Solved Virus as administrator (can not do ANYTHING with computer)

noahdfear · 2008/09/26

Best not to allow Avira to do anything until ComboFix has completed. Many antivirus programs interfere with and sometimes try to prevent ComboFix running. That's the reason we recommend disabling them.

Riser · 2008/09/27

Ok. I think I might have victory soon. I forgot that I have rocket dock (I'm use to the Leopard look) and on Rocket dock there was a docklet that operated like the fan out documents thingy on Leopard (thingy being the technical word, of course) I opened that folder which gave me the opportunity to type in c:/program files in the "address" box above. That accessed my program files and now I am making the ISO!!! YAY! I'm not completely free yet and will still work on getting you those logs (combofix crashes everytime I try to run it and all of my AV software is turned off.

noahdfear · 2008/09/27

Might as well see if the system will stay booted long enough to invoke system restore before going any further.

Start>All Programs>Accessories>System Tools>System Restore

Riser · 2008/09/27

Ok... found out the lovely T43 laptop DOESN'T have a CD burner installed... grr part 1. Grr part 2 is the only restore point it offers me is exactly... ten minutes ago.

noahdfear · 2008/09/27

That's probably a restore point created by ComboFix.

Rename ComboFix.exe (the renamed one) to something else. Now click Start>Run and type the following bolded command (use the name you used upon renaming in place of combofix.exe) and hit Enter.

"%userprofile%\desktop\combofix.exe" /killall

Maybe it will get through a run without crashing.

Riser · 2008/09/27

God woke up from his nap and smiled upon me for a brief moment:

ComboFix 08-09-26.01 - IBM Owner 2008-09-25 23:57:10.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.592 [GMT -7:00]
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\IBM Owner\Application Data\Adobe\crc.dat
C:\WINDOWS\BM03c75141.txt
C:\WINDOWS\BM03c75141.xml
C:\WINDOWS\dfmlxbpkqvd.dll
C:\WINDOWS\emek.exe
C:\WINDOWS\onfwbsak.dll
C:\WINDOWS\system32\acpie.dll
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\k86.bin
C:\WINDOWS\system32\ljJcbyAp.dll
C:\WINDOWS\system32\nnnnLfDW.dll
C:\WINDOWS\system32\paso.el
C:\WINDOWS\system32\pAybcJjl.ini
C:\WINDOWS\system32\pAybcJjl.ini2
C:\WINDOWS\system32\rqRKCvVN.dll
C:\WINDOWS\system32\tdssservers.dat
C:\WINDOWS\system32\tuvSigEt.dll
C:\WINDOWS\system32\winrzf32.dll
C:\WINDOWS\system32\xwknacvj.ini
C:\WINDOWS\system32\yayxyATn.dll
C:\WINDOWS\Tasks\oikahxcu.job

----- BITS: Possible infected sites -----

hxxp://77.74.48.101
hxxp://78.157.143.163
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Legacy_TDSSSERV
-------\Service_NPF
-------\Service_TDSSserv

((((((((((((((((((((((((( Files Created from 2008-08-26 to 2008-09-26 )))))))))))))))))))))))))))))))
.

