Jump to content

jouster

Member
  • Content Count

    17
  • Joined

  • Last visited

About jouster

  • Rank
    Lunar Novice

Personal Information

  • Country
    United States
  • OS
    XP Home
  1. jouster

    jouster Computer 1 - Log 01

    I might have a problem left and not sure if it wasn't something removed by the cleanup or not. When I try to add a printer I get an error that the print spooler service is not running. Any ideas how to resolve this?
  2. jouster

    jouster Computer 1 - Log 01

    Must be reading my mind-already there and doing that! Keep up the good work!
  3. jouster

    jouster Computer 2 - Log 01

    System seems to be operating much better, thanks again for all your help! I think the only problem left is the age of the comp (Compaq 5000 series 750MHz AMD Duron originally loaded with ME) Again you were awesome to work with and probly saved me from formatting
  4. jouster

    jouster Computer 1 - Log 01

    Deleted the files using HJT. Thanks for the help cleaning up! You've been awesome to work with. Comp 1 seems to be running alot better after some very much need maintenance. You and the lunarsoft team are an excellent resource and will be highly recommended!
  5. jouster

    jouster Computer 1 - Log 01

    Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:57:58 AM, on 7/20/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Wave Systems Corp\Common\DataServer.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\msiexec.exe C:\Program Files\Common Files\NeatReceipts\DB Controller\NeatReceiptsDBController.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe C:\WINDOWS\system32\fxssvc.exe C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe C:\Program Files\Microsoft Windows OneCare Live\winss.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\stsystra.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Apoint\HidFind.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\mozilla.org\SeaMonkey\seamonkey.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Windows Live\Contacts\wlcomm.exe C:\Documents and Settings\slarsen\Desktop\Download\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=2070604 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe O4 - HKLM\..\Run: [sigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [Nitro PDF Printer Monitor] "C:\Program Files\Nitro PDF\Professional\NitroPDFPrinterMonitor.exe" O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab O16 - DPF: {4FAE30E1-EE9C-477D-8D06-BF8D3429B60F} (WebIQ Technology Client) - http://webiq001.webiqonline.com/WebIQ/bin/WebIQ.cab O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://sirjousterhrk.spaces.live.com/PhotoUpload/MsnPUpld.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NeatReceipts Database Controller - Digital Business Processes - C:\Program Files\Common Files\NeatReceipts\DB Controller\NeatReceiptsDBController.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: OneTouch 4.0 Monitor - Visioneer Inc. - C:\Program Files\Visioneer\OneTouch 4.0\OtService.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Performance Logs and Alerts (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe O23 - Service: NTRU Hybrid TSS v2.0.25 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 11845 bytes
  6. jouster

    jouster Computer 2 - Log 01

    I also ran full scans with MBAM and SuperAntiSpyware on this comp. Here are the logs from those: Malwarebytes' Anti-Malware 1.39 Database version: 2464 Windows 5.1.2600 Service Pack 3 7/20/2009 1:09:06 AM mbam-log-2009-07-20 (01-09-06).txt Scan type: Full Scan (C:\|) Objects scanned: 192911 Time elapsed: 2 hour(s), 6 minute(s), 26 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\program files\DivX\divx converter\pS2Xx.ddc (Backdoor.Bot) -> Quarantined and deleted successfully. c:\program files\DivX\divx player\pS2Xx.ddc (Backdoor.Bot) -> Quarantined and deleted successfully. _____________________________________________________________________________________________________ SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 07/20/2009 at 09:02 AM Application Version : 4.26.1006 Core Rules Database Version : 3952 Trace Rules Database Version: 1943 Scan type : Complete Scan Total Scan Time : 01:35:30 Memory items scanned : 461 Memory threats detected : 0 Registry items scanned : 5031 Registry threats detected : 0 File items scanned : 21939 File threats detected : 2 Adware.Tracking Cookie C:\Documents and Settings\James Larsen\Cookies\james_larsen@atdmt[2].txt C:\Documents and Settings\LocalService\Cookies\system@atdmt[2].txt __________________________________________________________________________________________________________________ Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:32:40 AM, on 7/20/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Microsoft Windows OneCare Live\winss.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\James Larsen\Desktop\Download\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [QuickCare2.2] C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe /P QuickCare2.2 O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\RunOnce: [NSSInstallation] C:\WINDOWS\system32\Adobe\Shockwave 11\nssstub.exe /RunOnce O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Qwest Live - {6370284D-00DB-470F-B689-7CEF8CFB8A3A} - http://qwest.live.com (file missing) (HKCU) O16 - DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Installer) - https://ra.qwest.com/sdccommon/download/tgctlins.cab O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {1E3F1348-4370-4BBE-A67A-CC7ED824CA85} (Microsoft Genuine Advantage Self Support Tool) - http://go.microsoft.com/fwlink/?LinkId=82580 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: SupportSoft Listener Service (sprtlisten) - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\sprtlisten.exe O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe -- End of file - 7616 bytes ___________________________________________________________________________________________________________________ Also OneCare is finding a trojan. Here is the OneCare log for the last 24 hrs: 7/20/2009 8:11 AM Windows Live OneCare found potentially harmful or unwanted software on your computer Threat Name: Trojan:Win32/FakeSpypro Detection Date and Time: 7/20/2009 8:07 AM File Name: C:\System Volume Information\_restore{D9169744-9BED-4586-8250-6269661F2E09}\RP301\A0155579.exe Threat Severity: High Threat Category: Trojan Virus and spyware monitoring found potentially unwanted software: (ANTIVIRUS_ONACCESS) Threat Status: Removed 7/20/2009 8:11 AM Windows Live OneCare found potentially harmful or unwanted software on your computer Threat Name: Trojan:Win32/FakeSpypro Detection Date and Time: 7/20/2009 8:07 AM File Name: C:\System Volume Information\_restore{D9169744-9BED-4586-8250-6269661F2E09}\RP301\A0155580.exe Threat Severity: High Threat Category: Trojan Virus and spyware monitoring found potentially unwanted software: (ANTIVIRUS_ONACCESS) Threat Status: Removed 7/20/2009 8:06 AM Windows Live OneCare found potentially harmful or unwanted software on your computer Threat Name: Trojan:Win32/FakeSpypro Detection Date and Time: 7/20/2009 8:06 AM File Name: C:\System Volume Information\_restore{D9169744-9BED-4586-8250-6269661F2E09}\RP301\A0155580.exe Threat Severity: High Threat Category: Trojan Virus and spyware monitoring found potentially unwanted software: (ANTIVIRUS_ONACCESS_INFECTED) Threat Status: Detected 7/20/2009 8:06 AM Windows Live OneCare found potentially harmful or unwanted software on your computer Threat Name: Trojan:Win32/FakeSpypro Detection Date and Time: 7/20/2009 8:06 AM File Name: C:\System Volume Information\_restore{D9169744-9BED-4586-8250-6269661F2E09}\RP301\A0155579.exe Threat Severity: High Threat Category: Trojan Virus and spyware monitoring found potentially unwanted software: (ANTIVIRUS_ONACCESS_INFECTED) Threat Status: Detected 7/20/2009 2:05 AM Virus and spyware scan was completed Scanned Items: - Scan Type: Custom Scan Scan StartTime: 7/20/2009 1:24 AM Scan EndTime: 7/20/2009 2:05 AM Total Number of Files Scanned: 95470 Total Number of Files Not Scanned: 0 Total Number of Threats Found: 0 Total Number of Threats Cleaned: 0 Total Number of Threats Removed: 0 Total Number of Threats Quarantined: 0 Total Number of Threats Still Present But Suspended: 0 7/20/2009 12:08 AM Windows Live OneCare found potentially harmful or unwanted software on your computer Threat Name: Trojan:Win32/FakeSpypro Detection Date and Time: 7/20/2009 12:08 AM File Name: C:\System Volume Information\_restore{D9169744-9BED-4586-8250-6269661F2E09}\RP301\A0155580.exe Threat Severity: High Threat Category: Trojan Virus and spyware monitoring found potentially unwanted software: (ANTIVIRUS_ONACCESS_INFECTED) Threat Status: Detected 7/20/2009 12:08 AM Windows Live OneCare found potentially harmful or unwanted software on your computer Threat Name: Trojan:Win32/FakeSpypro Detection Date and Time: 7/20/2009 12:08 AM File Name: C:\System Volume Information\_restore{D9169744-9BED-4586-8250-6269661F2E09}\RP301\A0155579.exe Threat Severity: High Threat Category: Trojan Virus and spyware monitoring found potentially unwanted software: (ANTIVIRUS_ONACCESS_INFECTED) Threat Status: Detected 7/19/2009 10:52 PM Virus and spyware monitoring was turned on 7/19/2009 9:38 PM Successfully updated signatures from: AV Delta:(1.61.1867.0), AV Base:(1.61.0.0), AS Delta:(1.61.1867.0), AS Base:(1.61.0.0), AM Engine:(1.1.4803.0) to: AV Delta:(1.61.1908.0), AV Base:(1.61.0.0), AS Delta:(1.61.1908.0), AS Base:(1.61.0.0), AM Engine:(1.1.4803.0) 7/19/2009 9:38 PM 7/19/2009 6:53 PM Virus and spyware monitoring was turned off 7/18/2009 9:36 PM Virus and spyware monitoring was turned on 7/18/2009 3:44 PM Successfully updated signatures from: AV Delta:(1.61.1700.0), AV Base:(1.61.0.0), AS Delta:(1.61.1700.0), AS Base:(1.61.0.0), AM Engine:(1.1.4803.0) to: AV Delta:(1.61.1867.0), AV Base:(1.61.0.0), AS Delta:(1.61.1867.0), AS Base:(1.61.0.0), AM Engine:(1.1.4803.0) 7/18/2009 3:44 PM
  7. jouster

