Jump to content
Sign in to follow this  
flash0429

Need Help Keep Getting Blue Screen Of Death Randomly

Recommended Posts

Randomly getting the BSOD sometimes its one message and sometimes its another

 

 

 

here is the HJT Log:

 

 

 

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 10:52:39 PM, on 5/18/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ACS.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Secunia\PSI\PSIA.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Atheros\ACU.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\WINDOWS\system32\pctspk.exe

C:\WINDOWS\system32\PV92Tray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe

C:\Program Files\Secunia\PSI\psi_tray.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Secunia\PSI\sua.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe

O4 - HKLM\..\Run: [PV92TRAY] PV92Tray.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" /MINIMIZED

O4 - HKCU\..\Run: [sRS Audio Sandbox] "C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe" /hideme

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')

O4 - Startup: Mozilla Thunderbird.lnk = C:\Program Files\Mozilla Thunderbird\thunderbird.exe

O4 - Global Startup: Secunia PSI Tray.lnk = C:\Program Files\Secunia\PSI\psi_tray.exe

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: http://download.windowsupdate.com

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1304630732701

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1304630805060

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.ad...Plus/1.6/gp.cab

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Secunia PSI Agent - Secunia - C:\Program Files\Secunia\PSI\PSIA.exe

O23 - Service: Secunia Update Agent - Secunia - C:\Program Files\Secunia\PSI\sua.exe

 

--

End of file - 5665 bytes

 

 

Edited by flash0429

Share this post


Link to post
Share on other sites

Hi and Welcome!! :wp: My name is Jeff. I would be more than happy to take a look at your log and help you with solving any malware problems you might have. Logs can take a while to research, so please be patient and know that I am working hard to get you a clean and functional system back in your hands. I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Watch Topic button to the right of your topic title and then choosing the notification method ( Recommended: Inmediate Notification)
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

**Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise, this will be a team effort. This may cause a delay, but I will do my best to keep it as short as possible. Please bear with me, I will post back to you as soon as I can.**

 

IMPORTANT NOTE : Please do not delete anything unless instructed to.

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your system inoperable and could require a full reinstall of your OS losing all your programs and data.

 

Vista and Windows 7 users:

These tools MUST be run from the executable (.exe) every time you run them

with Admin Rights (Right click, choose "Run as Administrator")

 

Stay with this topic until I give you the all clean post.

Share this post


Link to post
Share on other sites

Hi flash0429!!

 

Please download DDS by sUBs from one of the following links and save it to your desktop.

  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
---------------------------------------------------
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
----------

 

Please download aswMBR to your desktop.

 

  • Double click the aswMBR icon to run it.

    Vista and Windows 7 users right click the icon and choose "Run as administrator".

  • Click the Scan button to start scan.
  • When it finishes, press the save log button, save the logfile to your desktop and post its contents in your next reply.

Posted Image

Click the image to enlarge it

 

In your next reply please post the logs created by DDS and aswMBR.exe :)

Share this post


Link to post
Share on other sites

can this all be run in safe mode cause the comp will give BSOD wen i start the comp some times

Share this post


Link to post
Share on other sites

Hi!

 

Yes it is more than fine to run these in Safe Mode.

 

Once you get the scans run please post the logs created into your next reply. :tup:

Share this post


Link to post
Share on other sites

here is the DDS Log:

 

 

 

DDS (Ver_11-05-19.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_25

Run by Owner at 12:20:50 on 2011-05-22

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.703.321 [GMT -4:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\savedump.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\ACS.exe

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Secunia\PSI\PSIA.exe

C:\Program Files\Secunia\PSI\sua.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Atheros\ACU.exe

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\WINDOWS\system32\pctspk.exe

C:\WINDOWS\system32\PV92Tray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\uTorrent\uTorrent.exe

C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe

C:\Program Files\Secunia\PSI\psi_tray.exe

C:\Program Files\Mozilla Thunderbird\thunderbird.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\Documents and Settings\Owner\Desktop\dds.scr

C:\WINDOWS\system32\WSCRIPT.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://google.com/

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe" /MINIMIZED

uRun: [sRS Audio Sandbox] "c:\program files\srs labs\audio sandbox\SRSSSC.exe" /hideme

mRun: [ACU] "c:\program files\atheros\ACU.exe" -nogui

mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mRun: [PCTVOICE] pctspk.exe

mRun: [PV92TRAY] PV92Tray.exe

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

StartupFolder: c:\docume~1\owner\startm~1\programs\startup\mozill~1.lnk - c:\program files\mozilla thunderbird\thunderbird.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\secuni~1.lnk - c:\program files\secunia\psi\psi_tray.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

Trusted Zone: microsoft.com\*.update

Trusted Zone: windowsupdate.com\download

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1304630732701

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1304630805060

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\owner\application data\mozilla\firefox\profiles\bwz6k9h4.default\

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll

.

============= SERVICES / DRIVERS ===============

.

R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [2004-6-1 6016]

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264]

R1 MpKsl3827ac15;MpKsl3827ac15;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3a33162c-f39e-4cb9-a5c0-7dc41c49b7e5}\MpKsl3827ac15.sys [2011-5-20 28752]

R1 MpKsl6d31ea62;MpKsl6d31ea62;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3a33162c-f39e-4cb9-a5c0-7dc41c49b7e5}\MpKsl6d31ea62.sys [2011-5-22 28752]

R1 MpKslb94374bd;MpKslb94374bd;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3a33162c-f39e-4cb9-a5c0-7dc41c49b7e5}\MpKslb94374bd.sys [2011-5-22 28752]

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2011-5-5 54760]

R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\drivers\ousbehci.sys [2011-5-7 45696]

R2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\secunia\psi\psia.exe [2011-4-19 993848]

R2 Secunia Update Agent;Secunia Update Agent;c:\program files\secunia\psi\sua.exe [2011-4-19 399416]

R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\drivers\ousb2hub.sys [2011-5-7 56960]

S1 MpKsl06aebd47;MpKsl06aebd47;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6e5e512b-65e9-4ead-bc43-bea0985761f7}\mpksl06aebd47.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6e5e512b-65e9-4ead-bc43-bea0985761f7}\MpKsl06aebd47.sys [?]

S1 MpKsl51843941;MpKsl51843941;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3a33162c-f39e-4cb9-a5c0-7dc41c49b7e5}\MpKsl51843941.sys [2011-5-18 28752]

S1 MpKsl674c8087;MpKsl674c8087;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6e5e512b-65e9-4ead-bc43-bea0985761f7}\mpksl674c8087.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6e5e512b-65e9-4ead-bc43-bea0985761f7}\MpKsl674c8087.sys [?]

S1 MpKsl7892d574;MpKsl7892d574;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6e5e512b-65e9-4ead-bc43-bea0985761f7}\mpksl7892d574.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6e5e512b-65e9-4ead-bc43-bea0985761f7}\MpKsl7892d574.sys [?]

S1 MpKsl7e38be4c;MpKsl7e38be4c;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{d58e7749-60c8-41d7-89ed-28ded1f79493}\mpksl7e38be4c.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{d58e7749-60c8-41d7-89ed-28ded1f79493}\MpKsl7e38be4c.sys [?]

S1 MpKsl8431e654;MpKsl8431e654;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6e5e512b-65e9-4ead-bc43-bea0985761f7}\mpksl8431e654.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6e5e512b-65e9-4ead-bc43-bea0985761f7}\MpKsl8431e654.sys [?]

S1 MpKslb5e33cc4;MpKslb5e33cc4;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2f7cd987-495b-46ca-88ec-515183ffd8fe}\mpkslb5e33cc4.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2f7cd987-495b-46ca-88ec-515183ffd8fe}\MpKslb5e33cc4.sys [?]

S1 MpKslda90a961;MpKslda90a961;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3a33162c-f39e-4cb9-a5c0-7dc41c49b7e5}\MpKslda90a961.sys [2011-5-20 28752]

S1 MpKsldebc6bd0;MpKsldebc6bd0;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3a33162c-f39e-4cb9-a5c0-7dc41c49b7e5}\MpKsldebc6bd0.sys [2011-5-20 28752]

S1 MpKsle3996729;MpKsle3996729;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{d58e7749-60c8-41d7-89ed-28ded1f79493}\mpksle3996729.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{d58e7749-60c8-41d7-89ed-28ded1f79493}\MpKsle3996729.sys [?]

