0EE88B-8720-50A7-7F31-503B4300A8C5}" = Catalyst Control Center Localization French "{2D87E961-577B-492B-AD54-1368680FB9A7}" = Bing Maps 3D "{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.40 E1 "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{35EB3E58-F46C-CB48-C623-16A455C37C5D}" = CCC Help Turkish "{36C491D0-A196-F49C-C63C-3509D7A2B91D}" = CCC Help Finnish "{37AF26EB-ACCD-4F9C-A13E-81483F932203}" = Catalyst Control Center - Branding "{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = HP Webcam "{45E6BF4C-6DC8-B1BB-517C-5F2C1D055A9B}" = CCC Help Hungarian "{48072101-4DFE-9DC2-9F5D-DE0EF7193C98}" = CCC Help Korean "{48B41C3A-9A92-4B81-B653-C97FEB85C910}" = C4USelfUpdater "{49798684-CC48-AF5C-E513-9FFF61EFD3A6}" = CCC Help Japanese "{4BFA6EEB-AAED-4334-8E98-A907DE4DD5CF}" = AMD Driver Support for HP 3D DriverGuard "{4CF11D44-43B7-1359-B438-972C69D7AD6F}" = CCC Help Spanish "{4ED20E34-D511-A85B-D7E5-755AE64D5F6C}" = CCC Help Portuguese "{53A19323-917A-4822-B27E-A57D1EF6E9FC}" = H&R Block Deluxe + Efile + State 2009 "{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support "{56BA241F-580C-43D2-8403-947241AAE633}" = center "{57B186F6-E6A7-A997-92E6-3E8C6189F497}" = Catalyst Control Center Localization Japanese "{5AB422C9-E804-1331-233E-E44D8BBC1862}" = CCC Help German "{5ED80CF6-D54D-5F9B-2B9C-E3B6F927879D}" = CCC Help Czech "{60AFC32A-B82F-3818-E90B-A71446BBCCD6}" = Catalyst Control Center Localization Greek "{6162653F-D1AB-6708-C73B-8411296900AE}" = Catalyst Control Center Localization Portuguese "{6179EAEB-0C72-0241-DC0B-0258E86B982A}" = ccc-core-preinstall "{64FBF438-35D1-8A01-FB00-36911B07FC72}" = Catalyst Control Center Graphics Light "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{6B4469FE-20FA-9E1D-6634-CF971706BD24}" = Catalyst Control Center Localization Chinese Traditional "{6C17DE97-6A5A-FA9C-0F4C-8B027E6AC014}" = CCC Help Russian "{6FCA773E-903A-5C83-D379-DD53F9EFD794}" = Catalyst Control Center Localization Turkish "{70CEFEBA-F757-4DBE-8A21-027C326137CE}" = HP Software Setup 5.00.A.7 "{747626CF-7958-290F-A7D8-6EE6549C8614}" = Catalyst Control Center Localization Hungarian "{75D7BB3A-9AB7-4ad1-AD5E-0059B90C624B}" = HP ProtectTools Security Manager Suite "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{7B459B8C-D870-2C14-9BA7-ABFFBCE7CD34}" = CCC Help Italian "{7BE1B3CE-5476-B847-4719-4421AEC5C663}" = CCC Help Thai "{7FD8231E-3991-48D7-A2C8-2C42A7075FB1}" = HP User Guide Bluetooth Addendum 0062 "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{8595812B-9104-4196-B629-FD298D819399}" = HP User Guides 0097 "{875FDD1A-4259-9361-572C-780AC637C81A}" = Catalyst Control Center Localization Czech "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8F676C36-74D3-9B7B-00FC-733EE5AFDA95}" = CCC Help Chinese Traditional "{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12 "{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007 "{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007 "{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007 "{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007 "{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007 "{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007 "{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007 "{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007 "{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007 "{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{97F4D62E-5AEB-4649-BABF-4712C6EF6845}" = DeductionPro 2009 "{9ADABDDE-9644-461B-9E73-83FA3EFCAB50}" = HP Wireless Assistant "{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR "{A2CB5EC7-E64F-5E35-2A23-63CB198649F5}" = CCC Help Greek "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser "{A777845E-F260-4572-787B-2BD08E560C78}" = Catalyst Control Center Localization Spanish "{A7A1BCB9-B9EE-3DBB-6F1C-570C532B9190}" = CCC Help French "{A93C4E94-1005-489D-BEAA-B873C1AA6CFC}" = HP Help and Support "{A9884559-F231-7727-95F4-41FDB052A536}" = Catalyst Control Center Localization Russian "{AB785290-EA80-7A10-B2C6-98919E514A68}" = Catalyst Control Center Graphics Full New "{AC194855-F7AC-4D04-B4C9-07BA46FCB697}" = ActivClient 6.1 x86 "{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2 "{AEA355A4-997D-A49D-A57A-CF537FFFEC84}" = Skins "{B18A542F-C99B-73C9-6552-73E1216E8834}" = CCC Help Dutch "{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0 "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy "{B5764B71-4BCE-206A-DE15-2E05469AA74C}" = Catalyst Control Center Localization Polish "{B817499D-2D52-2F37-DF6F-40735748FA88}" = CCC Help English "{BBB33AD6-BCF7-4002-B6A0-6DC679AE5C18}" = TaxCut Premium + State + Efile 2008 "{BC66641A-3279-BB5E-BEAB-99B39D13B3BD}" = CCC Help Polish "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver "{C1B0BDC8-0624-4036-90D1-F7DF0EE8C96D}" = Symantec Endpoint Protection "{C3D86DED-91D7-A890-5E9E-D14D993B5E9E}" = Catalyst