    Firefox vs SeaMonkey

    Both available from Mozilla, is one better than the other (ie performance, security)?
  8. jouster

    jouster Computer 1 - Log 01

    MBAM did not find any infections, SuperAntiSpyware found 4. SuperAntiSpyware log: SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 07/20/2009 at 00:23 AM Application Version : 4.26.1006 Core Rules Database Version : 3952 Trace Rules Database Version: 1943 Scan type : Complete Scan Total Scan Time : 00:44:36 Memory items scanned : 585 Memory threats detected : 0 Registry items scanned : 7806 Registry threats detected : 0 File items scanned : 30824 File threats detected : 4 Adware.Tracking Cookie C:\Documents and Settings\slarsen\Cookies\slarsen@atdmt[2].txt C:\Documents and Settings\slarsen\Cookies\slarsen@2o7[2].txt .msnportal.112.2o7.net [ C:\Documents and Settings\slarsen\Application Data\Mozilla\Profiles\default\8vzz6t46.slt\cookies.txt ] .atdmt.com [ C:\Documents and Settings\slarsen\Application Data\Mozilla\Profiles\default\8vzz6t46.slt\cookies.txt ]
  9. jouster

    jouster Computer 2 - Log 01

    Here is the Combofix log file using the CFScript: ComboFix 09-07-19.04 - James Larsen 07/19/2009 22:11.3.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.512.166 [GMT -7:00] Running from: c:\documents and settings\James Larsen\My Documents\Downloads\ComboFix.exe Command switches used :: c:\documents and settings\James Larsen\Desktop\CFScript.txt AV: Windows Live OneCare *On-access scanning disabled* (Updated) {427ADFC3-B354-4A51-BE34-A9D4218E45C4} FW: Windows Live OneCare Firewall *enabled* {A3899D22-27E6-4A7E-AE4E-2C106646DAAB} . ((((((((((((((((((((((((( Files Created from 2009-06-20 to 2009-07-20 ))))))))))))))))))))))))))))))) . 2009-07-19 06:16 . 2009-07-19 18:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-07-19 06:16 . 2009-07-19 06:21 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-07-19 05:12 . 2009-07-19 05:13 117760 ----a-w- c:\documents and settings\James Larsen\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2009-07-19 05:12 . 2009-07-19 05:12 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-07-19 05:12 . 2009-07-19 05:12 -------- d-----w- c:\program files\SUPERAntiSpyware 2009-07-19 05:12 . 2009-07-19 05:12 -------- d-----w- c:\documents and settings\James Larsen\Application Data\SUPERAntiSpyware.com 2009-07-19 04:40 . 2009-07-19 04:40 -------- d-----w- c:\documents and settings\James Larsen\Application Data\Malwarebytes 2009-07-19 04:40 . 2009-07-13 20:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-07-19 04:40 . 2009-07-19 04:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-07-19 04:40 . 2009-07-13 20:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-07-19 04:40 . 2009-07-19 04:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-07-19 04:21 . 2009-07-19 04:34 -------- d-----w- c:\program files\CCleaner 2009-07-19 04:16 . 2009-07-19 04:16 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP 2009-07-19 04:15 . 2005-08-26 02:18 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL 2009-07-19 04:14 . 2009-07-19 04:18 -------- d-----w- c:\program files\SpywareBlaster 2009-07-19 04:02 . 2009-07-19 04:02 -------- d-----w- c:\documents and settings\James Larsen\Local Settings\Application Data\Lunarsoft 2009-07-19 04:02 . 2009-07-19 04:02 -------- d-----w- c:\program files\Lunarsoft 2009-07-19 01:56 . 2009-07-19 01:56 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles 2009-07-18 23:43 . 2009-07-18 23:44 -------- d-----w- c:\documents and settings\James Larsen\Local Settings\Application Data\Qwest 2009-07-18 23:43 . 2009-07-18 23:43 -------- d-----w- c:\program files\Qwest Personal Digital Vault 2009-07-18 22:47 . 2009-07-18 22:47 -------- d-sh--w- c:\documents and settings\James Larsen\PrivacIE 2009-07-17 16:27 . 2009-07-17 16:27 -------- d-sh--w- c:\documents and settings\Jaedyn\IETldCache 2009-07-16 19:42 . 2009-07-16 19:42 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-07-16 19:39 . 2009-07-16 19:39 -------- d-sh--w- c:\documents and settings\James Larsen\IETldCache 2009-07-16 19:11 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-07-16 19:10 . 2009-07-16 19:11 -------- d-----w- c:\windows\ie8updates 2009-07-16 19:09 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-07-16 19:09 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-07-16 19:05 . 2009-07-16 19:08 -------- dc-h--w- c:\windows\ie8 2009-07-02 17:36 . 2009-07-02 17:42 -------- d-----w- c:\documents and settings\James Larsen\Local Settings\Application Data\Thunderbird 2009-07-02 17:36 . 2009-07-02 17:37 -------- d-----w- c:\documents and settings\James Larsen\Application Data\Thunderbird 2009-07-02 17:36 . 2009-07-19 21:49 -------- d-----w- c:\program files\Mozilla Thunderbird 2009-07-02 14:00 . 2009-07-02 13:58 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-07-02 13:53 . 2009-07-02 13:53 152576 ----a-w- c:\documents and settings\James Larsen\Application Data\Sun\Java\jre1.6.0_13\lzma.dll 2009-06-25 13:40 . 2009-06-25 13:40 -------- d-----w- c:\documents and settings\James Larsen\.GalleryRemote . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-20 04:38 . 2009-01-15 01:55 -------- d-----w- c:\program files\Microsoft Windows OneCare Live 2009-07-20 04:33 . 2008-05-09 01:32 -------- d-----w- c:\program files\Google 2009-07-19 21:59 . 2008-03-12 02:18 -------- d-----w- c:\program files\Valu-Soft 2009-07-19 21:54 . 2008-05-04 04:39 -------- d-----w- c:\program files\Yahoo! 2009-07-19 05:10 . 2008-02-21 07:41 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-07-19 04:31 . 2008-02-06 20:15 -------- d-----w- c:\documents and settings\James Larsen\Application Data\Azureus 2009-07-18 22:39 . 2008-02-21 05:41 -------- d-----w- c:\documents and settings\James Larsen\Application Data\Hamachi 2009-07-18 22:25 . 2009-01-15 01:10 -------- d-----w- c:\program files\Qwest 2009-07-16 18:59 . 2009-01-17 23:36 -------- d-----w- c:\documents and settings\James Larsen\Application Data\HPAppData 2009-07-03 17:33 . 2008-05-03 16:04 -------- d-----w- c:\documents and settings\James Larsen\Application Data\LimeWire 2009-07-02 13:58 . 2008-01-25 05:20 -------- d-----w- c:\program files\Java 2009-06-29 18:22 . 2009-02-20 16:22 1 ----a-w- c:\documents and settings\James Larsen\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2009-06-16 14:36 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-06-16 14:36 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-06-03 19:09 . 2004-08-04 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll 2009-06-02 01:45 . 2008-03-05 21:38 2404 ----a-w- c:\windows\system32\d3d9caps.dat 2009-05-31 04:57 . 2008-01-24 05:36 2180 ----a-w- c:\windows\system32\d3d8caps.dat 2009-05-28 04:09 . 2009-05-28 03:49 -------- d-----w- c:\program files\Sony Online Entertainment 2009-05-13 05:15 . 2004-08-04 12:00 915456 ----a-w- c:\windows\system32\wininet.dll 2009-05-07 15:32 . 2004-08-04 12:00 345600 ----a-w- c:\windows\system32\localspl.dll 2009-05-07 00:24 . 2009-01-24 15:30 69352 ----a-w- c:\documents and settings\Jaedyn\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-04-30 15:05 . 2009-07-16 18:43 69352 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-04-30 15:05 . 2009-01-24 03:08 69352 ----a-w- c:\documents and settings\Default User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-07-20 04:38 . 2009-01-23 16:05 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ((((((((((((((((((((((((((((( SnapShot@2009-07-20_02.31.51 ))))))))))))))))))))))))))))))))))))))))) . + 2009-07-20 05:25 . 2009-07-20 05:25 16384 c:\windows\Temp\Perflib_Perfdata_5f0.dat + 2009-07-20 05:28 . 2009-07-20 05:28 16384 c:\windows\Temp\Perflib_Perfdata_164.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-07 3885408] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-25 5898240] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-02 148888] "QuickCare2.2"="c:\program files\Qwest\QuickCare\bin\sprtcmd.exe" [2007-05-04 198184] "OneCareUI"="c:\program files\Microsoft Windows OneCare Live\winssnotify.exe" [2009-03-22 63864] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-25 86016] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-07-25 1519616] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "NSSInstallation"="c:\windows\system32\Adobe\Shockwave 11\nssstub.exe" [2009-03-04 181624] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 19:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^James Larsen^Start Menu^Programs^Startup^hamachi.lnk] path=c:\documents and settings\James Larsen\Start Menu\Programs\Startup\hamachi.lnk backup=c:\windows\pss\hamachi.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^James Larsen^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk] path=c:\documents and settings\James Larsen\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Xfire\\xfire.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Warcraft III\\War3.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\World of Warcraft\\WoW-2.3.0-enUS-downloader.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Qwest\\QuickConnect\\QuickConnect.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 "57352:TCP"= 57352:TCP:Pando Media Booster "57352:UDP"= 57352:UDP:Pando Media Booster R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [6/23/2009 11:01 AM 9968] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [6/23/2009 11:01 AM 72944] R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [4/11/2009 1:28 PM 55152] R2 OcHealthMon;Windows Live OneCare Health Monitor;c:\program files\Microsoft Windows OneCare Live\OcHealthMon.exe [3/22/2009 10:59 AM 24936] R2 sprtlisten;SupportSoft Listener Service;c:\program files\Common Files\supportsoft\bin\sprtlisten.exe [8/12/2008 2:53 PM 1213728] R3 PCnetHL;AMD PCnet-Home Adapter Driver;c:\windows\system32\drivers\pcntn5hl.sys [2/20/2008 1:53 PM 30282] R3 SMC1211;SMC EZ Card 10/100 PCI (SMC1211 Series) NT 5.0 Driver;c:\windows\system32\drivers\SMC1211.sys [7/11/2001 12:06 PM 23153] S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2/6/2009 6:08 PM 533360] S3 Gcr432;Gcr432;c:\windows\system32\drivers\gcr432.sys [10/4/2001 4:18 PM 53701] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 PciCon;PciCon;\??\d:\pcicon.sys --> d:\PciCon.sys [?] S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [6/23/2009 11:01 AM 7408] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc HPService REG_MULTI_SZ HPSLPSVC [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-07-20 c:\windows\Tasks\NSSstub.job - c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2009-03-04 04:12] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uInternet Connection Wizard,ShellNext = iexplore uSearchURL,(Default) = hxxp://www.google.com/keyword/%s IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} - hxxps://ra.qwest.com/sdccommon/download/tgctlins.cab FF - ProfilePath - c:\documents and settings\James Larsen\Application Data\Mozilla\Firefox\Profiles\8xo1ljg5.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.search.selectedEngine - Google FF - plugin: c:\progra~1\SONYON~1\npsoe.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-19 22:27 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(548) c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\windows\system32\WININET.dll - - - - - - - > 'explorer.exe'(2028) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\nvsvc32.exe c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\program files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe c:\program files\Microsoft Windows OneCare Live\winss.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2009-07-20 22:34 - machine was rebooted ComboFix-quarantined-files.txt 2009-07-20 05:34 ComboFix2.txt 2009-07-20 05:01 ComboFix3.txt 2009-07-20 02:45 Pre-Run: 2,887,442,432 bytes free Post-Run: 2,866,663,424 bytes free 268 --- E O F --- 2009-07-16 18:22
  10. jouster