S1 MpKslf8bf84e8;MpKslf8bf84e8;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2f7cd987-495b-46ca-88ec-515183ffd8fe}\mpkslf8bf84e8.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2f7cd987-495b-46ca-88ec-515183ffd8fe}\MpKslf8bf84e8.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-4-28 704872]

S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-9-1 15544]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-4 14336]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2011-05-22 16:18:55 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3a33162c-f39e-4cb9-a5c0-7dc41c49b7e5}\MpKslb94374bd.sys

2011-05-22 16:14:44 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3a33162c-f39e-4cb9-a5c0-7dc41c49b7e5}\MpKsl6d31ea62.sys

2011-05-20 17:31:20 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3a33162c-f39e-4cb9-a5c0-7dc41c49b7e5}\MpKsldebc6bd0.sys

2011-05-20 17:29:32 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3a33162c-f39e-4cb9-a5c0-7dc41c49b7e5}\MpKslda90a961.sys

2011-05-20 16:14:45 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3a33162c-f39e-4cb9-a5c0-7dc41c49b7e5}\MpKsl3827ac15.sys

2011-05-20 16:13:18 -------- d-sh--w- C:\found.001

2011-05-19 02:51:49 388096 ----a-r- c:\documents and settings\owner\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe

2011-05-19 02:51:47 -------- d-----w- c:\program files\Trend Micro

2011-05-19 01:50:17 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3a33162c-f39e-4cb9-a5c0-7dc41c49b7e5}\MpKsl51843941.sys

2011-05-17 23:42:55 7071056 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{3a33162c-f39e-4cb9-a5c0-7dc41c49b7e5}\mpengine.dll

2011-05-15 15:50:33 -------- d-----w- c:\documents and settings\owner\local settings\application data\Temp

2011-05-15 15:50:33 -------- d-----w- c:\documents and settings\owner\local settings\application data\Adobe

2011-05-15 04:08:20 -------- d-----w- c:\documents and settings\owner\local settings\application data\Thunderbird

2011-05-13 22:00:51 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-05-13 20:49:31 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys

2011-05-13 20:49:31 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys

2011-05-13 20:49:26 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys

2011-05-13 20:49:26 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys

2011-05-10 02:53:16 -------- d-----w- c:\documents and settings\owner\application data\Windows Search

2011-05-10 02:10:08 110602 ----a-w- c:\windows\system32\xcdsfx32.bin

2011-05-08 01:35:29 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll

2011-05-08 01:35:29 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll

2011-05-08 01:35:29 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll

2011-05-08 01:35:29 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll

2011-05-08 01:35:29 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll

2011-05-08 01:35:29 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll

2011-05-08 01:35:29 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll

2011-05-08 01:33:59 -------- d-----w- c:\documents and settings\owner\local settings\application data\Apple

2011-05-08 01:33:31 -------- d-----w- c:\documents and settings\owner\local settings\application data\Apple Computer

2011-05-08 01:12:25 421888 ----a-w- c:\windows\system32\ac3filter.acm

2011-05-08 01:12:12 -------- d-----w- c:\program files\XP Codec Pack

2011-05-07 22:33:52 26368 -c--a-w- c:\windows\system32\dllcache\usbstor.sys

2011-05-07 20:29:26 -------- d-----w- c:\documents and settings\owner\local settings\application data\SRS Labs

2011-05-07 20:29:22 -------- d-----w- c:\documents and settings\all users\application data\SRS Labs

2011-05-07 20:28:51 47360 ----a-r- c:\windows\system32\drivers\Surroundhp_kern_i386.sys

2011-05-07 20:28:51 47104 ----a-r- c:\windows\system32\drivers\tshd4_kern_i386.sys

2011-05-07 20:28:51 42112 ----a-r- c:\windows\system32\drivers\csiidecoder_kern_i386.sys

2011-05-07 20:28:51 39808 ----a-r- c:\windows\system32\drivers\SRS_SSCFilter_i386.sys

2011-05-07 20:28:51 32000 ----a-r- c:\windows\system32\drivers\wowhd_kern_i386.sys

2011-05-07 20:28:30 -------- d-----w- c:\program files\SRS Labs

2011-05-07 20:23:08 801778 ----a-w- c:\windows\system32\drivers\vpctcom.sys

2011-05-07 20:23:08 70320 ----a-w- c:\windows\system32\drivers\vvoice.sys

2011-05-07 20:23:08 356159 ----a-w- c:\windows\system32\drivers\ptserial.sys

2011-05-07 20:23:08 131072 ----a-w- c:\windows\system32\ptuninst.exe

2011-05-07 20:23:07 703673 ----a-w- c:\windows\system32\drivers\vmodem.sys

2011-05-07 20:23:07 323584 ----a-w- c:\windows\system32\PV92Tray.exe

2011-05-07 20:23:07 180224 ----a-w- c:\windows\system32\pctspk.exe

2011-05-07 20:23:07 155648 ----a-w- c:\windows\system32\ptsetup.dll

2011-05-07 20:23:07 125440 ----a-w- c:\windows\system32\runpct.exe

2011-05-07 20:23:07 -------- d-----w- c:\windows\PCTEL

2011-05-07 20:17:55 56960 ----a-w- c:\windows\system32\drivers\ousb2hub.sys

2011-05-07 20:17:55 45696 ----a-w- c:\windows\system32\drivers\ousbehci.sys

2011-05-07 20:17:55 -------- d-----w- c:\windows\Drivers

2011-05-07 20:15:08 32768 ----a-w- c:\program files\common files\installshield\professional\runtime\Objectps.dll

2011-05-07 20:15:08 192512 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iuser.dll

2011-05-07 20:15:07 729088 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iKernel.dll

2011-05-07 20:15:07 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\ctor.dll

2011-05-07 20:15:07 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\DotNetInstaller.exe

2011-05-07 20:15:07 266240 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iscript.dll

2011-05-07 20:15:05 188548 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\iGdi.dll

2011-05-07 20:15:04 311428 ----a-w- c:\program files\common files\installshield\professional\runtime\09\01\intel32\setup.dll

2011-05-07 15:29:32 -------- dc----w- C:\5008b47a02dc04ba23

2011-05-07 05:15:55 7071056 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll

2011-05-07 04:20:37 1599136 ----a-w- c:\windows\system32\drivers\athw.sys

2011-05-07 04:20:37 1599136 ----a-w- c:\windows\system32\athw.sys

2011-05-07 04:10:01 -------- d-----w- c:\windows\system32\wbem\repository\FS

2011-05-07 04:10:01 -------- d-----w- c:\windows\system32\wbem\Repository

2011-05-06 22:22:40 -------- d-sh--w- C:\found.000

2011-05-06 20:23:03 -------- d-----w- c:\windows\pss

2011-05-06 18:56:11 -------- d-----w- c:\documents and settings\all users\application data\Atheros

2011-05-06 18:51:24 -------- d-----w- c:\program files\Realtek

2011-05-06 14:10:37 -------- dc----w- C:\ATI

2011-05-06 03:46:15 -------- d-----w- c:\documents and settings\owner\local settings\application data\PCHealth

2011-05-06 03:43:20 222080 ------w- c:\windows\system32\MpSigStub.exe

2011-05-06 03:32:25 526184 ----a-w- c:\windows\system32\XceedCry.dll

2011-05-06 03:32:25 456536 ----a-w- c:\windows\system32\XCEEDZIP.DLL

2011-05-06 03:32:24 224016 ----a-w- c:\windows\system32\Tabctl32.ocx

2011-05-06 03:32:24 152848 ----a-w- c:\windows\system32\Comdlg32.ocx

2011-05-06 03:32:24 132880 ----a-w- c:\windows\system32\Msinet.ocx

2011-05-06 03:32:24 1081616 ----a-w- c:\windows\system32\Mscomctl.ocx

2011-05-06 03:29:19 81408 ----a-w- c:\windows\system32\devcon_x64.exe

2011-05-06 03:29:19 55808 ----a-w- c:\windows\system32\devcon.exe

2011-05-06 03:24:18 24 ----a-w- c:\windows\system.sys

2011-05-06 03:20:57 -------- d-----w- c:\program files\Microsoft Security Client

2011-05-06 03:01:35 -------- d-----w- c:\documents and settings\owner\local settings\application data\Downloaded Installations

2011-05-06 02:58:14 -------- dc----w- C:\d50df6bd7956c467af0de3cc65d6

2011-05-06 02:57:22 -------- d-----w- c:\windows\system32\winrm

2011-05-06 02:57:16 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$

2011-05-06 02:39:25 -------- d-----w- c:\documents and settings\owner\local settings\application data\ApplicationHistory

2011-05-06 02:37:49 -------- d-----w- c:\documents and settings\owner\local settings\application data\uTorrent

2011-05-06 02:35:54 -------- d-----w- c:\program files\uTorrent

2011-05-06 02:34:56 -------- d-----w- c:\documents and settings\owner\application data\uTorrent

2011-05-06 02:25:37 -------- d-----w- c:\documents and settings\owner\local settings\application data\Secunia PSI

2011-05-06 02:24:52 -------- d-----w- c:\documents and settings\owner\application data\DriverFinder

2011-05-06 02:24:31 -------- d-----w- c:\program files\Secunia

2011-05-06 02:19:09 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys

2011-05-06 02:18:53 45568 -c----w- c:\windows\system32\dllcache\wab.exe

2011-05-06 02:18:40 7680 -c----w- c:\windows\system32\dllcache\iecompat.dll

2011-05-06 02:17:47 978944 -c----w- c:\windows\system32\dllcache\mfc42.dll

2011-05-06 02:17:47 953856 -c----w- c:\windows\system32\dllcache\mfc40u.dll

2011-05-06 02:16:37 617472 -c----w- c:\windows\system32\dllcache\comctl32.dll

2011-05-06 02:12:17 -------- d-----w- c:\program files\CCleaner

2011-05-06 01:59:03 221184 ----a-w- c:\windows\system32\wmpns.dll

2011-05-06 01:45:04 -------- d-----w- c:\windows\system32\scripting

2011-05-06 01:45:04 -------- d-----w- c:\windows\l2schemas

2011-05-06 01:45:03 -------- d-----w- c:\windows\system32\en

2011-05-06 01:45:02 -------- d-----w- c:\windows\system32\bits

2011-05-06 01:38:04 -------- d-----w- c:\windows\network diagnostic

2011-05-06 01:32:20 -------- d-----w- c:\windows\EHome

2011-05-06 01:16:57 73728 ----a-w- c:\windows\system32\javacpl.cpl

2011-05-06 01:16:56 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-05-06 01:10:03 -------- d-sh--w- c:\documents and settings\owner\IECompatCache

2011-05-06 01:09:58 -------- d-sh--w- c:\documents and settings\owner\PrivacIE

2011-05-06 01:08:48 -------- d-sh--w- c:\documents and settings\owner\IETldCache

2011-05-06 01:03:12 54760 ----a-w- c:\windows\system32\drivers\fssfltr_tdi.sys

2011-05-06 01:02:55 -------- d-----w- c:\program files\Microsoft

2011-05-06 01:02:30 -------- d-----w- c:\program files\Windows Live SkyDrive

2011-05-06 01:02:23 4927864 ----a-w- c:\program files\common files\windows live\.cache\4239b9ea1cc0b89\Silverlight.2.0.exe