2008-10-01 06:30 . 2008-09-25 18:52 7 --a------ C:\WINDOWS\system32\axt.bin
2008-09-30 19:50 . 2008-09-30 19:50 137,728 --a------ C:\ybwnngu.exe
2008-09-30 19:50 . 2008-09-30 19:50 104,960 --a------ C:\WINDOWS\stfMeane1535.exe
2008-09-30 19:50 . 2008-09-30 19:50 96,768 --a------ C:\fveia.exe
2008-09-30 19:50 . 2008-09-30 19:50 69,632 --a------ C:\jllw.exe
2008-09-30 19:50 . 2008-09-30 19:50 22,016 --a------ C:\kcxl.exe
2008-09-30 19:50 . 2008-09-30 19:50 10,000 --a------ C:\WINDOWS\system32\gks834t.dll
2008-09-30 19:50 . 2008-09-30 19:50 8,608 --a------ C:\WINDOWS\system32\acpu.sys
2008-09-30 19:50 . 2008-09-30 19:50 6,144 --a------ C:\ggseqxs.exe
2008-09-30 19:24 . 2008-09-30 19:25 95,232 --a------ C:\WINDOWS\system32\esohujec.dll
2008-09-30 18:31 . 2008-09-30 18:47 <DIR> d-------- C:\Program Files\Common Files\PC Tools
2008-09-30 18:31 . 2008-09-26 00:11 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-30 18:31 . 2008-07-28 11:29 160,792 --a------ C:\WINDOWS\system32\drivers\pctfw2.sys
2008-09-30 18:31 . 2008-08-25 11:36 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-09-30 18:31 . 2008-08-25 11:36 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-09-30 18:31 . 2008-08-25 11:36 40,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-09-30 18:31 . 2008-06-02 15:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-09-30 18:30 . 2008-09-24 12:31 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-09-30 18:30 . 2008-09-30 18:30 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\PC Tools
2008-09-30 18:30 . 2008-09-30 18:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-09-30 18:19 . 2008-09-30 18:19 95,232 --a------ C:\WINDOWS\system32\ugeqqqje.dll
2008-09-30 18:17 . 2008-09-30 18:17 95,232 --a------ C:\WINDOWS\system32\prgfpdla.dll
2008-09-30 18:10 . 2008-09-30 18:10 95,232 --a------ C:\WINDOWS\system32\ubenydvw.dll
2008-09-30 18:07 . 2008-09-30 18:07 95,232 --a------ C:\WINDOWS\system32\bkjxypph.dll
2008-09-26 00:11 . 2008-09-26 00:11 90,112 --a------ C:\WINDOWS\system32\itwzoxkn.exe
2008-09-25 23:17 . 2008-09-25 23:17 90,112 --a------ C:\WINDOWS\system32\fcjefsdi.exe
2008-09-25 22:08 . 2008-09-25 22:08 <DIR> d-------- C:\Program Files\Microsoft Diagnostics and Recovery Toolset
2008-09-25 22:06 . 2008-09-25 22:06 <DIR> d-------- C:\Program Files\Alex Feinman
2008-09-25 22:00 . 2008-09-25 22:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\hyrinmfk
2008-09-25 22:00 . 2008-09-25 22:00 90,112 --a------ C:\WINDOWS\system32\kpaxebax.exe
2008-09-25 19:24 . 2008-09-25 19:24 <DIR> d--h----- C:\WINDOWS\system32\WLANProfiles
2008-09-25 19:02 . 2008-09-25 19:02 84,680 --a------ C:\WINDOWS\system32\_BLOCK.WB4
2008-09-25 15:06 . 2008-09-25 23:05 733 --a------ C:\WINDOWS\wininit.ini
2008-09-25 13:31 . 2008-09-25 13:31 71,168 --a------ C:\WINDOWS\system32\jvcankwx.dll
2008-09-25 13:27 . 2008-09-25 13:27 128,000 --a------ C:\WINDOWS\system32\wucdymbd.dll
2008-09-25 13:27 . 2008-09-25 13:27 128,000 --a------ C:\WINDOWS\system32\mgoocx.dll
2008-09-24 21:35 . 2008-09-24 21:36 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-09-24 21:35 . 2008-09-24 21:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-24 16:47 . 2008-09-30 18:08 <DIR> d-------- C:\Program Files\thriXXX
2008-09-23 21:55 . 2008-09-30 19:51 <DIR> d-------- C:\Program Files\Google
2008-09-23 16:58 . 2008-09-23 16:58 <DIR> d-------- C:\Program Files\iPod
2008-09-23 16:58 . 2008-09-23 16:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-23 14:15 . 2008-09-23 14:15 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\Final Draft
2008-09-23 14:14 . 2008-09-23 14:14 <DIR> d-------- C:\Program Files\Final Draft Tagger
2008-09-23 14:14 . 2008-09-23 14:14 <DIR> d-------- C:\Program Files\Final Draft 7
2008-09-23 14:14 . 2008-09-23 14:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Final Draft