    jouster Computer 2 - Log 01

    Here is the combofix log for comp 2, this was run without the CFScript: ComboFix 09-07-19.04 - James Larsen 07/19/2009 21:43.2.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.512.109 [GMT -7:00] Running from: c:\documents and settings\James Larsen\My Documents\Downloads\ComboFix.exe AV: Windows Live OneCare *On-access scanning disabled* (Updated) {427ADFC3-B354-4A51-BE34-A9D4218E45C4} FW: Windows Live OneCare Firewall *enabled* {A3899D22-27E6-4A7E-AE4E-2C106646DAAB} . ((((((((((((((((((((((((( Files Created from 2009-06-20 to 2009-07-20 ))))))))))))))))))))))))))))))) . 2009-07-19 06:16 . 2009-07-19 18:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-07-19 06:16 . 2009-07-19 06:21 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-07-19 05:12 . 2009-07-19 05:13 117760 ----a-w- c:\documents and settings\James Larsen\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2009-07-19 05:12 . 2009-07-19 05:12 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-07-19 05:12 . 2009-07-19 05:12 -------- d-----w- c:\program files\SUPERAntiSpyware 2009-07-19 05:12 . 2009-07-19 05:12 -------- d-----w- c:\documents and settings\James Larsen\Application Data\SUPERAntiSpyware.com 2009-07-19 04:40 . 2009-07-19 04:40 -------- d-----w- c:\documents and settings\James Larsen\Application Data\Malwarebytes 2009-07-19 04:40 . 2009-07-13 20:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-07-19 04:40 . 2009-07-19 04:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-07-19 04:40 . 2009-07-13 20:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-07-19 04:40 . 2009-07-19 04:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-07-19 04:21 . 2009-07-19 04:34 -------- d-----w- c:\program files\CCleaner 2009-07-19 04:16 . 2009-07-19 04:16 -------- d-----w- c:\documents and settings\All Users\Application Data\TEMP 2009-07-19 04:15 . 2005-08-26 02:18 118784 ----a-w- c:\windows\system32\MSSTDFMT.DLL 2009-07-19 04:14 . 2009-07-19 04:18 -------- d-----w- c:\program files\SpywareBlaster 2009-07-19 04:02 . 2009-07-19 04:02 -------- d-----w- c:\documents and settings\James Larsen\Local Settings\Application Data\Lunarsoft 2009-07-19 04:02 . 2009-07-19 04:02 -------- d-----w- c:\program files\Lunarsoft 2009-07-19 01:56 . 2009-07-19 01:56 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles 2009-07-18 23:43 . 2009-07-18 23:44 -------- d-----w- c:\documents and settings\James Larsen\Local Settings\Application Data\Qwest 2009-07-18 23:43 . 2009-07-18 23:43 -------- d-----w- c:\program files\Qwest Personal Digital Vault 2009-07-18 22:47 . 2009-07-18 22:47 -------- d-sh--w- c:\documents and settings\James Larsen\PrivacIE 2009-07-17 16:27 . 2009-07-17 16:27 -------- d-sh--w- c:\documents and settings\Jaedyn\IETldCache 2009-07-16 19:42 . 2009-07-16 19:42 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-07-16 19:39 . 2009-07-16 19:39 -------- d-sh--w- c:\documents and settings\James Larsen\IETldCache 2009-07-16 19:11 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll 2009-07-16 19:10 . 2009-07-16 19:11 -------- d-----w- c:\windows\ie8updates 2009-07-16 19:09 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll 2009-07-16 19:09 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll 2009-07-16 19:05 . 2009-07-16 19:08 -------- dc-h--w- c:\windows\ie8 2009-07-02 17:36 . 2009-07-02 17:42 -------- d-----w- c:\documents and settings\James Larsen\Local Settings\Application Data\Thunderbird 2009-07-02 17:36 . 2009-07-02 17:37 -------- d-----w- c:\documents and settings\James Larsen\Application Data\Thunderbird 2009-07-02 17:36 . 2009-07-19 21:49 -------- d-----w- c:\program files\Mozilla Thunderbird 2009-07-02 14:00 . 2009-07-02 13:58 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-07-02 13:53 . 2009-07-02 13:53 152576 ----a-w- c:\documents and settings\James Larsen\Application Data\Sun\Java\jre1.6.0_13\lzma.dll 2009-06-25 13:40 . 2009-06-25 13:40 -------- d-----w- c:\documents and settings\James Larsen\.GalleryRemote . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-20 04:38 . 2009-01-15 01:55 -------- d-----w- c:\program files\Microsoft Windows OneCare Live 2009-07-20 04:33 . 2008-05-09 01:32 -------- d-----w- c:\program files\Google 2009-07-19 21:59 . 2008-03-12 02:18 -------- d-----w- c:\program files\Valu-Soft 2009-07-19 21:54 . 2008-05-04 04:39 -------- d-----w- c:\program files\Yahoo! 2009-07-19 05:10 . 2008-02-21 07:41 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-07-19 04:31 . 2008-02-06 20:15 -------- d-----w- c:\documents and settings\James Larsen\Application Data\Azureus 2009-07-18 22:39 . 2008-02-21 05:41 -------- d-----w- c:\documents and settings\James Larsen\Application Data\Hamachi 2009-07-18 22:25 . 2009-01-15 01:10 -------- d-----w- c:\program files\Qwest 2009-07-16 18:59 . 2009-01-17 23:36 -------- d-----w- c:\documents and settings\James Larsen\Application Data\HPAppData 2009-07-03 17:33 . 2008-05-03 16:04 -------- d-----w- c:\documents and settings\James Larsen\Application Data\LimeWire 2009-07-02 13:58 . 2008-01-25 05:20 -------- d-----w- c:\program files\Java 2009-06-29 18:22 . 2009-02-20 16:22 1 ----a-w- c:\documents and settings\James Larsen\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2009-06-16 14:36 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-06-16 14:36 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-06-03 19:09 . 2004-08-04 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll 2009-06-02 01:45 . 2008-03-05 21:38 2404 ----a-w- c:\windows\system32\d3d9caps.dat 2009-05-31 04:57 . 2008-01-24 05:36 2180 ----a-w- c:\windows\system32\d3d8caps.dat 2009-05-28 04:09 . 2009-05-28 03:49 -------- d-----w- c:\program files\Sony Online Entertainment 2009-05-13 05:15 . 2004-08-04 12:00 915456 ----a-w- c:\windows\system32\wininet.dll 2009-05-07 15:32 . 2004-08-04 12:00 345600 ----a-w- c:\windows\system32\localspl.dll 2009-05-07 00:24 . 2009-01-24 15:30 69352 ----a-w- c:\documents and settings\Jaedyn\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-04-30 15:05 . 2009-07-16 18:43 69352 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-04-30 15:05 . 2009-01-24 03:08 69352 ----a-w- c:\documents and settings\Default User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-07-20 04:38 . 2009-01-23 16:05 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll . ((((((((((((((((((((((((((((( SnapShot@2009-07-20_02.31.51 ))))))))))))))))))))))))))))))))))))))))) . + 2009-07-20 04:34 . 2009-07-20 04:34 16384 c:\windows\Temp\Perflib_Perfdata_9c.dat + 2009-07-20 04:37 . 2009-07-20 04:37 16384 c:\windows\Temp\Perflib_Perfdata_61c.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-07 3885408] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-07-25 5898240] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-02 148888] "QuickCare2.2"="c:\program files\Qwest\QuickCare\bin\sprtcmd.exe" [2007-05-04 198184] "OneCareUI"="c:\program files\Microsoft Windows OneCare Live\winssnotify.exe" [2009-03-22 63864] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-07-25 86016] "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-07-25 1519616] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "NSSInstallation"="c:\windows\system32\Adobe\Shockwave 11\nssstub.exe" [2009-03-04 181624] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 19:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^James Larsen^Start Menu^Programs^Startup^hamachi.lnk] path=c:\documents and settings\James Larsen\Start Menu\Programs\Startup\hamachi.lnk backup=c:\windows\pss\hamachi.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^James Larsen^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk] path=c:\documents and settings\James Larsen\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk backup=c:\windows\pss\OpenOffice.org 3.0.lnkStartup [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Xfire\\xfire.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Warcraft III\\War3.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\World of Warcraft\\WoW-2.3.0-enUS-downloader.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Qwest\\QuickConnect\\QuickConnect.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 "57352:TCP"= 57352:TCP:Pando Media Booster "57352:UDP"= 57352:UDP:Pando Media Booster R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [6/23/2009 11:01 AM 9968] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [6/23/2009 11:01 AM 72944] R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [4/11/2009 1:28 PM 55152] R2 OcHealthMon;Windows Live OneCare Health Monitor;c:\program files\Microsoft Windows OneCare Live\OcHealthMon.exe [3/22/2009 10:59 AM 24936] R2 sprtlisten;SupportSoft Listener Service;c:\program files\Common Files\supportsoft\bin\sprtlisten.exe [8/12/2008 2:53 PM 1213728] R3 PCnetHL;AMD PCnet-Home Adapter Driver;c:\windows\system32\drivers\pcntn5hl.sys [2/20/2008 1:53 PM 30282] R3 SMC1211;SMC EZ Card 10/100 PCI (SMC1211 Series) NT 5.0 Driver;c:\windows\system32\drivers\SMC1211.sys [7/11/2001 12:06 PM 23153] S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [2/6/2009 6:08 PM 533360] S3 Gcr432;Gcr432;c:\windows\system32\drivers\gcr432.sys [10/4/2001 4:18 PM 53701] S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?] S3 PciCon;PciCon;\??\d:\pcicon.sys --> d:\PciCon.sys [?] S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [6/23/2009 11:01 AM 7408] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc HPService REG_MULTI_SZ HPSLPSVC [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-07-20 c:\windows\Tasks\NSSstub.job - c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2009-03-04 04:12] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com/ uInternet Connection Wizard,ShellNext = iexplore uSearchURL,(Default) = hxxp://www.google.com/keyword/%s IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} - hxxps://ra.qwest.com/sdccommon/download/tgctlins.cab FF - ProfilePath - c:\documents and settings\James Larsen\Application Data\Mozilla\Firefox\Profiles\8xo1ljg5.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.search.selectedEngine - Google FF - plugin: c:\progra~1\SONYON~1\npsoe.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-19 21:55 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc] "ImagePath"="c:\windows\system32\GameMon.des -service" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(544) c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\windows\system32\WININET.dll - - - - - - - > 'explorer.exe'(2356) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . Completion time: 2009-07-20 22:01 ComboFix-quarantined-files.txt 2009-07-20 05:01 ComboFix2.txt 2009-07-20 02:45 Pre-Run: 2,890,584,064 bytes free Post-Run: 2,846,138,368 bytes free 252 --- E O F --- 2009-07-16 18:22
  11. jouster