2011-05-06 00:29:19 -------- d-----w- c:\program files\common files\Windows Live

2011-05-06 00:23:01 -------- d-----w- c:\windows\ie8updates

2011-05-06 00:22:43 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2011-05-06 00:22:41 602112 -c----w- c:\windows\system32\dllcache\msfeeds.dll

2011-05-06 00:22:41 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll

2011-05-06 00:22:40 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2011-05-06 00:22:40 1991680 -c----w- c:\windows\system32\dllcache\iertutil.dll

2011-05-06 00:22:39 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

2011-05-06 00:22:39 11080704 -c----w- c:\windows\system32\dllcache\ieframe.dll

2011-05-05 23:53:50 -------- d-----w- c:\windows\ServicePackFiles

2011-05-05 23:45:01 -------- d-----w- c:\windows\system32\XPSViewer

2011-05-05 23:44:19 89088 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll

2011-05-05 23:44:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2011-05-05 23:44:06 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2011-05-05 23:44:06 597504 ------w- c:\windows\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

2011-05-05 23:44:06 117760 ------w- c:\windows\system32\prntvpt.dll

2011-05-05 23:44:05 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll

2011-05-05 23:44:05 575488 ------w- c:\windows\system32\xpsshhdr.dll

2011-05-05 23:44:05 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll

2011-05-05 23:44:05 1676288 ------w- c:\windows\system32\xpssvcs.dll

2011-05-05 23:44:05 -------- dc----w- C:\5f81d6e16bc36fca997325817afef3df

2011-05-05 23:40:12 -------- d-----w- c:\program files\MSXML 6.0

2011-05-05 23:35:25 -------- d-----w- c:\documents and settings\owner\local settings\application data\Identities

2011-05-05 23:35:20 -------- d-----w- c:\documents and settings\owner\application data\Windows Desktop Search

2011-05-05 23:34:31 -------- d-----w- c:\program files\Windows Desktop Search

2011-05-05 23:34:30 -------- d-----w- c:\windows\system32\GroupPolicy

2011-05-05 23:31:43 -------- d-----w- c:\program files\Windows Media Connect 2

2011-05-05 23:29:07 25471 ------w- c:\windows\system32\drivers\watv10nt.sys

2011-05-05 23:29:07 22271 ------w- c:\windows\system32\drivers\watv06nt.sys

2011-05-05 23:29:07 11935 ------w- c:\windows\system32\drivers\wadv11nt.sys

2011-05-05 23:29:07 11871 ------w- c:\windows\system32\drivers\wadv09nt.sys

2011-05-05 23:29:07 11807 ------w- c:\windows\system32\drivers\wadv07nt.sys

2011-05-05 23:29:07 11295 ------w- c:\windows\system32\drivers\wadv08nt.sys

2011-05-05 23:26:49 -------- d-----w- c:\windows\system32\LogFiles

2011-05-05 23:23:48 47616 ----a-w- c:\program files\windows media player\msoobci.dll

2011-05-05 23:23:48 1669120 ----a-w- c:\program files\windows media player\wmsetsdk.exe

2011-05-05 23:23:17 -------- d-----w- c:\windows\RegisteredPackages

2011-05-05 23:21:33 -------- d-----w- c:\windows\system32\URTTemp

2011-05-05 23:06:01 81920 -c----w- c:\windows\system32\dllcache\fontsub.dll

2011-05-05 23:06:01 119808 -c----w- c:\windows\system32\dllcache\t2embed.dll

2011-05-05 23:05:21 357888 -c----w- c:\windows\system32\dllcache\srv.sys

2011-05-05 23:04:15 272128 -c----w- c:\windows\system32\dllcache\bthport.sys

2011-05-05 23:04:15 272128 ------w- c:\windows\system32\drivers\bthport.sys

2011-05-05 23:04:12 455936 -c----w- c:\windows\system32\dllcache\mrxsmb.sys

2011-05-05 23:04:11 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe

2011-05-05 23:04:09 203136 -c----w- c:\windows\system32\dllcache\rmcast.sys

2011-05-05 23:02:42 284160 -c----w- c:\windows\system32\dllcache\pdh.dll

2011-05-05 23:02:41 730112 -c----w- c:\windows\system32\dllcache\lsasrv.dll

2011-05-05 23:02:41 617472 -c----w- c:\windows\system32\dllcache\advapi32.dll

2011-05-05 23:02:41 473600 -c----w- c:\windows\system32\dllcache\fastprox.dll

2011-05-05 23:02:41 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll

2011-05-05 23:02:41 401408 -c----w- c:\windows\system32\dllcache\rpcss.dll

2011-05-05 23:02:41 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe

2011-05-05 23:02:41 110592 -c----w- c:\windows\system32\dllcache\services.exe

2011-05-05 23:02:40 718336 -c----w- c:\windows\system32\dllcache\ntdll.dll

2011-05-05 23:02:40 2148864 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe

2011-05-05 23:02:39 2192768 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe

2011-05-05 23:02:38 2027008 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe

2011-05-05 23:00:51 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll

2011-05-05 22:53:22 337408 -c----w- c:\windows\system32\dllcache\netapi32.dll

2011-05-05 22:52:59 5120 ----a-w- c:\windows\system32\xpsp4res.dll

2011-05-05 22:52:58 218112 -c----w- c:\windows\system32\dllcache\wordpad.exe

2011-05-05 22:45:34 -------- d-----w- c:\windows\system32\PreInstall

2011-05-05 22:32:34 -------- d-----w- c:\program files\ATI Technologies

2011-05-05 22:31:59 -------- dc----w- C:\Display.temp

2011-05-05 22:29:23 15890 ----a-w- c:\windows\system32\drivers\mdc8021x.sys

2011-05-05 22:29:20 28672 ----a-w- c:\windows\system32\ControlACS.exe

2011-05-05 22:29:20 241664 ----a-w- c:\windows\system32\ControlWZCS.exe

2011-05-05 22:29:18 843776 ----a-w- c:\windows\system32\AegisE5.dll

2011-05-05 22:29:18 405504 ----a-w- c:\windows\system32\athcfg11.dll

2011-05-05 22:29:18 36933 ----a-w- c:\windows\system32\athgina.dll

2011-05-05 22:29:18 36864 ----a-w- c:\windows\system32\acs.exe

2011-05-05 22:29:18 28672 ----a-w- c:\windows\system32\DelRunOnceReg.exe

2011-05-05 22:29:18 110592 ----a-w- c:\windows\system32\AegisI5.exe

2011-05-05 22:28:42 -------- dc----w- C:\Atheros Utility.temp

2011-05-05 22:26:59 -------- dc----w- C:\Audio.temp

2011-05-05 22:25:38 393600 ----a-w- c:\windows\system32\drivers\ar5211.sys

2011-05-05 22:25:38 32768 ----a-w- c:\windows\system32\RmWLAN.exe

2011-05-05 22:25:38 32768 ----a-w- c:\windows\system32\CloseACU.exe

2011-05-05 22:25:38 28672 ----a-w- c:\windows\system32\InstallInf.exe

2011-05-05 22:25:38 270336 ----a-w- c:\windows\system32\PlugPlayPCIDevice.exe

2011-05-05 22:25:38 163840 ----a-w- c:\windows\system32\MFCFirstRemove.exe

2011-05-05 22:25:38 -------- d-----w- c:\program files\Atheros

2011-05-05 22:25:13 -------- dc----w- C:\AtherosMB51.temp

2011-05-05 22:24:02 -------- d-----w- c:\windows\system32\ReinstallBackups

2011-05-05 22:23:56 65280 ----a-w- c:\windows\system32\drivers\Rtlnic51.sys

2011-05-05 22:23:55 -------- d-----w- c:\windows\OPTIONS

2011-05-05 22:23:41 32768 ------w- c:\program files\common files\installshield\engine\6\intel 32\objectps.dll

2011-05-05 22:23:41 225280 ------w- c:\program files\common files\installshield\iscript\iscript.dll

2011-05-05 22:23:41 176128 ------w- c:\program files\common files\installshield\engine\6\intel 32\iuser.dll

2011-05-05 22:23:40 77824 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\ctor.dll

2011-05-05 22:23:39 614532 ----a-w- c:\program files\common files\installshield\engine\6\intel 32\IKernel.exe

2011-05-05 22:23:37 -------- dc----w- C:\Realtek Lan.temp

2011-05-05 22:20:55 26144 ----a-w- c:\windows\system32\spupdsvc.exe

2011-05-05 22:20:21 -------- dc----w- C:\1a70v160

2011-05-05 22:19:53 -------- dc-h--w- c:\windows\ie8

2011-05-05 22:07:37 -------- d--h--w- c:\windows\$hf_mig$

2011-05-05 21:27:54 274288 ----a-w- c:\windows\system32\mucltui.dll

2011-05-05 21:27:54 16736 ----a-w- c:\windows\system32\mucltui.dll.mui

2011-05-05 21:26:12 21728 ----a-w- c:\windows\system32\wucltui.dll.mui

2011-05-05 21:26:11 17632 ----a-w- c:\windows\system32\wuaueng.dll.mui

2011-05-05 21:26:11 15072 ----a-w- c:\windows\system32\wuaucpl.cpl.mui

2011-05-05 21:26:11 15064 ----a-w- c:\windows\system32\wuapi.dll.mui

2011-05-05 21:26:10 -------- d-----w- c:\windows\system32\SoftwareDistribution

2011-05-05 21:25:20 -------- d-sh--w- c:\documents and settings\owner\UserData

.

==================== Find3M ====================

.