Control Center Localization Dutch "{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries "{C4BEF3C4-9DF1-6D99-6C46-BBBF8E4B07A5}" = ccc-core-static "{C616F2BE-6A02-4E90-ABC8-B468E8575072}" = H&R Block Ohio 2009 "{C6BB4BD5-15D5-0B2D-CF4A-49BDCD7B3AC3}" = Catalyst Control Center Localization Norwegian "{C90BE263-E9B8-AD82-C517-3197FA4DA9C4}" = CCC Help Danish "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CBC24502-5EB5-45B6-9E56-E6A2F6AFA367}" = HP JavaCard for HP ProtectTools "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D405A9E1-5D02-46FB-A2B3-796F1F218B32}" = HP ProtectTools Security Manager "{D9C94F63-6B2C-9BFA-F37C-E48E1B6133E1}" = CCC Help Swedish "{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq "{DE6B7599-D3EF-4436-8836-BAA0B0D7768D}" = aiofw "{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK AiO Home Center "{E19DF3EF-351E-EE5E-623B-1A99C8C3EB5F}" = Catalyst Control Center Graphics Full Existing "{E2EF1380-9963-C7F9-3478-1046EC008C02}" = Catalyst Control Center Localization Chinese Standard "{E5C1C126-1687-4868-A3DD-B807176E4970}" = HP 3D DriveGuard "{E78D8DE3-E3CD-E89C-D5A0-D8FFE5F6E7F9}" = CCC Help Chinese Standard "{EA7D5022-7744-4D28-0E83-2DF9678C27B6}" = Catalyst Control Center Core Implementation "{EDD0A584-1ABB-8E7B-97AB-743C7E35EEA7}" = Catalyst Control Center Localization German "{EFBC8D78-75EA-4BB1-0CC6-172BFDF4B70F}" = Catalyst Control Center Localization Danish "{F01701B8-2C94-282D-9339-23AFBEDBE3E2}" = Catalyst Control Center Localization Italian "{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX "{F0BE302E-6B30-B816-4EA3-23CD6A23B08D}" = ccc-utility "{F173C2B3-296F-458C-98FF-1676A42EBA02}" = HP Wallpaper "{F657EF23-08BB-4C8D-B688-78C20FA657EA}" = Drive Encryption for HP ProtectTools "{F940B4EC-8504-CEE5-F36C-C2F5471D9E87}" = Catalyst Control Center Localization Thai "{FBAA2B2F-002D-45BB-291 Link to post Share on other sites
schrauber Posted May 1, 2010 Share Posted May 1, 2010 Hi, Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application. NOT supported for use in 9x or ME Upgrading Java: Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 20. Click the "Download" button to the right. Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.". Click on Continue. Click on the link to download Windows Offline Installation (jre-6u20-windows-i586.exe) and save it to your desktop. Do NOT use the Sun Download Manager.. Close any programs you may have running - especially your web browser. Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java version. Reboot your computer once all Java components are removed. Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u20-windows-i586.exe and select "Run as an Administrator.") Run OTL Under the Custom Scans/Fixes box at the bottom, paste in the following :OTL [2010/04/26 13:49:20 | 000,007,600 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\w1vjs2h771 [2010/04/26 13:49:20 | 000,007,600 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\w1vjs2h771 [2010/04/23 13:24:13 | 000,013,426 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841 [2010/04/23 13:24:13 | 000,013,426 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\q841 [2010/04/22 08:19:01 | 000,011,868 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60 [2010/04/22 08:19:01 | 000,011,868 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\34f60 [2010/04/29 07:39:11 | 000,048,745 | ---- | C] () -- C:\Documents and Settings\All Users\Documents\My Documents\s0p17h4102T.docx [2010/04/26 13:48:03 | 000,007,600 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\w1vjs2h771 [2010/04/26 13:48:03 | 000,007,600 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\w1vjs2h771 [2010/04/23 07:52:23 | 000,013,426 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841 [2010/04/23 07:52:23 | 000,013,426 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\q841 [2010/04/21 21:49:19 | 000,011,868 | -HS- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60 [2010/04/21 21:49:19 | 000,011,868 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\34f60 Then click the Run Fix button at the top Let the program run unhindered, when done it will say "Fix Complete press ok to open the log" Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post. ================================Follow up scan=================================Double click on OTL to run it. Make sure all other windows are closed and to let it run uninterrupted. When the window appears, underneath Output at the top change it to Minimal Output. Under the Standard Registry box change it to All. Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long. When the scan completes, it will open one notepad window. OTL.Txt a This is saved in the same location as OTL. Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply. How is it running now? Link to post Share on other sites