    jouster Computer 1 - Log 01

    Ok, I've ran the norton removal tool and the avg removal tool and then ran the combofix with the CFScript. Combofix ran as before but did not open a message box with the log. Here is the latest combofix log initiated with the CFScript: ComboFix 09-07-19.04 - slarsen 07/19/2009 21:33.5.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.389 [GMT -7:00] Running from: c:\documents and settings\slarsen\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\slarsen\Desktop\CFScript.txt AV: Windows Live OneCare *On-access scanning disabled* (Updated) {427ADFC3-B354-4A51-BE34-A9D4218E45C4} FW: Windows Live OneCare Firewall *enabled* {A3899D22-27E6-4A7E-AE4E-2C106646DAAB} . ((((((((((((((((((((((((( Files Created from 2009-06-20 to 2009-07-20 ))))))))))))))))))))))))))))))) . 2009-07-20 02:32 . 2009-07-20 02:32 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller 2009-07-19 16:42 . 2009-07-19 16:42 118784 ----a-w- c:\windows\SeaMonkeyUninstall.exe 2009-07-19 16:42 . 2009-07-19 16:42 118784 ----a-w- c:\windows\GREUninstall.exe 2009-07-19 16:41 . 2009-07-19 16:41 -------- d-----w- c:\program files\mozilla.org 2009-07-19 05:12 . 2009-07-19 05:12 117760 ----a-w- c:\documents and settings\slarsen\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2009-07-19 05:11 . 2009-07-19 05:11 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-07-19 05:11 . 2009-07-19 05:11 -------- d-----w- c:\program files\SUPERAntiSpyware 2009-07-19 05:11 . 2009-07-19 05:11 -------- d-----w- c:\documents and settings\slarsen\Application Data\SUPERAntiSpyware.com 2009-07-19 05:10 . 2009-07-19 05:10 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-07-19 04:52 . 2009-07-19 04:52 -------- d-----w- c:\documents and settings\slarsen\Application Data\Malwarebytes 2009-07-19 04:52 . 2009-07-13 20:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-07-19 04:52 . 2009-07-13 20:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-07-19 04:50 . 2009-07-19 04:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-07-19 04:50 . 2009-07-19 04:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-07-19 04:42 . 2009-07-19 04:47 -------- d-----w- c:\program files\CCleaner 2009-07-19 04:27 . 2009-07-19 04:31 -------- d-----w- c:\program files\SpywareBlaster 2009-07-19 04:09 . 2009-07-19 04:09 -------- d-----w- c:\program files\Lunarsoft 2009-07-19 04:09 . 2009-07-19 04:09 -------- d-----w- c:\documents and settings\slarsen\Local Settings\Application Data\Lunarsoft 2009-07-19 02:17 . 2009-07-19 02:17 -------- d-----w- C:\5534306ab07c14292b3f4ffb74ad 2009-07-19 02:08 . 2009-07-19 02:08 -------- d-----w- c:\windows\ie8updates 2009-07-19 00:35 . 2009-07-19 00:35 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2009-07-19 00:02 . 2009-07-19 00:02 -------- d-----w- c:\windows\system32\scripting 2009-07-19 00:02 . 2009-07-19 00:02 -------- d-----w- c:\windows\l2schemas 2009-07-19 00:02 . 2009-07-19 00:02 -------- d-----w- c:\windows\system32\en 2009-07-19 00:01 . 2009-07-19 00:01 5263 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch6\HTML\item_templ\common\fixes\austart.dll 2009-07-19 00:01 . 2009-07-19 00:01 179855 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch6\HTML\item_templ\common\fixes\auinterface.dll 2009-07-18 23:53 . 2009-07-18 23:53 -------- d-----w- c:\windows\ServicePackFiles 2009-07-18 23:33 . 2009-04-30 21:22 12800 ------w- c:\windows\system32\dllcache\xpshims.dll 2009-07-18 23:33 . 2009-04-30 21:22 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll 2009-07-18 23:29 . 2004-08-04 06:41 13776 ------w- c:\windows\system32\drivers\recagent.sys 2009-07-18 23:28 . 2008-04-14 00:11 37376 ------w- c:\windows\system32\l2gpstore.dll 2009-07-18 23:27 . 2008-04-14 00:11 59392 ------w- c:\windows\system32\eapqec.dll 2009-07-18 23:25 . 2009-03-06 14:22 284160 ------w- c:\windows\system32\dllcache\pdh.dll 2009-07-18 23:25 . 2009-02-09 12:10 401408 ------w- c:\windows\system32\dllcache\rpcss.dll 2009-07-18 23:25 . 2009-02-06 10:39 35328 ------w- c:\windows\system32\dllcache\sc.exe 2009-07-18 23:25 . 2009-02-09 12:10 473600 ------w- c:\windows\system32\dllcache\fastprox.dll 2009-07-18 23:25 . 2009-02-09 12:10 453120 ------w- c:\windows\system32\dllcache\wmiprvsd.dll 2009-07-18 23:25 . 2009-02-06 11:11 110592 ------w- c:\windows\system32\dllcache\services.exe 2009-07-18 23:25 . 2009-02-06 10:10 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe 2009-07-18 23:25 . 2009-02-09 12:10 729088 ------w- c:\windows\system32\dllcache\lsasrv.dll 2009-07-18 23:25 . 2009-02-09 12:10 617472 ------w- c:\windows\system32\dllcache\advapi32.dll 2009-07-18 23:25 . 2009-02-09 12:10 714752 ------w- c:\windows\system32\dllcache\ntdll.dll 2009-07-18 23:23 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll 2009-07-18 23:23 . 2008-04-21 12:08 215552 ------w- c:\windows\system32\dllcache\wordpad.exe 2009-07-16 23:25 . 2009-07-20 02:12 -------- d-----w- c:\documents and settings\slarsen\Tracing 2009-07-16 23:17 . 2009-07-16 23:17 -------- d-----w- c:\program files\Microsoft Sync Framework 2009-07-16 23:15 . 2009-07-16 23:15 -------- d-----w- c:\program files\Microsoft 2009-07-16 23:15 . 2009-07-16 23:15 -------- d-----w- c:\program files\Windows Live SkyDrive 2009-07-16 23:03 . 2009-07-16 23:03 -------- d-----w- c:\program files\Common Files\Windows Live 2009-07-16 22:50 . 2009-07-16 22:50 -------- d-sh--w- c:\documents and settings\slarsen\PrivacIE 2009-07-16 22:50 . 2009-07-16 22:50 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-07-16 22:48 . 2009-07-16 22:48 -------- d-sh--w- c:\documents and settings\slarsen\IETldCache 2009-07-16 22:39 . 2009-07-16 22:42 -------- dc-h--w- c:\windows\ie8 2009-07-16 18:03 . 2009-07-16 18:03 23720 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupport_TestContent.dll 2009-07-16 18:03 . 2009-07-16 18:03 221208 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupportCommon.dll 2009-07-16 18:03 . 2009-07-16 18:03 110248 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupportInterface.dll 2009-07-16 18:03 . 2009-07-16 18:03 23056 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix101001.dll 2009-07-16 18:03 . 2009-07-16 18:03 29352 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix058456.dll 2009-07-16 18:03 . 2009-07-16 18:03 21160 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix056479.dll 2009-07-16 17:55 . 2007-11-28 05:56 91328 ----a-w- c:\windows\system32\drivers\msfwdrv.sys 2009-07-16 17:55 . 2007-11-28 05:56 116416 ----a-w- c:\windows\system32\drivers\msfwhlpr.sys 2009-07-16 17:54 . 2008-05-15 23:15 53168 ----a-w- c:\windows\system32\drivers\MpFilter.sys 2009-07-16 17:47 . 2009-07-20 04:45 -------- d-----w- c:\program files\Microsoft Windows OneCare Live 2009-07-16 15:10 . 2009-07-19 00:02 -------- d-----w- c:\windows\system32\bits 2009-07-16 15:10 . 2008-04-14 00:11 7168 ------w- c:\windows\system32\bitsprx4.dll 2009-07-14 21:25 . 2009-07-14 21:25 664 ----a-w- c:\windows\system32\d3d9caps.dat 2009-07-09 13:29 . 2009-07-09 13:29 152576 ----a-w- c:\documents and settings\slarsen\Application Data\Sun\Java\jre1.6.0_14\lzma.dll 2009-06-30 19:30 . 2009-06-30 19:30 3073114 ----a-w- c:\windows\system32\MyCokeRewards Summer 2009 Screensaver.scr 2009-06-28 19:42 . 2009-06-28 19:42 -------- d-----w- c:\documents and settings\Lenny\Local Settings\Application Data\AVG Security Toolbar 2009-06-28 19:37 . 2009-06-28 19:37 -------- d-----w- c:\program files\AVG 2009-06-28 19:32 . 2009-07-16 17:38 -------- d-----w- c:\program files\Lavasoft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-20 02:34 . 2007-07-16 16:48 -------- d-----w- c:\program files\Common Files\Symantec Shared 2009-07-20 02:34 . 2007-07-16 16:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec 2009-07-20 02:34 . 2008-05-03 23:04 -------- d-----w- c:\documents and settings\slarsen\Application Data\Symantec 2009-07-20 00:01 . 2008-10-31 15:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-07-19 16:42 . 2007-07-16 18:25 335 ----a-w- c:\windows\nsreg.dat 2009-07-19 16:42 . 2007-10-10 22:08 9277 ----a-w- c:\windows\mozver.dat 2009-07-19 12:10 . 2007-07-16 18:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-07-19 06:07 . 2008-05-03 14:22 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-07-19 02:45 . 