2011-05-17 04:24:42 90112 ----a-w- c:\windows\DUMP63f9.tmp

2011-05-06 18:49:06 130432 ----a-w- c:\windows\system32\drivers\Rtnicxp.sys

2011-05-06 18:49:05 73728 ----a-w- c:\windows\system32\RtNicProp32.dll

2011-03-11 14:10:38 471552 ----a-w- c:\windows\apppatch\aclayers.dll

2011-03-07 05:33:50 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-03-04 06:37:06 420864 ----a-w- c:\windows\system32\vbscript.dll

2011-03-03 13:21:11 1857920 ----a-w- c:\windows\system32\win32k.sys

2011-02-22 23:06:29 916480 ----a-w- c:\windows\system32\wininet.dll

2011-02-22 23:06:29 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-02-22 23:06:29 1469440 ------w- c:\windows\system32\inetcpl.cpl

2011-02-22 11:41:59 385024 ----a-w- c:\windows\system32\html.iec

.

============= FINISH: 12:22:39.72 ==============

 

 

 

here is the ATTACH Log:

 

 

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_11-05-19.01)

.

Microsoft Windows XP Home Edition

Boot Device: \Device\HarddiskVolume1

Install Date: 5/5/2011 3:59:30 PM

System Uptime: 5/22/2011 12:17:45 PM (0 hours ago)

.

Motherboard: TOSHIBA | | EDW10

Processor: Mobile Intel® Pentium® 4 CPU 3.06GHz | NWD | 3066/mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 56 GiB total, 45.192 GiB free.

D: is CDROM ()

E: is Removable

.

==== Disabled Device Manager Items =============

.

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}

Description:

Device ID: ACPI\CMP0101\2&DABA3FF&0

Manufacturer:

Name:

PNP Device ID: ACPI\CMP0101\2&DABA3FF&0

Service:

.

Class GUID: {4D36E96D-E325-11CE-BFC1-08002BE10318}

Description: HSP56 MR (ATI)

Device ID: PCI\VEN_1002&DEV_434D&SUBSYS_00011179&REV_01\3&61AAA01&0&A6

Manufacturer: PCtel

Name: HSP56 MR (ATI)

PNP Device ID: PCI\VEN_1002&DEV_434D&SUBSYS_00011179&REV_01\3&61AAA01&0&A6

Service: Modem

.

==== System Restore Points ===================

.

RP1: 5/5/2011 4:02:55 PM - System Checkpoint

RP2: 5/5/2011 6:07:46 PM - Installed Windows XP KB932823-v3.

RP3: 5/5/2011 6:20:58 PM - Installed Windows Internet Explorer 8.

RP4: 5/5/2011 6:23:55 PM - Installed Realtek Fast Ethernet Adapter Driver

RP5: 5/5/2011 6:25:37 PM - Installed Atheros Wireless LAN MiniPCI card Driver

RP6: 5/5/2011 6:29:18 PM - Installed Atheros Client Utility

RP7: 5/5/2011 6:44:48 PM - Software Distribution Service 3.0

RP8: 5/5/2011 7:21:17 PM - Software Distribution Service 3.0

RP9: 5/5/2011 9:16:05 PM - Installed Java™ 6 Update 25

RP10: 5/5/2011 9:25:35 PM - Software Distribution Service 3.0

RP11: 5/5/2011 11:03:49 PM - Software Distribution Service 3.0

RP12: 5/5/2011 11:43:19 PM - Software Distribution Service 3.0

RP13: 5/5/2011 11:58:21 PM - B4 Driver Install

RP14: 5/6/2011 10:02:55 AM - Software Distribution Service 3.0

RP15: 5/6/2011 2:47:23 PM - Unsigned driver install

RP16: 5/6/2011 2:51:22 PM - Installed REALTEK GbE & FE Ethernet PCI NIC Driver

RP17: 5/6/2011 3:10:32 PM - Software Distribution Service 3.0

RP18: 5/7/2011 12:00:53 AM - Restore Operation

RP19: 5/7/2011 1:08:12 AM - Software Distribution Service 3.0

RP20: 5/7/2011 10:31:13 AM - Software Distribution Service 3.0

RP21: 5/7/2011 11:23:07 AM - Software Distribution Service 3.0

RP22: 5/7/2011 11:43:35 AM - Software Distribution Service 3.0

RP23: 5/7/2011 4:20:13 PM - Unsigned driver install

RP24: 5/7/2011 4:21:08 PM - Installed REALTEK GbE & FE Ethernet PCI NIC Driver

RP25: 5/7/2011 4:23:36 PM - Unsigned driver install

RP26: 5/7/2011 4:28:28 PM - Installed SRS Audio Sandbox

RP27: 5/7/2011 9:34:36 PM - Installed QuickTime

RP28: 5/8/2011 1:02:33 PM - Software Distribution Service 3.0

RP29: 5/9/2011 10:38:40 PM - Removed SRS Audio Sandbox

RP30: 5/9/2011 10:40:05 PM - Installed SRS Audio Sandbox

RP31: 5/10/2011 8:47:51 PM - Software Distribution Service 3.0

RP32: 5/10/2011 11:54:50 PM - Installed Roxio DVDit Pro HD

RP33: 5/10/2011 11:58:40 PM - Installed Roxio DVDit Pro HD

RP34: 5/11/2011 11:09:06 PM - Software Distribution Service 3.0

RP35: 5/11/2011 11:10:08 PM - Software Distribution Service 3.0

RP36: 5/11/2011 11:27:02 PM - Software Distribution Service 3.0

RP37: 5/13/2011 2:19:14 AM - Software Distribution Service 3.0

RP38: 5/14/2011 3:40:38 PM - Software Distribution Service 3.0

RP39: 5/15/2011 10:59:47 AM - Software Distribution Service 3.0

RP40: 5/15/2011 11:45:30 AM - Installed Adobe Reader X (10.0.1).

RP41: 5/16/2011 11:30:03 AM - Software Distribution Service 3.0

RP42: 5/17/2011 11:42:17 AM - System Checkpoint

RP43: 5/17/2011 7:42:41 PM - Software Distribution Service 3.0

RP44: 5/18/2011 10:51:45 PM - Installed HiJackThis

.

==== Installed Programs ======================

.

µTorrent

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Reader X (10.0.1)

Apple Application Support

Apple Software Update

Atheros Client Utility

Atheros Wireless LAN MiniPCI card Driver

ATI - Software Uninstall Utility

ATI Control Panel

ATI Display Driver

CCleaner

HiJackThis

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows XP (KB954550-v5)

HSP56 Modem Drivers

Java Auto Updater

Java™ 6 Update 25

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2416447)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft Antimalware

Microsoft Application Error Reporting

Microsoft Base Smart Card Cryptographic Service Provider Package

Microsoft Choice Guard

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Security Client

Microsoft Security Essentials

Microsoft Silverlight

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Mozilla Firefox 4.0.1 (x86 en-US)

Mozilla Thunderbird (3.1.10)

MSXML 6.0 Parser (KB933579)

QuickTime

Realtek AC'97 Audio

Realtek Fast Ethernet Adapter Driver

REALTEK GbE & FE Ethernet PCI NIC Driver

Secunia PSI (2.0.0.3003)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Windows Internet Explorer 8 (KB2497640)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB982381)

Segoe UI

SRS Audio Sandbox

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Windows Internet Explorer 8 (KB2447568)

WebFldrs XP

Windows Genuine Advantage Validation Tool (KB892130)

Windows Imaging Component

Windows Internet Explorer 8

Windows Live Essentials

Windows Live Family Safety

Windows Live Sign-in Assistant

Windows Live Upload Tool

Windows Management Framework Core

Windows Media Format 11 runtime

Windows Media Player 11

Windows Search 4.0

Windows XP Service Pack 3

WinRAR 4.00 (32-bit)

XP Codec Pack

.

==== Event Viewer Messages From Past Week ========

.

5/22/2011 12:22:43 PM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0011F52AA335. The following error occurred: The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

5/22/2011 12:18:46 PM, error: System Error [1003] - Error code 10000050, parameter1 f8529b54, parameter2 00000000, parameter3 f760cc28, parameter4 00000000.

5/22/2011 12:14:49 PM, error: System Error [1003] - Error code 10000050, parameter1 f85a948c, parameter2 00000000, parameter3 f7608c28, parameter4 00000000.

5/20/2011 12:16:20 PM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0011F52AA335. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.

5/20/2011 12:15:20 PM, error: System Error [1003] - Error code 10000050, parameter1 f8481324, parameter2 00000000, parameter3 f75e9ca1, parameter4 00000000.

5/20/2011 12:15:18 PM, error: System Error [1003] - Error code 100000d1, parameter1 f84e4440, parameter2 00000002, parameter3 00000001, parameter4 f1258ad9.

5/20/2011 12:07:26 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.103.1952.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6802.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

5/19/2011 12:17:14 AM, error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.

5/18/2011 9:53:58 PM, error: System Error [1003] - Error code 10000050, parameter1 f8551e4c, parameter2 00000001, parameter3 f81e9f4a, parameter4 00000000.

5/18/2011 9:50:22 PM, error: NetBT [4307] - Initialization failed because the transport refused to open initial Addresses.

5/18/2011 10:59:24 PM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.103.1952.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6802.0 Error code: 0x80072ee2 Error description: The operation timed out

5/18/2011 10:46:11 PM, error: PSched [14103] - QoS [Adapter {5A07C321-A422-4A16-904E-46D5C04FB35A}]: The netcard driver failed the query for OID_GEN_LINK_SPEED.

5/16/2011 11:55:38 AM, error: System Error [1003] - Error code 100000d1, parameter1 f84a8318, parameter2 00000002, parameter3 00000001, parameter4 efe87ad9.