kensob Posted May 2, 2010 Author Share Posted May 2, 2010 It is running much much better. Thank you. Here are the logs you requested. ========== OTL ========== C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\w1vjs2h771 moved successfully. C:\Documents and Settings\All Users\Application Data\w1vjs2h771 moved successfully. C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841 moved successfully. C:\Documents and Settings\All Users\Application Data\q841 moved successfully. C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60 moved successfully. C:\Documents and Settings\All Users\Application Data\34f60 moved successfully. C:\Documents and Settings\All Users\Documents\My Documents\s0p17h4102T.docx moved successfully. File C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\w1vjs2h771 not found. File C:\Documents and Settings\All Users\Application Data\w1vjs2h771 not found. File C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\q841 not found. File C:\Documents and Settings\All Users\Application Data\q841 not found. File C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\34f60 not found. File C:\Documents and Settings\All Users\Application Data\34f60 not found. OTL by OldTimer - Version 3.2.2.0 log created on 05012010_222539 OTL logfile created on: 5/1/2010 10:27:11 PM - Run 4 OTL by OldTimer - Version 3.2.2.0 Folder = C:\Documents and Settings\KSOBECKI\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 40.00% Memory free 4.00 Gb Paging File | 3.00 Gb Available in Paging File | 73.00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 231.87 Gb Total Space | 198.75 Gb Free Space | 85.72% Space Free | Partition Type: NTFS Drive D: | 1.00 Gb Total Space | 0.97 Gb Free Space | 97.23% Space Free | Partition Type: FAT32 E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: KENHPLT Current User Name: KSOBECKI Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (Symantec Corporation) PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation) PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation) PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation) PRC - c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe (Hewlett-Packard Development Company, L.P) PRC - c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe (SafeBoot International) PRC - c:\Program Files\Hewlett-Packard\IAM\Bin\asghost.exe (Bioscrypt Inc.) PRC - c:\Program Files\Fingerprint Sensor\AtService.exe (AuthenTec, Inc.) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems) PRC - c:\Program Files\ActivIdentity\ActivClient\accoca.exe (ActivIdentity) ========== Modules (SafeList) ========== MOD - C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\system32\APSHook.dll (Bioscrypt Inc.) ========== Win32 Services (SafeList) ========== SRV - (Kodak AiO Network Discovery Service) -- C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe (Eastman Kodak Company) SRV - (SmcService) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation) SRV - (Symantec AntiVirus) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation) SRV - (SNAC) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE (Symantec Corporation) SRV - (ccSetMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation) SRV - (ccEvtMgr) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation) SRV - (LiveUpdate) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE (Symantec Corporation) SRV - (HP ProtectTools Service) -- c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe (Hewlett-Packard Development Company, L.P) SRV - (HpFkCryptService) -- c:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe (SafeBoot International) SRV - (ASBroker) -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll (Bioscrypt Inc.) SRV - (ASChannel) -- c:\Program Files\Hewlett-Packard\IAM\Bin\ASChnl.dll (Bioscrypt Inc.) SRV - (ATService) -- c:\Program Files\Fingerprint Sensor\AtService.exe (AuthenTec, Inc.) SRV - (AgereModemAudio) -- C:\WINDOWS\system32\agrsmsvc.exe (Agere Systems) SRV - (accoca) -- c:\Program Files\ActivIdentity\ActivClient\accoca.exe (ActivIdentity) SRV - (Pml Driver HPH11) -- C:\WINDOWS\system32\hphipm11.exe (HP) ========== Driver Services (SafeList) ========== DRV - (catchme) -- File not found DRV - (NAVEX15) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100430.036\NAVEX15.SYS (Symantec Corporation) DRV - (NAVENG) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20100430.036\NAVENG.SYS (Symantec Corporation) DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation) DRV - (EraserUtilRebootDrv) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation) DRV - (SymEvent) -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS (Symantec Corporation) DRV - (SRTSPL) -- C:\WINDOWS\system32\drivers\srtspl.sys (Symantec Corporation) DRV - (SRTSP) -- C:\WINDOWS\system32\drivers\srtsp.sys (Symantec Corporation) DRV - (SRTSPX) -- C:\WINDOWS\system32\drivers\srtspx.sys (Symantec Corporation) DRV - (SPBBCDrv) -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation) DRV - (SYMTDI) -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation) DRV - (SYMREDRV) -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation) DRV - (SbAlg) -- C:\WINDOWS\system32\drivers\SbAlg.sys (SafeBoot N.V.) DRV - (SbFsLock) -- C:\WINDOWS\system32\drivers\SbFsLock.sys (SafeBoot International) DRV - (RsvLock) -- C:\WINDOWS\system32\drivers\rsvlock.sys (SafeBoot International) DRV - (SafeBoot) -- C:\WINDOWS\system32\drivers\SafeBoot.sys () DRV - (ahcix86) -- C:\WINDOWS\System32\DRIVERS\ahcix86.sys (AMD Technologies Inc.) DRV - (hpdskflt) -- C:\WINDOWS\system32\DRIVERS\hpdskflt.sys (Hewlett-Packard Corporation) DRV - (Accelerometer) -- C:\WINDOWS\system32\drivers\Accelerometer.sys (Hewlett-Packard Corporation) DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.) DRV - (ATSwpWDF) -- C:\WINDOWS\system32\drivers\ATSwpWDF.sys (AuthenTec, Inc.) DRV - (RMCAST) -- C:\WINDOWS\system32\drivers\rmcast.sys (Microsoft Corporation) DRV - (HBtnKey) -- C:\WINDOWS\system32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.) DRV - (Changer) -- C:\WINDOWS\system32\drivers\changer.sys (Microsoft Corporation) DRV - (tffsport) -- C:\WINDOWS\system32\DRIVERS\tffsport.sys (M-Systems) DRV - (lbrtfdc) -- C:\WINDOWS\system32\drivers\lbrtfdc.sys (Toshiba Corp.) DRV - (MQAC) -- C:\WINDOWS\system32\drivers\mqac.sys (Microsoft Corporation) DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows ® Server 2003 DDK provider) DRV - (ADIHdAudAddService) -- C:\WINDOWS\system32\drivers\ADIHdAud.sys (Analog Devices, Inc.) DRV - (SNP2UVC) USB2.0 PC Camera (SNP2UVC) -- C:\WINDOWS\system32\drivers\snp2uvc.sys () DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.) DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation) DRV - (Amddfltr) -- C:\WINDOWS\system32\DRIVERS\Amddfltr.sys (Advanced Micro Devices) DRV - (AgereSoftModem) -- C:\WINDOWS\system32\drivers\AGRSM.sys (Agere Systems) DRV - (b57w2k) Broadcom NetLink -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation) DRV - (HpqKbFiltr) -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys (Hewlett-Packard Development Company, L.P.) DRV - (AmdPPM) -- C:\WINDOWS\system32\drivers\AmdPPM.sys (Advanced Micro Devices) DRV - (IFXTPM) -- C:\WINDOWS\system32\drivers\ifxtpm.sys (Infineon Technologies AG) DRV - (Dot4Usb HPH11) -- C:\WINDOWS\system32\drivers\hphius11.sys (HP) DRV - (Dot4Print HPH11) -- C:\WINDOWS\system32\drivers\hphipr11.sys (HP) DRV - (Dot4 HPH11) -- C:\WINDOWS\system32\drivers\hphid411.sys (HP) DRV - (SMCIRDA) -- C:\WINDOWS\system32\drivers\smcirda.sys (SMC) DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.) ========== Standard Registry (All) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://search.msn.com/spbasic.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/06/24 22:30:06 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2010/05/01 22:21:45 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/27 09:28:05 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/05/01 22:22:03 | 000,000,000 | ---D | M] [2010/04/26 08:33:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Extensions [2010/04/26 08:33:31 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2010/01/05 13:08:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Extensions\[email protected] [2010/04/30 15:47:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Firefox\Profiles\220ltht1.default\extensions [2010/04/27 09:10:08 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\KSOBECKI\Application Data\Mozilla\Firefox\Profiles\220ltht1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010/05/01 22:22:05 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2010/04/26 08:33:07 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2010/05/01 22:22:05 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010/04/01 13:58:18 | 000,023,000 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll [2010/04/01 13:58:19 | 000,138,712 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll [2010/05/01 22:21:44 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll [2010/04/01 13:58:20 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll [2010/04/01 11:56:18 | 000,001,394 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom.xml [2010/04/01 11:56:18 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml [2010/04/01 11:56:18 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml [2010/04/01 11:56:18 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay.xml [2010/04/01 11:56:18 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml [2010/04/01 11:56:18 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml [2010/04/01 11:56:18 | 000,001,096 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo.xml O1 HOSTS File: ([2010/04/27 22:00:27 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetActiveDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NofolderOptions = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll (Apple Inc.