2008-01-24 00:13 -------- d-----w- c:\program files\Microsoft Silverlight 2009-07-19 02:43 . 2007-06-05 03:00 77040 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-07-19 01:52 . 2009-05-13 18:26 -------- d-----w- c:\program files\Microsoft Works 2009-07-19 00:20 . 2009-07-19 01:35 186034 ----a-w- c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat 2009-07-19 00:20 . 2004-08-11 22:14 88375 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-07-19 00:01 . 2009-07-19 00:00 175759 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch6\HTML\item_templ\common\fixes\aflcommon.dll 2009-07-16 23:21 . 2008-09-18 19:30 -------- d-----w- c:\program files\Windows Live Toolbar 2009-07-16 23:16 . 2008-09-18 19:26 -------- d-----w- c:\program files\Windows Live 2009-07-16 17:38 . 2008-05-03 04:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-07-16 15:22 . 2008-10-29 00:52 -------- d-----w- c:\documents and settings\slarsen\Application Data\WeatherBug 2009-07-16 14:50 . 2008-02-04 03:58 -------- d-----w- c:\documents and settings\slarsen\Application Data\Wave Systems Corp 2009-07-09 13:29 . 2007-06-05 02:47 -------- d-----w- c:\program files\Java 2009-07-08 14:38 . 2008-11-20 23:07 57760 ---ha-w- c:\windows\system32\mlfcache.dat 2009-07-08 14:37 . 2008-12-22 20:55 -------- d-----w- c:\documents and settings\Lenny\Application Data\Apple Computer 2009-07-07 13:24 . 2009-01-27 23:37 -------- d-----w- c:\documents and settings\Lenny\Application Data\WeatherBug 2009-07-03 22:56 . 2009-01-24 02:02 34 ----a-w- c:\documents and settings\Lenny\jagex_runescape_preferences.dat 2009-07-01 16:02 . 2008-03-03 21:25 -------- d-----w- c:\program files\Mozilla Thunderbird 2009-06-16 14:36 . 2004-08-11 22:00 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-06-16 14:36 . 2004-08-11 22:00 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-06-03 19:09 . 2004-08-11 22:00 1291264 ----a-w- c:\windows\system32\quartz.dll 2009-05-26 14:47 . 2009-05-26 14:47 -------- d-----w- c:\documents and settings\Lenny\Application Data\Nitro PDF 2009-05-13 05:15 . 2004-08-11 22:00 915456 ----a-w- c:\windows\system32\wininet.dll 2009-05-07 15:32 . 2004-08-11 22:00 345600 ----a-w- c:\windows\system32\localspl.dll 2004-07-22 17:51 . 2004-07-22 17:51 3432656 ----a-w- c:\program files\ManagedDX.CAB 2004-07-20 05:58 . 2004-07-20 05:58 1156363 ----a-w- c:\program files\BDANT.cab 2004-07-20 05:53 . 2004-07-20 05:53 976020 ----a-w- c:\program files\BDAXP.cab 2004-07-09 21:17 . 2004-07-09 21:17 13265040 ----a-w- c:\program files\dxnt.cab 2004-07-09 16:13 . 2004-07-09 16:13 15493481 ----a-w- c:\program files\DirectX.cab 2004-07-09 16:13 . 2004-07-09 16:13 703080 ----a-w- c:\program files\BDA.cab 2004-07-09 11:08 . 2004-07-09 11:08 472576 ----a-w- c:\program files\dxsetup.exe 2004-07-09 11:08 . 2004-07-09 11:08 2242560 ----a-w- c:\program files\dsetup32.dll 2004-07-09 10:03 . 2004-07-09 10:03 62976 ----a-w- c:\program files\DSETUP.dll 2007-10-11 23:47 . 2007-10-11 23:47 135680 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll . ((((((((((((((((((((((((((((( SnapShot@2009-07-19_23.12.11 ))))))))))))))))))))))))))))))))))))))))) . + 2009-07-20 04:38 . 2009-07-20 04:38 16384 c:\windows\Temp\Perflib_Perfdata_c54.dat + 2009-07-20 04:46 . 2009-07-20 04:46 16384 c:\windows\Temp\Perflib_Perfdata_6ac.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-07 3885408] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "igndlm.exe"="c:\program files\Download Manager\DLM.exe" [2007-03-05 1103480] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896] "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824] "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-02-20 1191936] "Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128] "Nitro PDF Printer Monitor"="c:\program files\Nitro PDF\Professional\NitroPDFPrinterMonitor.exe" [2009-03-04 209216] "OneCareUI"="c:\program files\Microsoft Windows OneCare Live\winssnotify.exe" [2009-03-22 63864] "SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-03-24 282624] c:\documents and settings\All Users\Start Menu\Programs\Startup\ EMBASSY Trust Suite Secure Update.lnk - c:\program files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2006-8-25 192512] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 19:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^eFax 4.3.lnk] backup=c:\windows\pss\eFax 4.3.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk] backup=c:\windows\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk] backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^slarsen^Start Menu^Programs^Startup^Yahoo! Widgets.lnk] path=c:\documents and settings\slarsen\Start Menu\Programs\Startup\Yahoo! Widgets.lnk backup=c:\windows\pss\Yahoo! Widgets.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\fxsclnt.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Activision\\Star Trek Armada II DEMO\\Armada2Demo.exe"= "c:\\Program Files\\mIRC\\mirc.exe"= "c:\\Program Files\\Microsoft Office\\OFFICE11\\FRONTPG.EXE"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [6/23/2009 11:01 AM 9968] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [6/23/2009 11:01 AM 72944] R2 NeatReceipts Database Controller;NeatReceipts Database Controller;c:\program files\Common Files\NeatReceipts\DB Controller\NeatReceiptsDBController.exe [2/5/2008 2:03 PM 228480] R2 OcHealthMon;Windows Live OneCare Health Monitor;c:\program files\Microsoft Windows OneCare Live\OcHealthMon.exe [3/22/2009 10:59 AM 24936] R2 OneTouch 4.0 Monitor;OneTouch 4.0 Monitor;c:\program files\Visioneer\OneTouch 4.0\OtService.exe [8/28/2006 1:58 AM 126976] S3 GTKCMOS;GTKCMOS;c:\windows\system32\GTKCMOS.sys [6/15/2004 12:55 PM 7882] S3 MSSQL$NR2007;SQL Server (NR2007);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2/26/2008 10:08 PM 29183504] S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [10/12/2007 5:04 PM 99200] S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [6/23/2009 11:01 AM 7408] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc HPService REG_MULTI_SZ HPSLPSVC [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Nitro PDF Professional] cscript //B "c:\program files\Nitro PDF\Professional\RemoveOldAddins.vbs" . Contents of the 'Scheduled Tasks' folder 2009-05-26 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34] 2009-07-20 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-10-31 07:57] . . ------- Supplementary Scan ------- . uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local Trusted Zone: inettracer.com\www Trusted Zone: turbotax.com . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-19 21:45 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(836) c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\windows\system32\WININET.dll - - - - - - - > 'explorer.exe'(2532) c:\windows\system32\WININET.dll c:\progra~1\WINDOW~2\wmpband.dll c:\program files\iTunes\iTunesMiniPlayer.dll c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\program files\Intel\Wireless\Bin\WLKEEPER.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Wave Systems Corp\Common\DataServer.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\system32\msiexec.exe c:\program files\Dell\QuickSet\NicConfigSvc.exe c:\windows\system32\PnkBstrA.exe c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\program files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe c:\windows\system32\fxssvc.exe c:\program files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe c:\program files\Microsoft Windows OneCare Live\winss.exe c:\program files\Canon\CAL\CALMAIN.exe c:\windows\system32\igfxsrvc.exe c:\program files\Apoint\hidfind.exe c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe c:\program files\Apoint\ApntEx.exe c:\windows\system32\wscntfy.exe c:\windows\system32\dwwin.exe c:\program files\Windows Live\Contacts\wlcomm.exe . ************************************************************************** . Completion time: 2009-07-20 21:51 - machine was rebooted ComboFix-quarantined-files.txt 2009-07-20 04:51 ComboFix2.txt 2009-07-20 02:17 ComboFix3.txt 2009-07-19 23:17 ComboFix4.txt 2008-05-12 20:55 ComboFix5.txt 2009-07-20 04:32 Pre-Run: 16,607,563,776 bytes free Post-Run: 16,600,514,560 bytes free 308 --- E O F --- 2009-07-19 03:53
  12. jouster