5/16/2011 11:12:47 PM, error: System Error [1003] - Error code 100000d1, parameter1 f857d6e5, parameter2 00000002, parameter3 00000001, parameter4 f155a5e1.

5/16/2011 11:09:59 PM, error: System Error [1003] - Error code 10000050, parameter1 f85f3f24, parameter2 00000000, parameter3 f79d2c28, parameter4 00000000.

5/16/2011 10:56:26 PM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.

5/15/2011 12:19:04 AM, error: Service Control Manager [7034] - The TCP/IP NetBIOS Helper service terminated unexpectedly. It has done this 1 time(s).

5/15/2011 12:19:04 AM, error: Service Control Manager [7034] - The SSDP Discovery Service service terminated unexpectedly. It has done this 1 time(s).

5/15/2011 12:19:04 AM, error: Service Control Manager [7031] - The Universal Plug and Play Device Host service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

5/15/2011 11:50:25 AM, error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

5/15/2011 10:59:02 AM, error: System Error [1003] - Error code 10000050, parameter1 f84ac000, parameter2 00000001, parameter3 805e5397, parameter4 00000000.

5/15/2011 10:35:40 AM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.103.1753.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6802.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

5/15/2011 10:35:11 AM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.103.1753.0 Update Source: Microsoft Update Server Update Stage: Search Source Path: http://www.microsoft.com Signature Type: AntiVirus Update Type: Full User: NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6802.0 Error code: 0x8024402c Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.

.

==== End Of File ===========================

 

 

 

and here is the aswMBR Log:

 

 

 

aswMBR version 0.9.5.256 Copyright© 2011 AVAST Software

Run date: 2011-05-22 12:24:49

-----------------------------

12:24:49.394 OS Version: Windows 5.1.2600 Service Pack 3

12:24:49.394 Number of processors: 2 586 0x401

12:24:49.394 ComputerName: FLASH-00273D36F UserName: Owner

12:24:50.082 Initialize success

12:24:54.035 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3

12:24:54.035 Disk 0 Vendor: IC25N060ATMR04-0 MO3OAD4A Size: 57231MB BusType: 3

12:24:56.066 Disk 0 MBR read successfully

12:24:56.066 Disk 0 MBR scan

12:24:56.066 Disk 0 Windows XP default MBR code

12:24:58.066 Disk 0 scanning sectors +117194175

12:24:58.113 Disk 0 scanning C:\WINDOWS\system32\drivers

12:25:05.863 Service scanning

12:25:07.253 Disk 0 trace - called modules:

12:25:07.269 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys atiide.sys PCIIDEX.SYS

12:25:07.285 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82b79928]

12:25:07.285 3 CLASSPNP.SYS[f7ee1fd7] -> nt!IofCallDriver -> \Device\00000076[0x82b33f18]

12:25:07.285 5 ACPI.sys[f7e58620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x82b4a940]

12:25:07.285 Scan finished successfully

12:25:46.128 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Owner\Desktop\MBR.dat"

12:25:46.144 The log file has been saved successfully to "C:\Documents and Settings\Owner\Desktop\aswMBR.txt"

 

 

Edited by flash0429

Share this post


Link to post
Share on other sites

Hi Flash0429!

 

Please read through these instructions to familarize yourself with what to expect when this tool runs

 

Download ComboFix from one of these locations:

 

Link 1

Link 2

 

* IMPORTANT !!! Save ComboFix.exe to your Desktop

 

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

 

Posted Image

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

 

Posted Image

 

Click on Yes, to continue scanning for malware.

 

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

 

Notes:

 

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

 

In your next reply please post the log created by ComboFix. :)

Share this post


Link to post
Share on other sites

here is the Combo Fix Log i had to run it twice since the first time i ran it it blue screenes when it was trying to make the log however the results of the first scan are still in here:

 

 

 

ComboFix 11-05-23.02 - Owner 05/23/2011 19:00:20.2.2 - x86

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

---- Previous Run -------

.

c:\program files\Internet Explorer\SET42.tmp

c:\program files\Internet Explorer\SET47.tmp

c:\windows\system32\_000741_.tmp.dll

.

-- Previous Run --

.

Infected copy of c:\windows\system32\userinit.exe was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\userinit.exe

.

--------

.

.

((((((((((((((((((((((((( Files Created from 2011-04-23 to 2011-05-23 )))))))))))))))))))))))))))))))

.

.

2011-05-23 22:44 . 2011-05-23 22:44 -------- dc----w- C:\spoolerlogs

2011-05-20 16:13 . 2011-05-20 16:13 -------- d-----w- C:\found.001

2011-05-07 15:29 . 2011-05-07 15:29 -------- dc----w- C:\5008b47a02dc04ba23

2011-05-06 22:22 . 2011-05-06 22:22 -------- d-----w- C:\found.000

2011-05-06 14:10 . 2011-05-06 14:22 -------- dc----w- C:\ATI

2011-05-06 02:58 . 2011-05-06 03:02 -------- dc----w- C:\d50df6bd7956c467af0de3cc65d6

2011-05-05 23:44 . 2011-05-05 23:44 -------- dc----w- C:\5f81d6e16bc36fca997325817afef3df

2011-05-05 22:31 . 2011-05-05 22:32 -------- dc----w- C:\Display.temp

2011-05-05 22:28 . 2011-05-05 22:28 -------- dc----w- C:\Atheros Utility.temp

2011-05-05 22:26 . 2011-05-05 22:27 -------- dc----w- C:\Audio.temp

2011-05-05 22:25 . 2011-05-05 22:25 -------- dc----w- C:\AtherosMB51.temp

2011-05-05 22:23 . 2011-05-05 22:23 -------- dc----w- C:\Realtek Lan.temp

2011-05-05 22:20 . 2011-05-05 22:20 -------- dc----w- C:\1a70v160

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-05-06 18:49 . 2008-02-25 16:54 130432 ----a-w- c:\windows\system32\drivers\Rtnicxp.sys

2011-05-06 18:49 . 2008-07-21 20:14 73728 ----a-w- c:\windows\system32\RtNicProp32.dll

2011-03-11 14:10 . 2004-08-04 12:00 471552 ----a-w- c:\windows\apppatch\aclayers.dll

2011-03-04 06:37 . 2004-08-04 12:00 420864 ----a-w- c:\windows\system32\vbscript.dll

2011-03-03 13:21 . 2004-08-04 12:00 1857920 ----a-w- c:\windows\system32\win32k.sys

2011-04-14 16:26 . 2011-05-06 01:14 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-05-12 557432]

"SRS Audio Sandbox"="c:\program files\SRS Labs\Audio Sandbox\SRSSSC.exe" [2011-05-10 3215360]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ACU"="c:\program files\Atheros\ACU.exe" [2004-08-08 286720]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-04-22 335872]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]

"PCTVOICE"="pctspk.exe" [2003-10-30 180224]

"PV92TRAY"="PV92Tray.exe" [2003-10-30 323584]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

.

c:\documents and settings\Owner\Start Menu\Programs\Startup\

Mozilla Thunderbird.lnk - c:\program files\Mozilla Thunderbird\thunderbird.exe [2011-5-15 12594352]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2011-4-19 291896]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^3754068.lnk]

path=c:\documents and settings\Owner\Start Menu\Programs\Startup\3754068.lnk

backup=c:\windows\pss\3754068.lnkStartup

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

"AllowInboundTimestampRequest"= 1 (0x1)

"AllowInboundMaskRequest"= 1 (0x1)

"AllowInboundRouterRequest"= 1 (0x1)

"AllowOutboundDestinationUnreachable"= 1 (0x1)

"AllowOutboundSourceQuench"= 1 (0x1)

"AllowOutboundParameterProblem"= 1 (0x1)

"AllowOutboundTimeExceeded"= 1 (0x1)

"AllowRedirect"= 1 (0x1)

"AllowOutboundPacketTooBig"= 1 (0x1)

.

R1 MpKsl06aebd47;MpKsl06aebd47;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E5E512B-65E9-4EAD-BC43-BEA0985761F7}\MpKsl06aebd47.sys [x]

R1 MpKsl51843941;MpKsl51843941;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A33162C-F39E-4CB9-A5C0-7DC41C49B7E5}\MpKsl51843941.sys [2011-05-19 28752]

R1 MpKsl674c8087;MpKsl674c8087;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E5E512B-65E9-4EAD-BC43-BEA0985761F7}\MpKsl674c8087.sys [x]

R1 MpKsl680f7889;MpKsl680f7889;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A33162C-F39E-4CB9-A5C0-7DC41C49B7E5}\MpKsl680f7889.sys [2011-05-23 28752]

R1 MpKsl7892d574;MpKsl7892d574;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E5E512B-65E9-4EAD-BC43-BEA0985761F7}\MpKsl7892d574.sys [x]

R1 MpKsl7e38be4c;MpKsl7e38be4c;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D58E7749-60C8-41D7-89ED-28DED1F79493}\MpKsl7e38be4c.sys [x]

R1 MpKsl8431e654;MpKsl8431e654;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E5E512B-65E9-4EAD-BC43-BEA0985761F7}\MpKsl8431e654.sys [x]

R1 MpKslb5e33cc4;MpKslb5e33cc4;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2F7CD987-495B-46CA-88EC-515183FFD8FE}\MpKslb5e33cc4.sys [x]

R1 MpKslda90a961;MpKslda90a961;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A33162C-F39E-4CB9-A5C0-7DC41C49B7E5}\MpKslda90a961.sys [2011-05-20 28752]

R1 MpKsldebc6bd0;MpKsldebc6bd0;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A33162C-F39E-4CB9-A5C0-7DC41C49B7E5}\MpKsldebc6bd0.sys [2011-05-20 28752]

R1 MpKsle3996729;MpKsle3996729;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D58E7749-60C8-41D7-89ED-28DED1F79493}\MpKsle3996729.sys [x]

R1 MpKslf8bf84e8;MpKslf8bf84e8;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2F7CD987-495B-46CA-88EC-515183FFD8FE}\MpKslf8bf84e8.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 15544]

R3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe [2008-04-14 14336]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S0 atiide;atiide;c:\windows\system32\DRIVERS\atiide.sys [2004-06-01 6016]

S2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\Drivers\ousbehci.sys [2005-07-15 45696]

S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2011-04-19 993848]

S2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [2011-04-19 399416]

S3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\DRIVERS\ousb2hub.sys [2005-07-15 56960]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

WINRM REG_MULTI_SZ WINRM

.