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation) O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} http://www.pcpitstop.com/betapit/PCPitStop.CAB (PCPitstop Utility) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1237572595955 (MUWebControl Class) O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab (HP Download Manager) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control) O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0...oUploader55.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 72.240.13.6 72.240.13.5 72.240.1.206 O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation) O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation) O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\WINDOWS\system32\APSHook.dll) - C:\WINDOWS\system32\APSHook.dll (Bioscrypt Inc.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\Userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation) O20 - Winlogon\Notify\ackpbsc: DllName - c:\WINDOWS\system32\ackpbsc.dll - C:\WINDOWS\system32\ackpbsc.dll (ActivIdentity) O20 - Winlogon\Notify\acunlock: DllName - c:\Program Files\ActivIdentity\ActivClient\acunlock.dll - c:\Program Files\ActivIdentity\ActivClient\acunlock.dll (ActivIdentity) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation) O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation) O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation) O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\OneCard: DllName - c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll - c:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll (Bioscrypt Inc.) O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation) O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation) O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation) O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) O24 - Desktop Components:0 (My Current Home Page) - About:Home O24 - Desktop BackupWallPaper: C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation) O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation) O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation) O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010/05/01 22:25:39 | 000,000,000 | ---D | C] -- C:\_OTL [2010/05/01 22:22:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun [2010/05/01 22:22:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2010/05/01 22:22:03 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [2010/05/01 22:22:03 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010/05/01 22:22:03 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010/05/01 22:22:03 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2010/05/01 22:22:03 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [2010/05/01 22:20:22 | 016,295,712 | ---- | C] (Sun Microsystems, Inc.) -- C:\Documents and Settings\KSOBECKI\Desktop\jre-6u20-windows-i586.exe [2010/05/01 06:59:58 | 000,000,000 | ---D | C] -- C:\Program Files\ESET [2010/04/30 23:19:13 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\KSOBECKI\Recent [2010/04/30 08:45:28 | 000,000,000 | -HSD | C] -- C:\RECYCLER [2010/04/28 22:19:48 | 000,000,000 | ---D | C] -- C:\schrauber [2010/04/27 21:53:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\pdf995 [2010/04/26 13:48:28 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\drivers\lbrtfdc.sys [2010/04/26 13:48:28 | 000,034,688 | ---- | C] (Toshiba Corp.) -- C:\WINDOWS\System32\dllcache\lbrtfdc.sys [2010/04/26 13:48:23 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\changer.sys [2010/04/26 13:48:23 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\changer.sys [2010/04/26 13:48:20 | 000,008,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\i2omgmt.sys [2010/04/26 08:33:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\Mozilla [2010/04/26 08:33:05 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2010/04/25 18:21:26 | 000,024,064 | ---- | C] (Sonic Focus, Inc) -- C:\WINDOWS\System32\drivers\sfaudio.sys [2010/04/25 18:18:53 | 000,000,000 | RHSD | C] -- C:\cmdcons [2010/04/25 18:17:13 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2010/04/25 18:17:12 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2010/04/25 18:17:12 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2010/04/25 18:17:12 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2010/04/25 18:16:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2010/04/25 17:36:43 | 000,000,000 | ---D | C] -- C:\Qoobox [2010/04/24 22:12:12 | 000,562,688 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe [2010/04/23 10:23:51 | 000,409,600 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJ5000MON.dll [2010/04/23 10:23:51 | 000,131,072 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\System32\EKIJCOINST07.dll [2010/04/23 10:22:08 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 