    jouster Computer 1 - Log 01

    Here's the combofix log: ComboFix 09-07-19.02 - slarsen 07/19/2009 15:59.3.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.505 [GMT -7:00] Running from: c:\documents and settings\slarsen\Desktop\ComboFix.exe AV: Windows Live OneCare *On-access scanning disabled* (Updated) {427ADFC3-B354-4A51-BE34-A9D4218E45C4} FW: Windows Live OneCare Firewall *enabled* {A3899D22-27E6-4A7E-AE4E-2C106646DAAB} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\desktop.ini c:\windows\COUPON~1.OCX c:\windows\CouponPrinter.ocx c:\windows\system32\ansnrgyy.ini . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_SKYNETjmdceynj ((((((((((((((((((((((((( Files Created from 2009-06-19 to 2009-07-19 ))))))))))))))))))))))))))))))) . 2009-07-19 16:42 . 2009-07-19 16:42 118784 ----a-w- c:\windows\SeaMonkeyUninstall.exe 2009-07-19 16:42 . 2009-07-19 16:42 118784 ----a-w- c:\windows\GREUninstall.exe 2009-07-19 16:41 . 2009-07-19 16:41 -------- d-----w- c:\program files\mozilla.org 2009-07-19 05:12 . 2009-07-19 05:12 117760 ----a-w- c:\documents and settings\slarsen\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL 2009-07-19 05:11 . 2009-07-19 05:11 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-07-19 05:11 . 2009-07-19 05:11 -------- d-----w- c:\program files\SUPERAntiSpyware 2009-07-19 05:11 . 2009-07-19 05:11 -------- d-----w- c:\documents and settings\slarsen\Application Data\SUPERAntiSpyware.com 2009-07-19 05:10 . 2009-07-19 05:10 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-07-19 04:52 . 2009-07-19 04:52 -------- d-----w- c:\documents and settings\slarsen\Application Data\Malwarebytes 2009-07-19 04:52 . 2009-07-13 20:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-07-19 04:52 . 2009-07-13 20:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-07-19 04:50 . 2009-07-19 04:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-07-19 04:50 . 2009-07-19 04:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-07-19 04:42 . 2009-07-19 04:47 -------- d-----w- c:\program files\CCleaner 2009-07-19 04:27 . 2009-07-19 04:31 -------- d-----w- c:\program files\SpywareBlaster 2009-07-19 04:09 . 2009-07-19 04:09 -------- d-----w- c:\program files\Lunarsoft 2009-07-19 04:09 . 2009-07-19 04:09 -------- d-----w- c:\documents and settings\slarsen\Local Settings\Application Data\Lunarsoft 2009-07-19 02:17 . 2009-07-19 02:17 -------- d-----w- C:\5534306ab07c14292b3f4ffb74ad 2009-07-19 02:08 . 2009-07-19 02:08 -------- d-----w- c:\windows\ie8updates 2009-07-19 00:35 . 2009-07-19 00:35 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2009-07-19 00:02 . 2009-07-19 00:02 -------- d-----w- c:\windows\system32\scripting 2009-07-19 00:02 . 2009-07-19 00:02 -------- d-----w- c:\windows\l2schemas 2009-07-19 00:02 . 2009-07-19 00:02 -------- d-----w- c:\windows\system32\en 2009-07-19 00:01 . 2009-07-19 00:01 5263 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch6\HTML\item_templ\common\fixes\austart.dll 2009-07-19 00:01 . 2009-07-19 00:01 179855 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch6\HTML\item_templ\common\fixes\auinterface.dll 2009-07-18 23:53 . 2009-07-18 23:53 -------- d-----w- c:\windows\ServicePackFiles 2009-07-18 23:33 . 2009-04-30 21:22 12800 ------w- c:\windows\system32\dllcache\xpshims.dll 2009-07-18 23:33 . 2009-04-30 21:22 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll 2009-07-18 23:29 . 2004-08-04 06:41 13776 ------w- c:\windows\system32\drivers\recagent.sys 2009-07-18 23:28 . 2008-04-14 00:11 37376 ------w- c:\windows\system32\l2gpstore.dll 2009-07-18 23:27 . 2008-04-14 00:11 59392 ------w- c:\windows\system32\eapqec.dll 2009-07-18 23:25 . 2009-03-06 14:22 284160 ------w- c:\windows\system32\dllcache\pdh.dll 2009-07-18 23:25 . 2009-02-09 12:10 401408 ------w- c:\windows\system32\dllcache\rpcss.dll 2009-07-18 23:25 . 2009-02-06 10:39 35328 ------w- c:\windows\system32\dllcache\sc.exe 2009-07-18 23:25 . 2009-02-09 12:10 473600 ------w- c:\windows\system32\dllcache\fastprox.dll 2009-07-18 23:25 . 2009-02-09 12:10 453120 ------w- c:\windows\system32\dllcache\wmiprvsd.dll 2009-07-18 23:25 . 2009-02-06 11:11 110592 ------w- c:\windows\system32\dllcache\services.exe 2009-07-18 23:25 . 2009-02-06 10:10 227840 ------w- c:\windows\system32\dllcache\wmiprvse.exe 2009-07-18 23:25 . 2009-02-09 12:10 729088 ------w- c:\windows\system32\dllcache\lsasrv.dll 2009-07-18 23:25 . 2009-02-09 12:10 617472 ------w- c:\windows\system32\dllcache\advapi32.dll 2009-07-18 23:25 . 2009-02-09 12:10 714752 ------w- c:\windows\system32\dllcache\ntdll.dll 2009-07-18 23:23 . 2008-05-03 11:55 2560 ------w- c:\windows\system32\xpsp4res.dll 2009-07-18 23:23 . 2008-04-21 12:08 215552 ------w- c:\windows\system32\dllcache\wordpad.exe 2009-07-16 23:25 . 2009-07-19 23:11 -------- d-----w- c:\documents and settings\slarsen\Tracing 2009-07-16 23:17 . 2009-07-16 23:17 -------- d-----w- c:\program files\Microsoft Sync Framework 2009-07-16 23:15 . 2009-07-16 23:15 -------- d-----w- c:\program files\Microsoft 2009-07-16 23:15 . 2009-07-16 23:15 -------- d-----w- c:\program files\Windows Live SkyDrive 2009-07-16 23:03 . 2009-07-16 23:03 -------- d-----w- c:\program files\Common Files\Windows Live 2009-07-16 22:50 . 2009-07-16 22:50 -------- d-sh--w- c:\documents and settings\slarsen\PrivacIE 2009-07-16 22:50 . 2009-07-16 22:50 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache 2009-07-16 22:48 . 2009-07-16 22:48 -------- d-sh--w- c:\documents and settings\slarsen\IETldCache 2009-07-16 22:39 . 2009-07-16 22:42 -------- dc-h--w- c:\windows\ie8 2009-07-16 18:03 . 2009-07-16 18:03 23720 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupport_TestContent.dll 2009-07-16 18:03 . 2009-07-16 18:03 221208 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupportCommon.dll 2009-07-16 18:03 . 2009-07-16 18:03 110248 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HelpAndSupportInterface.dll 2009-07-16 18:03 . 2009-07-16 18:03 23056 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix101001.dll 2009-07-16 18:03 . 2009-07-16 18:03 29352 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix058456.dll 2009-07-16 18:03 . 2009-07-16 18:03 21160 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch1\HTML\item_templ\common\fixes\HASFix056479.dll 2009-07-16 17:55 . 2007-11-28 05:56 91328 ----a-w- c:\windows\system32\drivers\msfwdrv.sys 2009-07-16 17:55 . 2007-11-28 05:56 116416 ----a-w- c:\windows\system32\drivers\msfwhlpr.sys 2009-07-16 17:54 . 2008-05-15 23:15 53168 ----a-w- c:\windows\system32\drivers\MpFilter.sys 2009-07-16 17:47 . 2009-07-19 12:18 -------- d-----w- c:\program files\Microsoft Windows OneCare Live 2009-07-16 15:10 . 2009-07-19 00:02 -------- d-----w- c:\windows\system32\bits 2009-07-16 15:10 . 2008-04-14 00:11 7168 ------w- c:\windows\system32\bitsprx4.dll 2009-07-14 21:25 . 2009-07-14 21:25 664 ----a-w- c:\windows\system32\d3d9caps.dat 2009-07-09 13:29 . 2009-07-09 13:29 152576 ----a-w- c:\documents and settings\slarsen\Application Data\Sun\Java\jre1.6.0_14\lzma.dll 2009-06-30 19:30 . 2009-06-30 19:30 3073114 ----a-w- c:\windows\system32\MyCokeRewards Summer 2009 Screensaver.scr 2009-06-28 19:42 . 2009-06-28 19:42 -------- d-----w- c:\documents and settings\Lenny\Local Settings\Application Data\AVG Security Toolbar 2009-06-28 19:37 . 2009-06-28 19:37 -------- d-----w- c:\program files\AVG 2009-06-28 19:32 . 2009-07-16 17:38 -------- d-----w- c:\program files\Lavasoft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-19 16:42 . 2007-07-16 18:25 335 ----a-w- c:\windows\nsreg.dat 2009-07-19 16:42 . 2007-10-10 22:08 9277 ----a-w- c:\windows\mozver.dat 2009-07-19 12:10 . 2007-07-16 18:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-07-19 06:07 . 2008-05-03 14:22 -------- d-----w- c:\program files\Spybot - Search & Destroy 2009-07-19 02:45 . 2008-01-24 00:13 -------- d-----w- c:\program files\Microsoft Silverlight 2009-07-19 02:43 . 2007-06-05 03:00 77040 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-07-19 01:52 . 2009-05-13 18:26 -------- d-----w- c:\program files\Microsoft Works 2009-07-19 00:20 . 2009-07-19 01:35 186034 ----a-w- c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat 2009-07-19 00:20 . 2004-08-11 22:14 88375 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat 2009-07-19 00:01 . 