Contents of the 'Scheduled Tasks' folder

.

2011-05-16 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

.

2011-05-23 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 16:26]

.

2011-05-23 c:\windows\Tasks\User_Feed_Synchronization-{328B7CC1-7421-4D6A-9900-C7962576C5A4}.job

- c:\windows\system32\msfeedssync.exe [2009-03-08 11:31]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://google.com/

Trusted Zone: microsoft.com\*.update

Trusted Zone: windowsupdate.com\download

FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\bwz6k9h4.default\

FF - prefs.js: network.proxy.type - 0

.

- - - - ORPHANS REMOVED - - - -

.

MSConfigStartUp-DriverFinder - c:\program files\DriverFinder\DriverFinder.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-05-23 19:08

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

Completion time: 2011-05-23 19:12:46

ComboFix-quarantined-files.txt 2011-05-23 23:12

.

Pre-Run: 48,453,496,832 bytes free

Post-Run: 48,419,352,576 bytes free

.

- - End Of File - - 5AC426B36B2B752A1542794B8C06FE99

 

 

Edited by flash0429

Share this post


Link to post
Share on other sites

Hi!!

 

**WARNING**Unfortunately one or more of the infections I have identified are Backdoor Trojans, IRCBots or other Malware capable of stealing very important information. You need to stop using all Internet Banking sites, change passwords to all sites with sensitive information from a clean computer and phone your bank to inform them that you may be a victim of identify theft. More often than not, we advise users that a full reinstallation of their Operating System is the only way to ensure that their computer will ever be 100% clean again.

 

If you would like to continue with the cleaning please follow the instructions below and I will be more than happy to help. :)

----------

 

1. Close any open browsers.

 

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

 

3. Open notepad and copy/paste the text in the quotebox below into it:

 

File::

c:\documents and settings\Owner\Start Menu\Programs\Startup\3754068.lnk

c:\windows\pss\3754068.lnkStartup

 

Registry::

[-HKLM\~\startupfolder\C:\Documents and Settings\Owner\Start Menu\Programs\Startup\3754068.lnk]

 

Save this as "CFScript.txt", and as Type: All Files (*.*) in the same location as ComboFix.exe

 

 

Posted Image

 

Refering to the picture above, drag CFScript into ComboFix.exe

 

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Share this post


Link to post
Share on other sites

here is the Combo Fix Log:

 

 

 

ComboFix 11-05-24.06 - Owner 05/25/2011 11:33:27.3.2 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.703.397 [GMT -4:00]

Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

* Created a new restore point

.

FILE ::

"c:\documents and settings\Owner\Start Menu\Programs\Startup\3754068.lnk"

"c:\windows\pss\3754068.lnkStartup"

.

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\pss\3754068.lnkStartup

.

.

((((((((((((((((((((((((( Files Created from 2011-04-25 to 2011-05-25 )))))))))))))))))))))))))))))))

.

.

2011-05-23 22:44 . 2011-05-23 22:44 -------- dc----w- C:\spoolerlogs

2011-05-20 16:13 . 2011-05-20 16:13 -------- d-----w- C:\found.001

2011-05-07 15:29 . 2011-05-07 15:29 -------- dc----w- C:\5008b47a02dc04ba23

2011-05-06 22:22 . 2011-05-06 22:22 -------- d-----w- C:\found.000

2011-05-06 14:10 . 2011-05-06 14:22 -------- dc----w- C:\ATI

2011-05-06 02:58 . 2011-05-06 03:02 -------- dc----w- C:\d50df6bd7956c467af0de3cc65d6

2011-05-05 23:44 . 2011-05-05 23:44 -------- dc----w- C:\5f81d6e16bc36fca997325817afef3df

2011-05-05 22:31 . 2011-05-05 22:32 -------- dc----w- C:\Display.temp

2011-05-05 22:28 . 2011-05-05 22:28 -------- dc----w- C:\Atheros Utility.temp

2011-05-05 22:26 . 2011-05-05 22:27 -------- dc----w- C:\Audio.temp

2011-05-05 22:25 . 2011-05-05 22:25 -------- dc----w- C:\AtherosMB51.temp

2011-05-05 22:23 . 2011-05-05 22:23 -------- dc----w- C:\Realtek Lan.temp

2011-05-05 22:20 . 2011-05-05 22:20 -------- dc----w- C:\1a70v160

.

.

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-05-06 18:49 . 2008-02-25 16:54 130432 ----a-w- c:\windows\system32\drivers\Rtnicxp.sys

2011-05-06 18:49 . 2008-07-21 20:14 73728 ----a-w- c:\windows\system32\RtNicProp32.dll

2011-03-11 14:10 . 2004-08-04 12:00 471552 ----a-w- c:\windows\apppatch\aclayers.dll

2011-03-04 06:37 . 2004-08-04 12:00 420864 ----a-w- c:\windows\system32\vbscript.dll

2011-03-03 13:21 . 2004-08-04 12:00 1857920 ----a-w- c:\windows\system32\win32k.sys

2011-04-14 16:26 . 2011-05-06 01:14 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((( [email protected]_23.08.21 )))))))))))))))))))))))))))))))))))))))))

.

+ 2011-05-25 15:31 . 2011-05-25 15:31 16384 c:\windows\Temp\Perflib_Perfdata_6f0.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-05-12 557432]

"SRS Audio Sandbox"="c:\program files\SRS Labs\Audio Sandbox\SRSSSC.exe" [2011-05-10 3215360]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ACU"="c:\program files\Atheros\ACU.exe" [2004-08-08 286720]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-04-22 335872]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]

"PCTVOICE"="pctspk.exe" [2003-10-30 180224]

"PV92TRAY"="PV92Tray.exe" [2003-10-30 323584]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

.

c:\documents and settings\Owner\Start Menu\Programs\Startup\

Mozilla Thunderbird.lnk - c:\program files\Mozilla Thunderbird\thunderbird.exe [2011-5-15 12594352]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Secunia PSI Tray.lnk - c:\program files\Secunia\PSI\psi_tray.exe [2011-4-19 291896]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^3754068.lnk]

path=c:\documents and settings\Owner\Start Menu\Programs\Startup\3754068.lnk

backup=c:\windows\pss\3754068.lnkStartup

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

"AllowInboundTimestampRequest"= 1 (0x1)

"AllowInboundMaskRequest"= 1 (0x1)

"AllowInboundRouterRequest"= 1 (0x1)

"AllowOutboundDestinationUnreachable"= 1 (0x1)

"AllowOutboundSourceQuench"= 1 (0x1)

"AllowOutboundParameterProblem"= 1 (0x1)

"AllowOutboundTimeExceeded"= 1 (0x1)

"AllowRedirect"= 1 (0x1)

"AllowOutboundPacketTooBig"= 1 (0x1)

.

R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [6/1/2004 5:02 AM 6016]

R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\drivers\ousbehci.sys [5/7/2011 4:17 PM 45696]

R2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\psia.exe [4/19/2011 2:44 AM 993848]

R2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [4/19/2011 2:44 AM 399416]

R3 ousb2hub;OrangeWare USB 2.0 Root Hub Support;c:\windows\system32\drivers\ousb2hub.sys [5/7/2011 4:17 PM 56960]

S1 MpKsl06aebd47;MpKsl06aebd47;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E5E512B-65E9-4EAD-BC43-BEA0985761F7}\MpKsl06aebd47.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E5E512B-65E9-4EAD-BC43-BEA0985761F7}\MpKsl06aebd47.sys [?]

S1 MpKsl51843941;MpKsl51843941;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A33162C-F39E-4CB9-A5C0-7DC41C49B7E5}\MpKsl51843941.sys [5/18/2011 9:50 PM 28752]

S1 MpKsl674c8087;MpKsl674c8087;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E5E512B-65E9-4EAD-BC43-BEA0985761F7}\MpKsl674c8087.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E5E512B-65E9-4EAD-BC43-BEA0985761F7}\MpKsl674c8087.sys [?]

S1 MpKsl680f7889;MpKsl680f7889;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A33162C-F39E-4CB9-A5C0-7DC41C49B7E5}\MpKsl680f7889.sys [5/23/2011 5:43 PM 28752]

S1 MpKsl7892d574;MpKsl7892d574;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E5E512B-65E9-4EAD-BC43-BEA0985761F7}\MpKsl7892d574.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E5E512B-65E9-4EAD-BC43-BEA0985761F7}\MpKsl7892d574.sys [?]

S1 MpKsl7e38be4c;MpKsl7e38be4c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D58E7749-60C8-41D7-89ED-28DED1F79493}\MpKsl7e38be4c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D58E7749-60C8-41D7-89ED-28DED1F79493}\MpKsl7e38be4c.sys [?]

S1 MpKsl8431e654;MpKsl8431e654;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E5E512B-65E9-4EAD-BC43-BEA0985761F7}\MpKsl8431e654.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{6E5E512B-65E9-4EAD-BC43-BEA0985761F7}\MpKsl8431e654.sys [?]