6.0 [2010/04/22 10:50:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple Computer [2010/04/22 08:28:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\KSOBECKI\Application Data\Malwarebytes [2010/04/22 08:27:53 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/04/22 08:27:51 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010/04/22 08:27:51 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010/04/22 08:27:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes [2010/04/22 08:15:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe [2010/04/21 08:46:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun [2010/04/20 15:46:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia [2010/04/20 15:10:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe [2010/04/20 15:05:58 | 000,082,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ws2_32.dll [2010/04/12 15:50:39 | 000,249,856 | ---- | C] (TODO: <Company name>) -- C:\WINDOWS\System32\pdfmona.dll [2009/03/20 20:16:56 | 000,180,224 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll [2007/07/05 04:28:52 | 000,176,128 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010/05/01 22:21:43 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe [2010/05/01 22:21:43 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe [2010/05/01 22:21:43 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe [2010/05/01 22:21:43 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl [2010/05/01 22:21:42 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll [2010/05/01 22:21:03 | 016,295,712 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\KSOBECKI\Desktop\jre-6u20-windows-i586.exe [2010/05/01 09:48:09 | 000,022,371 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\April.docx [2010/05/01 08:22:55 | 007,077,888 | -H-- | M] () -- C:\Documents and Settings\KSOBECKI\NTUSER.DAT [2010/04/30 08:54:56 | 000,053,248 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/04/30 07:08:19 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010/04/30 07:06:09 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2010/04/30 06:59:17 | 003,924,193 | R--- | M] () -- C:\Documents and Settings\KSOBECKI\Desktop\schrauber.exe [2010/04/29 15:39:38 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010/04/29 15:39:26 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010/04/29 06:32:10 | 000,006,591 | ---- | M] () -- C:\Documents and Settings\KSOBECKI\Application Data\PrimoPDFSet.xml [2010/04/27 22:00:27 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2010/04/27 22:00:18 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010/04/27 21:53:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010/04/27 21:53:16 | 1875,759,104 | -HS- | M] () -- C:\hiberfil.sys [2010/04/27 21:51:41 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\KSOBECKI\ntuser.ini [2010/04/26 15:58:12 | 000,256,512 | ---- | M] () -- C:\WINDOWS\PEV.exe [2010/04/26 13:56:51 | 005,364,298 | -H-- | M] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\IconCache.db [2010/04/26 11:15:13 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010/04/26 08:06:14 | 000,000,791 | ---- | M] () -- C:\WINDOWS\orun32.ini [2010/04/25 18:19:04 | 000,000,293 | RHS- | M] () -- C:\boot.ini [2010/04/25 17:33:01 | 000,024,064 | ---- | M] (Sonic Focus, Inc) -- C:\WINDOWS\System32\drivers\sfaudio.sys [2010/04/24 22:16:06 | 000,293,376 | ---- | M] () -- C:\nvmx55zj.exe [2010/04/24 22:12:17 | 000,562,688 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\KSOBECKI\Desktop\OTL.exe [2010/04/23 10:26:44 | 000,000,775 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\KODAK AiO Home Center.lnk [2010/04/22 08:27:56 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010/04/22 08:15:40 | 000,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat [2010/04/21 02:48:33 | 000,000,094 | ---- | M] () -- C:\WINDOWS\wininit.ini [2010/04/20 16:58:28 | 000,001,661 | ---- | M] () -- C:\WINDOWS\lsrslt.ini [2010/04/20 15:42:26 | 000,571,308 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010/04/20 15:42:26 | 000,477,702 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010/04/20 15:42:26 | 000,082,990 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010/04/13 16:31:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010/04/12 15:54:43 | 000,000,028 | ---- | M] () -- C:\WINDOWS\pdf995.ini [2010/04/12 15:50:39 | 000,249,856 | ---- | M] (TODO: <Company name>) -- C:\WINDOWS\System32\pdfmona.dll [2010/04/12 15:50:39 | 000,051,716 | ---- | M] () -- C:\WINDOWS\System32\pdf995mon.dll [2010/04/08 19:53:37 | 000,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2010/04/25 18:19:04 | 000,000,223 | ---- | C] () -- C:\Boot.bak [2010/04/25 18:18:57 | 000,260,272 | ---- | C] () -- C:\cmldr [2010/04/25 18:17:13 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe [2010/04/25 18:17:12 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe [2010/04/25 