2008-09-23 14:13 . 2008-09-23 14:13 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-23 13:12 . 2008-09-23 13:12 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2008-09-23 11:42 . 2008-09-23 11:42 <DIR> d-------- C:\Program Files\iShut
2008-09-23 11:42 . 2008-09-23 11:42 <DIR> d-------- C:\Program Files\ForceQuit
2008-09-23 11:05 . 1986-09-24 17:59 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\LimeWire
2008-09-23 06:55 . 2008-09-23 06:55 <DIR> d-------- C:\Program Files\Menu Bar
2008-09-23 02:08 . 2008-09-23 02:08 <DIR> d-------- C:\Program Files\Object Desktop
2008-09-23 02:07 . 2008-09-23 02:07 <DIR> d-------- C:\WINDOWS\Sun
2008-09-23 01:33 . 2008-09-23 01:33 7,852 --a------ C:\WINDOWS\system32\mcdmsg7.dll
2008-09-23 00:58 . 2008-09-22 23:57 139,541 --a------ C:\Leopard_2_0_by_neodesktop.rar
2008-09-23 00:43 . 2008-09-23 00:43 0 --------- C:\WINDOWS\WB.ini
2008-09-23 00:20 . 2008-09-23 00:20 <DIR> d-------- C:\Program Files\Stardock
2008-09-23 00:20 . 2008-04-25 19:41 218,624 --a--c--- C:\WINDOWS\system32\dllcache\uxtheme.dll
2008-09-23 00:20 . 2008-04-26 16:14 42,672 --a------ C:\WINDOWS\system32\wbsys.dll
2008-09-23 00:19 . 2008-09-23 00:19 <DIR> d-------- C:\Program Files\WinCustomize
2008-09-22 08:36 . 2008-09-22 08:36 <DIR> d-------- C:\Program Files\YzShadow
2008-09-22 08:36 . 2008-09-22 08:36 <DIR> d-------- C:\Program Files\WinRoll
2008-09-22 08:35 . 2008-09-25 21:50 <DIR> d-------- C:\Program Files\Tiger System Preferences v2
2008-09-22 08:35 . 2008-09-23 14:58 <DIR> d-------- C:\Program Files\SearchSpy
2008-09-22 08:35 . 2008-09-22 08:35 <DIR> d-------- C:\Program Files\RK Launcher
2008-09-22 08:35 . 2008-09-22 08:35 <DIR> d-------- C:\Program Files\ObjectDock
2008-09-22 08:35 . 2008-09-22 08:35 2,179,584 --a------ C:\WINDOWS\system32\osxboot.exe
2008-09-22 08:30 . 2008-09-30 19:52 <DIR> d--h----- C:\WINDOWS\FlyakiteOSX
2008-09-21 23:10 . 2008-09-22 07:59 <DIR> d-------- C:\Program Files\RocketDock
2008-09-21 20:57 . 2008-09-21 20:57 <DIR> d--h----- C:\WINDOWS\PIF
2008-09-21 20:57 . 2008-09-21 21:08 <DIR> d-------- C:\Program Files\Finderbar 1.5
2008-09-21 20:57 . 2008-09-21 21:04 39,424 --a------ C:\WINDOWS\zipinst.exe
2008-09-21 20:56 . 2008-09-25 21:27 24 --a------ C:\WINDOWS\LogonStudio.ini
2008-09-21 20:55 . 2000-05-17 09:52 187,392 --a------ C:\WINDOWS\system32\JPGUtils.dll
2008-09-21 19:44 . 2008-04-13 17:12 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-09-21 18:33 . 2008-09-21 18:33 <DIR> d-------- C:\Program Files\Java
2008-09-21 18:33 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-09-21 18:32 . 2008-09-21 18:32 <DIR> d-------- C:\Program Files\Common Files\Java
2008-09-21 18:23 . 2008-09-21 18:33 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\Wyzo
2008-09-21 18:23 . 2008-09-21 18:23 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\.wyzo
2008-09-21 18:21 . 2008-09-21 18:21 <DIR> d-------- C:\Program Files\Wyzo
2008-09-20 19:07 . 2008-09-20 19:07 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\Apple Computer
2008-09-20 19:06 . 2008-09-23 16:58 <DIR> d-------- C:\Program Files\iTunes
2008-09-20 19:06 . 2008-04-17 13:12 107,368 --a------ C:\WINDOWS\system32\GEARAspi.dll
2008-09-20 19:06 . 2008-04-17 13:12 15,464 --a------ C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
2008-09-20 19:05 . 2008-09-20 19:05 <DIR> d-------- C:\Program Files\QuickTime
2008-09-20 19:05 . 2008-09-20 19:05 <DIR> d-------- C:\Program Files\Apple Software Update
2008-09-20 19:05 . 2008-09-20 19:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-20 19:04 . 2008-09-20 19:05 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-09-20 19:04 . 2008-09-20 19:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-09-20 18:20 . 2008-09-20 18:20 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\ATI
2008-09-20 18:20 . 2008-09-20 18:20 <DIR> d-------- C:\Documents and Settings\Guest
2008-09-20 17:36 . 2008-09-20 17:37 44 --a------ C:\WINDOWS\SMWizard.INI