2009-07-19 00:00 175759 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\OC\Channels\ch6\HTML\item_templ\common\fixes\aflcommon.dll 2009-07-18 23:00 . 2008-10-31 15:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater 2009-07-16 23:21 . 2008-09-18 19:30 -------- d-----w- c:\program files\Windows Live Toolbar 2009-07-16 23:16 . 2008-09-18 19:26 -------- d-----w- c:\program files\Windows Live 2009-07-16 17:38 . 2008-05-03 04:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-07-16 17:34 . 2007-07-16 16:48 -------- d-----w- c:\program files\Common Files\Symantec Shared 2009-07-16 15:22 . 2008-10-29 00:52 -------- d-----w- c:\documents and settings\slarsen\Application Data\WeatherBug 2009-07-16 14:50 . 2008-02-04 03:58 -------- d-----w- c:\documents and settings\slarsen\Application Data\Wave Systems Corp 2009-07-09 13:29 . 2007-06-05 02:47 -------- d-----w- c:\program files\Java 2009-07-08 14:38 . 2008-11-20 23:07 57760 ---ha-w- c:\windows\system32\mlfcache.dat 2009-07-08 14:37 . 2008-12-22 20:55 -------- d-----w- c:\documents and settings\Lenny\Application Data\Apple Computer 2009-07-07 13:24 . 2009-01-27 23:37 -------- d-----w- c:\documents and settings\Lenny\Application Data\WeatherBug 2009-07-03 22:56 . 2009-01-24 02:02 34 ----a-w- c:\documents and settings\Lenny\jagex_runescape_preferences.dat 2009-07-01 16:02 . 2008-03-03 21:25 -------- d-----w- c:\program files\Mozilla Thunderbird 2009-06-27 16:20 . 2007-07-16 16:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec 2009-06-16 14:36 . 2004-08-11 22:00 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-06-16 14:36 . 2004-08-11 22:00 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-06-03 19:09 . 2004-08-11 22:00 1291264 ----a-w- c:\windows\system32\quartz.dll 2009-05-26 14:47 . 2009-05-26 14:47 -------- d-----w- c:\documents and settings\Lenny\Application Data\Nitro PDF 2009-05-13 05:15 . 2004-08-11 22:00 915456 ----a-w- c:\windows\system32\wininet.dll 2009-05-07 15:32 . 2004-08-11 22:00 345600 ----a-w- c:\windows\system32\localspl.dll 2004-07-22 17:51 . 2004-07-22 17:51 3432656 ----a-w- c:\program files\ManagedDX.CAB 2004-07-20 05:58 . 2004-07-20 05:58 1156363 ----a-w- c:\program files\BDANT.cab 2004-07-20 05:53 . 2004-07-20 05:53 976020 ----a-w- c:\program files\BDAXP.cab 2004-07-09 21:17 . 2004-07-09 21:17 13265040 ----a-w- c:\program files\dxnt.cab 2004-07-09 16:13 . 2004-07-09 16:13 15493481 ----a-w- c:\program files\DirectX.cab 2004-07-09 16:13 . 2004-07-09 16:13 703080 ----a-w- c:\program files\BDA.cab 2004-07-09 11:08 . 2004-07-09 11:08 472576 ----a-w- c:\program files\dxsetup.exe 2004-07-09 11:08 . 2004-07-09 11:08 2242560 ----a-w- c:\program files\dsetup32.dll 2004-07-09 10:03 . 2004-07-09 10:03 62976 ----a-w- c:\program files\DSETUP.dll 2007-10-11 23:47 . 2007-10-11 23:47 135680 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-07 3885408] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "igndlm.exe"="c:\program files\Download Manager\DLM.exe" [2007-03-05 1103480] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896] "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 802816] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 696320] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824] "Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-02-20 1191936] "Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128] "Nitro PDF Printer Monitor"="c:\program files\Nitro PDF\Professional\NitroPDFPrinterMonitor.exe" [2009-03-04 209216] "OneCareUI"="c:\program files\Microsoft Windows OneCare Live\winssnotify.exe" [2009-03-22 63864] "SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-03-24 282624] c:\documents and settings\All Users\Start Menu\Programs\Startup\ EMBASSY Trust Suite Secure Update.lnk - c:\program files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2006-8-25 192512] HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 19:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP] @="Service" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^eFax 4.3.lnk] backup=c:\windows\pss\eFax 4.3.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNCSHORTCUTNAME.lnk] backup=c:\windows\pss\HOTSYNCSHORTCUTNAME.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk] backup=c:\windows\pss\HP Image Zone Fast Start.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^slarsen^Start Menu^Programs^Startup^Yahoo! Widgets.lnk] path=c:\documents and settings\slarsen\Start Menu\Programs\Startup\Yahoo! Widgets.lnk backup=c:\windows\pss\Yahoo! Widgets.lnkStartup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\1c77df37 HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Host Process [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\WINDOWS\\system32\\fxsclnt.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqcopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Activision\\Star Trek Armada II DEMO\\Armada2Demo.exe"= "c:\\Program Files\\mIRC\\mirc.exe"= "c:\\Program Files\\Microsoft Office\\OFFICE11\\FRONTPG.EXE"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [6/23/2009 11:01 AM 9968] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [6/23/2009 11:01 AM 72944] R2 NeatReceipts Database Controller;NeatReceipts Database Controller;c:\program files\Common Files\NeatReceipts\DB Controller\NeatReceiptsDBController.exe [2/5/2008 2:03 PM 228480] R2 OcHealthMon;Windows Live OneCare Health Monitor;c:\program files\Microsoft Windows OneCare Live\OcHealthMon.exe [3/22/2009 10:59 AM 24936] R2 OneTouch 4.0 Monitor;OneTouch 4.0 Monitor;c:\program files\Visioneer\OneTouch 4.0\OtService.exe [8/28/2006 1:58 AM 126976] S3 GTKCMOS;GTKCMOS;c:\windows\system32\GTKCMOS.sys [6/15/2004 12:55 PM 7882] S3 MSSQL$NR2007;SQL Server (NR2007);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2/26/2008 10:08 PM 29183504] S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [10/12/2007 5:04 PM 99200] S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [6/23/2009 11:01 AM 7408] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc HPService REG_MULTI_SZ HPSLPSVC [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\Nitro PDF Professional] cscript //B "c:\program files\Nitro PDF\Professional\RemoveOldAddins.vbs" . Contents of the 'Scheduled Tasks' folder 2009-05-26 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 20:34] 2009-07-19 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-10-31 07:57] . - - - - ORPHANS REMOVED - - - - Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) Toolbar-Locked - (no file) WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file) Notify-NavLogon - (no file) . ------- Supplementary Scan ------- . uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local Trusted Zone: inettracer.com\www Trusted Zone: turbotax.com . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-19 16:12 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(840) c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\windows\system32\WININET.dll - - - - - - - > 'explorer.exe'(3244) c:\windows\system32\WININET.dll c:\progra~1\WINDOW~2\wmpband.dll c:\program files\iTunes\iTunesMiniPlayer.dll c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\program files\Intel\Wireless\Bin\WLKEEPER.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Wave Systems Corp\Common\DataServer.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE c:\windows\system32\msiexec.exe c:\program files\Dell\QuickSet\NicConfigSvc.exe c:\windows\system32\PnkBstrA.exe c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\program files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe c:\windows\system32\fxssvc.exe c:\program files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe c:\program files\Microsoft Windows OneCare Live\winss.exe c:\program files\Canon\CAL\CALMAIN.exe c:\windows\system32\igfxsrvc.exe c:\program files\Apoint\hidfind.exe c:\program files\Apoint\ApntEx.exe c:\windows\system32\wscntfy.exe c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe c:\program files\Windows Live\Contacts\wlcomm.exe . ************************************************************************** . Completion time: 2009-07-19 16:17 - machine was rebooted ComboFix-quarantined-files.txt 2009-07-19 23:17 ComboFix2.txt 2008-05-12 20:55 ComboFix3.txt 2008-05-12 17:41 Pre-Run: 15,774,556,160 bytes free Post-Run: 16,363,556,864 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 321 --- E O F --- 2009-07-19 03:53
  13. jouster