S1 MpKslb5e33cc4;MpKslb5e33cc4;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2F7CD987-495B-46CA-88EC-515183FFD8FE}\MpKslb5e33cc4.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2F7CD987-495B-46CA-88EC-515183FFD8FE}\MpKslb5e33cc4.sys [?]

S1 MpKslda90a961;MpKslda90a961;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A33162C-F39E-4CB9-A5C0-7DC41C49B7E5}\MpKslda90a961.sys [5/20/2011 1:29 PM 28752]

S1 MpKsldebc6bd0;MpKsldebc6bd0;c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{3A33162C-F39E-4CB9-A5C0-7DC41C49B7E5}\MpKsldebc6bd0.sys [5/20/2011 1:31 PM 28752]

S1 MpKsle3996729;MpKsle3996729;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D58E7749-60C8-41D7-89ED-28DED1F79493}\MpKsle3996729.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{D58E7749-60C8-41D7-89ED-28DED1F79493}\MpKsle3996729.sys [?]

S1 MpKslf8bf84e8;MpKslf8bf84e8;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2F7CD987-495B-46CA-88EC-515183FFD8FE}\MpKslf8bf84e8.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2F7CD987-495B-46CA-88EC-515183FFD8FE}\MpKslf8bf84e8.sys [?]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]

S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [9/1/2010 4:30 AM 15544]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [8/4/2004 8:00 AM 14336]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

WINRM REG_MULTI_SZ WINRM

.

Contents of the 'Scheduled Tasks' folder

.

2011-05-16 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

.

2011-05-25 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2010-11-11 16:26]

.

2011-05-25 c:\windows\Tasks\User_Feed_Synchronization-{328B7CC1-7421-4D6A-9900-C7962576C5A4}.job

- c:\windows\system32\msfeedssync.exe [2009-03-08 11:31]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://google.com/

Trusted Zone: microsoft.com\*.update

Trusted Zone: windowsupdate.com\download

FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\bwz6k9h4.default\

FF - prefs.js: network.proxy.type - 0

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-05-25 11:40

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

Completion time: 2011-05-25 11:42:08

ComboFix-quarantined-files.txt 2011-05-25 15:42

ComboFix2.txt 2011-05-23 23:12

.

Pre-Run: 48,374,284,288 bytes free

Post-Run: 48,366,628,864 bytes free

.

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

.

- - End Of File - - 78D8C6279A09D71FEBB292FC41ADBD8D

 

 

Edited by flash0429

Share this post


Link to post
Share on other sites

Hi flash0429!!

 

Please download OTM by OldTimer.

  • Save it to your desktop.
  • Please click OTM and then click >> run.
  • Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Reg
[-HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^3754068.lnk]
[-HKLM\~\startupfolder\C:\Documents and Settings\Owner\Start Menu\Programs\Startup\3754068.lnk]

:Files
c:\documents and settings\Owner\Start Menu\Programs\Startup\3754068.lnk
c:\windows\pss\3754068.lnkStartup

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]
  • Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM
Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Share this post


Link to post
Share on other sites

here is the OTM Log:

 

 

 

All processes killed

========== PROCESSES ==========

No active process named explorer.exe was found!

========== REGISTRY ==========

Registry key HKEY_LOCAL_MACHINE\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^3754068.lnk\ not found.

Registry key HKEY_LOCAL_MACHINE\~\startupfolder\C:\Documents and Settings\Owner\Start Menu\Programs\Startup\3754068.lnk\ not found.

========== FILES ==========

File/Folder c:\documents and settings\Owner\Start Menu\Programs\Startup\3754068.lnk not found.

File/Folder c:\windows\pss\3754068.lnkStartup not found.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrator

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: All Users

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

 

User: LocalService

->Temp folder emptied: 66016 bytes

->Temporary Internet Files folder emptied: 32902 bytes

 

User: NetworkService

->Temp folder emptied: 1152 bytes

->Temporary Internet Files folder emptied: 67 bytes

 

User: Owner

->Temp folder emptied: 1803 bytes

->Temporary Internet Files folder emptied: 5576641 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 266814819 bytes

->Flash cache emptied: 5109 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 2252395 bytes

%systemroot%\System32 .tmp files removed: 19818180 bytes

%systemroot%\System32\dllcache .tmp files removed: 20839632 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 1610 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes

RecycleBin emptied: 80798541 bytes

 

Total Files Cleaned = 378.00 mb

 

 

OTM by OldTimer - Version 3.1.18.0 log created on 05252011_223638

 

Files moved on Reboot...

 

Registry entries deleted on Reboot...

 

 

Edited by flash0429

Share this post


Link to post
Share on other sites

Thank you for the log. I will return as quickly as I can. :)

Share this post


Link to post
Share on other sites

Hi Flash0429,

 

Please download Malwarebytes' Anti-Malware to your desktop.

 

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan as shown below.

     

    Posted Image

  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

 

The log can also be found here:

C:\Documents and Settings\<User name>\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

----------

ESET Online Scanner

I'd like us to scan your machine with ESET Online Scan

 

Note: It is recommended to disable on-board anti-virus program and anti-spyware programs while performing scans so there are no conflicts and it will speed up scan time.

Please don't go surfing while your resident protection is disabled!

Once the scan is finished remember to re-enable your anti-virus along with your anti-spyware programs.

 

  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.

    ESET OnlineScan

  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Make sure that the option "Remove found threats" is Unchecked
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin

    scanning your computer. Please be patient as this can take some time.

  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as

    ESETScan. Include the contents of this report in your next reply.

  • Push the Back button.
  • Push Finish
http://www.eset.com/onlinescan/

 

In your next reply please post the logs created by Malwarebytes and the ESET Online Scanner. :)

Share this post


Link to post
Share on other sites

ok here is the MWAM Log:

 

 

 

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

 

Database version: 6682

 

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

 

5/26/2011 12:53:53 AM

mbam-log-2011-05-26 (00-53-53).txt

 

Scan type: Quick scan

Objects scanned: 140148

Time elapsed: 4 minute(s), 8 second(s)

 

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

 

Memory Processes Infected:

(No malicious items detected)

 

Memory Modules Infected:

(No malicious items detected)

 

Registry Keys Infected:

(No malicious items detected)

 

Registry Values Infected:

(No malicious items detected)

 

Registry Data Items Infected:

(No malicious items detected)

 

Folders Infected:

(No malicious items detected)

 

Files Infected:

(No malicious items detected)

 

 

 

and here is the ESET Log:

 

 

 

C:\System Volume Information\_restore{075FF223-EC4E-4AB5-8156-0AEEAC6E79F3}\RP27\A0023775.exe multiple threats

C:\System Volume Information\_restore{075FF223-EC4E-4AB5-8156-0AEEAC6E79F3}\RP28\A0025741.EXE probably a variant of Win32/Delf.FHGRIIB trojan

C:\System Volume Information\_restore{075FF223-EC4E-4AB5-8156-0AEEAC6E79F3}\RP32\A0029011.EXE a variant of Win32/Keygen.AF application

C:\System Volume Information\_restore{075FF223-EC4E-4AB5-8156-0AEEAC6E79F3}\RP41\A0033272.EXE a variant of Win32/Keygen.AF application

 

 

 

when i ran the ESET scan it blue screen on me when it was updating the database and when the computer restarted it ran an error check and fixe a bunch of stuff so if you would like that log i know where to find it and i can post it in the next reply

Share this post


Link to post
Share on other sites

Hi flash0429,

 

Yes please post that log created by the error check so that we can take a look at that. Thank you.

----------

 

You have an older version of Adobe Reader. You can download the current version HERE

----------

 

P2P - I see you have P2P software uTorrent installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections and possibly Identity Theft. It likely contributed to your current situation. This page will give you further information.

 

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

 

I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs.

Share this post


Link to post
Share on other sites

here is the Log:

 

 

 

Checking file system on C:

The type of the file system is NTFS.

 

 

One of your disks needs to be checked for consistency. You

may cancel the disk check, but it is strongly recommended

that you continue.

Windows will now check the disk.

The segment number 0x522100000000 in file 0x5239 is incorrect.

Correcting a minor error in file 21049.

Attribute record of type 0x80 and instance tag 0x3 is cross linked

starting at 0x3c960a for possibly 0x1 clusters.

Attribute record of type 0x80 and instance tag 0x3 is cross linked

starting at 0x3c960a for possibly 0x1 clusters.

Some clusters occupied by attribute of type 0x80 and instance tag 0x3

in file 0x5239 is already in use.

Deleting corrupt attribute record (128, "")

from file record segment 21049.

The segment number 0x522200000000 in file 0x523a is incorrect.

Correcting a minor error in file 21050.

Attribute record of type 0x80 and instance tag 0x4 is cross linked

starting at 0x79a521 for possibly 0x24 clusters.

Attribute record of type 0x80 and instance tag 0x4 is cross linked

starting at 0x79a521 for possibly 0x24 clusters.

Some clusters occupied by attribute of type 0x80 and instance tag 0x4

in file 0x523a is already in use.

Deleting corrupt attribute record (128, "")

from file record segment 21050.

The segment number 0x522300000000 in file 0x523b is incorrect.

Correcting a minor error in file 21051.

The segment number 0xa9cc00000000 in file 0xaa08 is incorrect.

Correcting a minor error in file 43528.

Attribute record of type 0x80 and instance tag 0x3 is cross linked

starting at 0x3d2d64 for possibly 0x2b clusters.

Attribute record of type 0x80 and instance tag 0x3 is cross linked

starting at 0x3d2d64 for possibly 0x2b clusters.

Some clusters occupied by attribute of type 0x80 and instance tag 0x3

in file 0xaa08 is already in use.

Deleting corrupt attribute record (128, "")

from file record segment 43528.

The segment number 0xa9ce00000000 in file 0xaa0a is incorrect.

Correcting a minor error in file 43530.