2008-09-19 16:37 . 2008-09-19 16:37 0 --a------ C:\WINDOWS\nsreg.dat
2008-09-19 16:34 . 2008-09-23 14:22 <DIR> d-------- C:\Program Files\Celtx
2008-09-19 16:34 . 2008-09-19 16:34 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\Greyfirst
2008-09-19 16:27 . 2008-09-19 16:27 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Avaya
2008-09-19 14:22 . 2008-09-19 14:22 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Intel
2008-09-17 21:57 . 2008-09-17 21:57 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-09-17 21:37 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-09-17 21:37 . 2008-09-17 21:37 376 --a------ C:\WINDOWS\ODBC.INI
2008-09-17 21:36 . 2008-09-17 21:36 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-09-17 21:36 . 2008-09-17 21:36 <DIR> d-------- C:\Program Files\Common Files\L&H
2008-09-17 21:35 . 2008-09-17 21:36 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-09-17 21:35 . 2008-09-17 21:35 <DIR> d-------- C:\Program Files\Microsoft Works
2008-09-17 21:34 . 2008-06-13 04:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-17 21:32 . 2008-05-08 07:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-09-17 21:31 . 2008-09-17 21:31 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-09-17 21:30 . 2008-09-17 21:30 <DIR> dr-h----- C:\MSOCache
2008-09-17 21:27 . 2008-04-11 12:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-09-17 21:27 . 2008-05-01 07:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-09-17 21:15 . 2008-09-17 21:15 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-09-17 21:15 . 2008-09-17 21:15 <DIR> d-------- C:\WINDOWS\system32\en
2008-09-17 21:15 . 2008-09-17 21:15 <DIR> d-------- C:\WINDOWS\system32\bits
2008-09-17 21:15 . 2008-09-17 21:15 <DIR> d-------- C:\WINDOWS\l2schemas
2008-09-17 21:12 . 2008-09-17 21:16 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-09-17 20:54 . 2004-08-03 22:29 327,040 --------- C:\WINDOWS\system32\drivers\ati2mtaa.sys
2008-09-17 20:53 . 2004-08-03 22:29 63,663 --------- C:\WINDOWS\system32\drivers\ati1rvxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 56,623 --------- C:\WINDOWS\system32\drivers\ati1btxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 36,463 --------- C:\WINDOWS\system32\drivers\ati1tuxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 34,735 --------- C:\WINDOWS\system32\drivers\ati1xsxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 30,671 --------- C:\WINDOWS\system32\drivers\ati1raxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 29,455 --------- C:\WINDOWS\system32\drivers\ati1xbxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 26,367 --------- C:\WINDOWS\system32\drivers\ati1snxx.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-24 21:36 147,456 ----a-w C:\WINDOWS\fbxrqtwn.exe
2008-09-18 02:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-18 02:46 --------- d-----w C:\Program Files\Common Files\Lenovo
2008-09-18 02:44 33,536 ----a-w C:\WINDOWS\system32\drivers\tvtfilter.sys
2008-09-18 02:44 30,144 ----a-w C:\WINDOWS\system32\drivers\psadd.sys
2008-09-18 02:44 --------- d-----w C:\Program Files\Lenovo
2008-09-18 02:43 7,012 ----a-w C:\WINDOWS\system32\drivers\pmemnt.sys
2008-09-18 02:35 0 ---ha-r C:\WINDOWS\system32\drivers\IBM_2678_A44_TP.MRK
2008-09-18 00:36 --------- d-----w C:\Program Files\Broadcom
2008-09-18 00:34 --------- d-----w C:\Documents and Settings\IBM Owner\Application Data\ATI
2008-09-18 00:32 --------- d-----w C:\Program Files\ATI Technologies
2008-09-18 00:31 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-18 00:25 --------- d-----w C:\Program Files\Foxit Software
2008-09-18 00:09 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-16 03:12 4,224 ----a-w C:\WINDOWS\system32\drivers\IBMBLDID.sys
2008-08-16 03:12 11,520 ----a-w C:\WINDOWS\system32\drivers\ANC.sys
1986-09-25 01:40 53,248 --sha-w C:\WINDOWS\system32\efcccdBr.dll
.