    jouster Computer 1 - Log 01

    ok running combofix on comp1 now. Just to make sure we're on the same page I've posted two seperate posts on the forum for two different computers (log1-comp1 and log1-comp2)and am following your advice for each post on their respective machines.
  14. jouster

    jouster Computer 2 - Log 01

    Here is the last Malwarebytes log- Malwarebytes' Anti-Malware 1.39 Database version: 2462 Windows 5.1.2600 Service Pack 3 7/18/2009 10:00:18 PM mbam-log-2009-07-18 (22-00-18).txt Scan type: Quick Scan Objects scanned: 105413 Time elapsed: 14 minute(s), 42 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\AvScan (Malware.Trace) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\documents and settings\james larsen\Desktop\ZwinkySetup2.3.50.45.ZJfox000.exe (Adware.MyWeb) -> Quarantined and deleted successfully.
  15. jouster

    jouster Computer 1 - Log 01

    Thanks Tarun. As of right now it seems to be working fine. I was having issues with the windows update and also could not log into any windows live services (hotmail, messenger and even had problems loading the microsoft update with firefox). I just installed windows live OneCare and had to fight it because it required the live sign in to complete the install. I just happened upon lunarsoft while trying to fix the update problem and used dial-a-fix which solved the issue. I wish I had known about this site before it would have saved me a lot of time and stress! Is there anything I can do about the files in red from the hijack this report?
×