18:17:12 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2010/04/25 18:17:12 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2010/04/25 18:17:12 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2010/04/25 17:28:07 | 003,924,193 | R--- | C] () -- C:\Documents and Settings\KSOBECKI\Desktop\schrauber.exe [2010/04/24 22:16:03 | 000,293,376 | ---- | C] () -- C:\nvmx55zj.exe [2010/04/23 10:26:44 | 000,000,775 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\KODAK AiO Home Center.lnk [2010/04/23 10:14:02 | 000,035,634 | ---- | C] () -- C:\Documents and Settings\KSOBECKI\Local Settings\Application Data\c4u.log [2010/04/22 08:27:56 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010/04/22 08:17:00 | 1875,759,104 | -HS- | C] () -- C:\hiberfil.sys [2010/04/22 08:15:40 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat [2010/04/20 17:38:45 | 000,000,094 | ---- | C] () -- C:\WINDOWS\wininit.ini [2010/04/20 16:58:28 | 000,001,661 | ---- | C] () -- C:\WINDOWS\lsrslt.ini [2010/04/12 15:54:43 | 000,000,028 | ---- | C] () -- C:\WINDOWS\pdf995.ini [2010/04/12 15:50:40 | 000,000,142 | ---- | C] () -- C:\WINDOWS\wpd99.drv [2010/04/12 15:50:39 | 000,051,716 | ---- | C] () -- C:\WINDOWS\System32\pdf995mon.dll [2010/04/08 19:53:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2010/01/21 22:49:12 | 000,000,044 | ---- | C] () -- C:\WINDOWS\SMWizard.INI [2009/09/17 19:09:54 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2009/08/03 16:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll [2009/04/29 12:46:02 | 000,000,034 | ---- | C] () -- C:\WINDOWS\hpfsched.ini [2009/04/29 12:40:27 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\hpodinet.dll [2009/04/10 12:37:43 | 000,176,235 | ---- | C] () -- C:\WINDOWS\System32\Primomonnt.dll [2008/06/22 00:28:19 | 000,028,510 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2008/05/30 12:36:58 | 000,108,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\SafeBoot.sys [2008/04/28 12:13:33 | 000,000,310 | ---- | C] () -- C:\WINDOWS\primopdf.ini [2008/04/10 13:27:34 | 001,804,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys [2007/09/27 10:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini [2007/09/27 10:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini [2007/09/27 10:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini [2007/05/10 02:16:40 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys [2006/05/19 22:39:58 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini [2005/04/03 18:30:00 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\scardsyn.dll [2004/08/07 09:19:16 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2004/08/07 09:12:40 | 000,000,791 | ---- | C] () -- C:\WINDOWS\orun32.ini [1998/05/06 23:10:00 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\ODMA32.dll < End of report > Link to post Share on other sites
schrauber Posted May 2, 2010 Share Posted May 2, 2010 Hi, Delete ComboFix and Clean Up Click Start > Run > type combofix /Uninstall > OK (Note the space between combofix and /Uninstall) Please advise if this step is missed for any reason as it performs some important actions. Please run OTL one more time and hit Cleanup. This will remove OTL and all helper tools. Your machine appears to be clean, please take the time to read below on how to secure the machine and take the necessary steps to keep it Clean Hiding Hidden Files Please set your system to hide all hidden files. Click Start, open My Computer, select the Tools menu and click Folder Options. Select the View Tab. Under the Hidden files and folders heading, uncheck Show hidden files and folders. Check: Hide file extensions for known file types Check the Hide protected operating system files (recommended) option. Click Yes to confirm. Purging System Restore Points Now you should Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state. The easiest and safest way to do this is: Go to Start > Programs > Accessories > System Tools and click "System Restore". Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore. Then go to Start > Run and type: Cleanmgr Click "OK". Click the "More Options" Tab. Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one. One of the most common questions found when cleaning Spyware or other Malware is "how did my machine get infected?". There are a variety of reasons, but the most common ones are that you are going to sites that you are not practicing Safe Internet, you are not running the proper security software, and that your computer's security settings are set too low. Below I have outlined a series of categories that outline how you can increase the security of your computer so that you will not be infected again in the future. Practice Safe Internet One of the main reasons people get infected in the first place is that they are not practicing Safe Internet. You practice Safe Internet when you educate yourself on how to properly use the