Attribute record of type 0x80 and instance tag 0x3 is cross linked

starting at 0xade00 for possibly 0x1 clusters.

Attribute record of type 0x80 and instance tag 0x3 is cross linked

starting at 0xade00 for possibly 0x1 clusters.

Some clusters occupied by attribute of type 0x80 and instance tag 0x3

in file 0xaa0a is already in use.

Deleting corrupt attribute record (128, "")

from file record segment 43530.

The segment number 0xa9cf00000000 in file 0xaa0b is incorrect.

Correcting a minor error in file 43531.

The file reference 0x100000000523a of index entry $NtUninstallWudf01000$ of index $I30

with parent 0x1c is not the same as 0x400000000523a.

Deleting index entry $NtUninstallWudf01000$ in index $I30 of file 28.

The file reference 0x100000000523a of index entry $NTUNI~4 of index $I30

with parent 0x1c is not the same as 0x400000000523a.

Deleting index entry $NTUNI~4 in index $I30 of file 28.

The file reference 0x5000000005239 of index entry SRS Labs of index $I30

with parent 0xd17 is not the same as 0x4000000005239.

Deleting index entry SRS Labs in index $I30 of file 3351.

The file reference 0x5000000005239 of index entry SRSLAB~1 of index $I30

with parent 0xd17 is not the same as 0x4000000005239.

Deleting index entry SRSLAB~1 in index $I30 of file 3351.

The file reference 0x800000000aa0b of index entry Mozilla Thunderbird of index $I30

with parent 0xe95 is not the same as 0x1700000000aa0b.

Deleting index entry Mozilla Thunderbird in index $I30 of file 3733.

The file reference 0x800000000aa0b of index entry MOZILL~2 of index $I30

with parent 0xe95 is not the same as 0x1700000000aa0b.

Deleting index entry MOZILL~2 in index $I30 of file 3733.

The parent 0x7000000005223 of index entry SRSSSC.INI of index $I30

in file 0x522f is incorrect. The expected parent is 0x700000000523b.

Deleting index entry SRSSSC.INI in index $I30 of file 21051.

The parent 0x7000000005223 of index entry SRSSSC_PRESETS.INI of index $I30

in file 0x522d is incorrect. The expected parent is 0x700000000523b.

Deleting index entry SRSSSC_PRESETS.INI in index $I30 of file 21051.

The parent 0x7000000005223 of index entry SRSSSC~1.INI of index $I30

in file 0x522d is incorrect. The expected parent is 0x700000000523b.

Deleting index entry SRSSSC~1.INI in index $I30 of file 21051.

Index entry A0020882.dir of index $I30 in file 0x5242 points to unused file 0x5238.

Deleting index entry A0020882.dir in index $I30 of file 21058.

The file reference 0x500000000aa08 of index entry SendTo.folder.dat of index $I30

with parent 0xa66a is not the same as 0xa00000000aa08.

Deleting index entry SendTo.folder.dat in index $I30 of file 42602.

The file reference 0x500000000aa08 of index entry SENDTO~1.DAT of index $I30

with parent 0xa66a is not the same as 0xa00000000aa08.

Deleting index entry SENDTO~1.DAT in index $I30 of file 42602.

Index entry StartMenu.folder.dat of index $I30 in file 0xa66a points to unused file 0xaa09.

Deleting index entry StartMenu.folder.dat in index $I30 of file 42602.

Index entry STARTM~1.DAT of index $I30 in file 0xa66a points to unused file 0xaa09.

Deleting index entry STARTM~1.DAT in index $I30 of file 42602.

The file reference 0x800000000aa0a of index entry StartUp.folder.dat of index $I30

with parent 0xa66a is not the same as 0xe00000000aa0a.

Deleting index entry StartUp.folder.dat in index $I30 of file 42602.

The file reference 0x800000000aa0a of index entry STARTU~1.DAT of index $I30

with parent 0xa66a is not the same as 0xe00000000aa0a.

Deleting index entry STARTU~1.DAT in index $I30 of file 42602.

The parent 0x1700000000a9cf of index entry MovedFiles of index $I30

in file 0xac4c is incorrect. The expected parent is 0x1700000000aa0b.

Deleting index entry MovedFiles in index $I30 of file 43531.

The parent 0x1700000000a9cf of index entry MOVEDF~1 of index $I30

in file 0xac4c is incorrect. The expected parent is 0x1700000000aa0b.

Deleting index entry MOVEDF~1 in index $I30 of file 43531.

Cleaning up minor inconsistencies on the drive.

CHKDSK is recovering lost files.

Cleaning up 104 unused index entries from index $SII of file 0x9.

Cleaning up 104 unused index entries from index $SDH of file 0x9.

Cleaning up 104 unused security descriptors.

Inserting data attribute into file 21049.

Inserting data attribute into file 21050.

Inserting data attribute into file 43528.

Inserting data attribute into file 43530.

CHKDSK is verifying Usn Journal...

Usn Journal verification completed.

Correcting errors in the master file table's (MFT) BITMAP attribute.

Correcting errors in the Volume Bitmap.

Windows has made corrections to the file system.

 

58597055 KB total disk space.

11130720 KB in 38165 files.

11212 KB in 3885 indexes.

0 KB in bad sectors.

160047 KB in use by the system.

65536 KB occupied by the log file.

47295076 KB available on disk.

 

4096 bytes in each allocation unit.

14649263 total allocation units on disk.

11823769 allocation units available on disk.

 

Internal Info:

50 dd 00 00 4f a4 00 00 58 c9 00 00 00 00 00 00 P...O...X.......

7c 00 00 00 01 00 00 00 d9 04 00 00 00 00 00 00 |...............

ee 1e 0d 04 00 00 00 00 c0 81 0a 27 00 00 00 00 ...........'....

da ba 86 0c 00 00 00 00 00 00 00 00 00 00 00 00 ................

00 00 00 00 00 00 00 00 0a be 49 43 00 00 00 00 ..........IC....

d0 6a cc b6 00 00 00 00 78 38 07 00 15 95 00 00 .j......x8......

00 00 00 00 00 80 5d a7 02 00 00 00 2d 0f 00 00 ......].....-...

 

Windows has finished checking your disk.

Please wait while your computer restarts.

 

 

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 

 

Share this post


Link to post
Share on other sites

  • Click Start > Run... then type in CMD and click on OK.
  • At the Command Prompt C:\ > type the following: chkdsk c: /r and hit the Enter/Return key.

    Note: chkdsk c: /r presumes that the disk upon which you wish to run Error Checking is your C: Drive (most often)

  • When prompted with:

CHKDSK cannot run because the volume is in use by another process

Would you like to schedule this volume to be checked next time the system

restarts (Y/N)

  • Hit the Y key then at the Command Prompt C:\ >
  • Type in EXIT and and hit the Enter/Return key.
  • Now Reboot(Restart) your computer.
Note: Upon Reboot(Restart), CHKDSK will start and carry out the repairs required.

 

How is your computer running now and are you having any other problems?

Share this post


Link to post
Share on other sites

im not having ne other problems no the computer seems to be running better it is not blue screening as often as it was before however it has happened a couple times still the errors i have been getting are

 

 

driver_irql_not_less_or_equal i only get this one once in a while not all the time

 

but then i also get: non_page_fault this is the one that i get most of the time

 

im not sure if that helps any

Share this post


Link to post
Share on other sites

Hi flash0429,

 

IT APPEARS THAT YOUR LOGS ARE NOW CLEAN :D SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!! :D

 

This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.

----------

 

After performing the following instructions, I would ask that you start a new thread in the Tech Forum here at PC Pitstop or here at What the Tech (you will have to register for an account if you don't already have one). They will be able to help you with your error messages and BSOD problems as these are not malware related.

----------

 

The following will implement some cleanup procedures as well as reset System Restore points:

 

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

 

ComboFix /Uninstall

----------

 

  • Double-click OTM.exe to start the program.
  • Close all other programs apart from OTM as this step will require a reboot
  • On the OTM main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
----------

 

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.

 

Here are some tips to reduce the potential for spyware infection in the future:

 

1. Make your Internet Explorer more secure - This can be done by following these simple instructions:

  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
2. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:
  • Open Internet Explorer
  • Click on Tools > Internet Options
  • Press Security tab
  • Select Internet zone then place check next to Enable Protected Mode if not already done
  • Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
  • Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.
3. Use and Update an Anti-Virus Software - I can not overemphasize the need for you to use and update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

 

4. Firewall

Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here.

**Do not install more than one firewall program because they will conflict with each other**

5. Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

 

6. Filehippo's Update Checker. It is free utilitiy that scan your computer for installed software, checks the versions and then sends this information to see if there are any newer releases. Available software updates are displayed and you can decide which ones to download and install. Among many other types of programs, they includes a number of the Anti-Spyware, Firewall/Security and Anti-Virus programs that have been recommended (though not all of them). Note: Definition files should be updated from within the programs themselves. The Update Checker look for newer versions of the software program, not definition files.

 

7. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.

For information on how to download and install, please read this tutorial by WinHelp2002

Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

 

8. WOT , Web of Trust, As 'Googling' is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

  • Green to go
  • Yellow for caution
  • Red to stop
WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

 

9. Install Spybot - Search and Destroy - Download and install Spybot - Search and Destroy with its TeaTimer option. This will provide real time spyware and hijacker protection on your computer alongside your virus protection. You should scan your computer with the program on a regular basis just as you would with your anti-virus software. A tutorial on installing and using this product can be found here:

Instructions for - Spybot S & D and Ad-aware

 

10. Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

 

 

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

Share this post


Link to post
Share on other sites

yes thank you very much for all of the help i appreciate it all very much i have been coming to you guys for a few years now and have been always satisfied with the work and help

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.
Sign in to follow this  

×
×
  • Create New...