Internet through the use of security tools and good practice. Knowing how you can get infected and what types of files and sites to avoid will be the most crucial step in keeping your computer malware free. The reality is that the majority of people who are infected with malware are ones who click on things they shouldn't be clicking on. Whether these things are files or sites it doesn't really matter. If something is out to get you, and you click on it, it most likely will. Below are a list of simple precautions to take to keep your computer clean and running securely: If you receive an attachment from someone you do not know, DO NOT OPEN IT! Simple as that. Opening attachments from people you do not know is a very common method for viruses or worms to infect your computer. If you receive an attachment and it ends with a .exe, .com, .bat, or .pif do not open the attachment unless you know for a fact that it is clean. For the casual computer user, you will almost never receive a valid attachment of this type. If you receive an attachment from someone you know, and it looks suspicious, then it probably is. The email could be from someone you know infected with a malware that is trying to infect everyone in their address book. If you are browsing the Internet and a popup appears saying that you are infected, ignore it!. These are, as far as I am concerned, scams that are being used to scare you into purchasing a piece of software. There are also programs that disguise themselves as Anti-Spyware or security products but are instead scams. For a list of these types of programs we recommend you visit this link: Rogue/Suspect Anti-Spyware Products & Web Sites Another tactic to fool you on the web is when a site displays a popup that looks like a normal Windows message or alert. When you click on them, though, they instead bring you to another site that is trying to push a product on you. We suggest that you close these windows by clicking on the X instead of the OK button. Alternatively, you can check to see if it's a real alert by right-clicking on the window. If there is a menu that comes up saying Add to Favorites... you know it's a fake. Do not go to adult sites. I know this may bother some of you, but the fact is that a large amount of malware is pushed through these types of sites. I am not saying all adult sites do this, but a lot do. When using an Instant Messaging program be cautious about clicking on links people send to you. It is not uncommon for infections to send a message to everyone in the infected person's contact list that contains a link to an infection. Instead when you receive a message that contains a link, message back to the person asking if it is legit before you click on it. Stay away from Warez and Crack sites! In addition to the obvious copyright issues, the downloads from these sites are typically overrun with infections. Be careful of what you download off of web sites and Peer-2-Peer networks. Some sites disguise malware as legitimate software to trick you into installing them and Peer-2-Peer networks are crawling with it. If you want to download a piece of software a from a site, and are not sure if they are legitimate, you can use McAfee Siteadvisor to look up info on the site. DO NOT INSTALL any software without first reading the End User License Agreement, otherwise known as the EULA. A tactic that some developers use is to offer their software for free, but have spyware and other programs you do not want bundled with it. This is where they make their money. By reading the agreement there is a good chance you can spot this and not install the software. Visit Microsoft's Windows Update Site Frequently It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates. Make Internet Explorer 7 more secure From within Internet Explorer click on the Tools menu and then click on Options. Click once on the Security tab Click once on the Internet icon so it becomes highlighted. Click once on the Custom Level button. Change the Download signed ActiveX controls to Prompt Change the Download unsigned ActiveX controls to Disable Change the Initialize and script ActiveX controls not marked as safe to Disable Change the Installation of desktop items to Prompt Change the Launching programs and files in an IFRAME to Prompt Change the Navigate sub-frames across different domains to Prompt When all these settings have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button. Next press the Apply button and then the OK to exit the Internet Properties page. Link to post Share on other sites
schrauber Posted May 7, 2010 Share Posted May 7, 2010 Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. If your the topic starter, and need this topic reopened, please contact me via pm with the address of the thread. Everyone else please begin a New Topic. Link to post Share on other sites
.png.9d4b89b15b2cd5e65edd93a0e6823dce.png)
Recommended Posts