------- Sigcheck -------

2002-12-31 05:00 577024 c72661f8552ace7c5c85e16a3cf505c4 C:\WINDOWS\$NtServicePackUninstall$\user32.dll
2008-04-13 17:12 578560 b26b135ff1b9f60c9388b4a7d16f600b C:\WINDOWS\FlyakiteOSX\Backup\user32.dll
2008-04-13 17:12 578048 ae179e8b06437cc629db4b521740ba24 C:\WINDOWS\ServicePackFiles\i386\user32.dll
2008-04-13 17:12 578560 b26b135ff1b9f60c9388b4a7d16f600b C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\user32.dll
2008-04-13 17:12 578048 ae179e8b06437cc629db4b521740ba24 C:\WINDOWS\system32\user32.dll

2008-06-23 09:01 827904 c66402a06b83b036c195242c0c8cf83c C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
2008-06-23 09:57 826368 8c13d4a7479fa0a026eda8abce82c0ed C:\WINDOWS\FlyakiteOSX\Backup\wininet.dll
2002-12-31 05:00 656384 c0823fc5469663ba63e7db88f9919d70 C:\WINDOWS\ie7\wininet.dll
2007-08-13 18:54 818688 a4a0fc92358f39538a6494c42ef99fe9 C:\WINDOWS\ie7updates\KB953838-IE7\wininet.dll
2008-06-23 09:57 803840 3a29a6c233d2c16cb7f405a9c44c6bb1 C:\WINDOWS\ServicePackFiles\i386\wininet.dll
2008-06-23 09:57 826368 8c13d4a7479fa0a026eda8abce82c0ed C:\WINDOWS\SoftwareDistribution\Download\b4e75dba041bc21ee94fbcfa88cb49de\SP2GDR\wininet.dll
2008-06-23 09:01 827904 c66402a06b83b036c195242c0c8cf83c C:\WINDOWS\SoftwareDistribution\Download\b4e75dba041bc21ee94fbcfa88cb49de\SP2QFE\wininet.dll
2008-04-13 17:12 666112 7a4f775abb2f1c97def3e73afa2faedd C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\wininet.dll
2008-06-23 09:57 803840 3a29a6c233d2c16cb7f405a9c44c6bb1 C:\WINDOWS\system32\wininet.dll
2008-06-23 09:57 803840 3a29a6c233d2c16cb7f405a9c44c6bb1 C:\WINDOWS\system32\dllcache\wininet.dll

2008-04-13 17:12 2823168 d641db52c7fe1df7202a5405a203ce75 C:\WINDOWS\explorer.exe
2002-12-31 05:00 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2008-04-13 17:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\FlyakiteOSX\Backup\explorer.exe
2008-04-13 17:12 2823168 d641db52c7fe1df7202a5405a203ce75 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
2008-04-13 17:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C5BF49A2-94F3-42BD-F434-3604812C897D}]
2008-09-30 19:50 10000 --a------ C:\WINDOWS\system32\gks834t.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock "= "C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"SpybotSD TeaTimer "= "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"MntComMsg "= "C:\WINDOWS\system32\kpaxebax.exe" [2008-09-25 90112]
"ProcAplCom "= "C:\WINDOWS\system32\fcjefsdi.exe" [2008-09-25 90112]
"Jnskdfmf9eldfd "= "C:\DOCUME~1\IBMOWN~1\LOCALS~1\Temp\csrssc.exe" [2008-09-26 22017]
"SrvSh "= "C:\WINDOWS\system32\itwzoxkn.exe" [2008-09-26 90112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC "= "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"TVT Scheduler Proxy "= "C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-05-14 487424]
"TPHOTKEY "= "C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-10-02 94208]
"EZEJMNAP "= "C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2008-06-05 242976]
"PWRMGRTR "= "C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2008-07-29 331776]
"BLOG "= "C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2008-07-29 208896]
"ACTray "= "C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe" [2008-08-15 425984]
"ACWLIcon "= "C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2008-08-15 143360]
"SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-07-03 1323008]
"SoundMAXPnP "= "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-09-06 413696]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"System Files Updater "= "C:\WINDOWS\FlyakiteOSX\System Files Updater.exe" [2006-01-14 153233]
"iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"ISTray "= "C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264]
"TpShocks "= "TpShocks.exe" [2008-06-06 C:\WINDOWS\system32\TpShocks.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"UETmGi7RDG "= "C:\Documents and Settings\All Users\Application Data\hyrinmfk\lqvqdijo.exe" [2008-09-25 65536]

C:\Documents and Settings\IBM Owner\Start Menu\Programs\Startup\
CCC.lnk - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-09-29 49152]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-09-17 24576]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools "= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoFolderOptions "= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{C5BF49A2-94F3-42BD-F434-3604812C897D} "= "C:\WINDOWS\system32\gks834t.dll" [2008-09-30 10000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost "= "C:\\WINDOWS\\system32\\logonuiX.exe "

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
2008-08-15 21:37 32768 C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2005-07-05 23:45 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2005-11-30 20:16 24576 C:\WINDOWS\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=wbsys.dll mgoocx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ACGina

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\npf.sys]
@= "Driver "

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"C:\\WINDOWS\\system32\\dpvsetup.exe "=
"C:\\Program Files\\Wyzo\\wyzo.exe "=
"C:\\Program Files\\iTunes\\iTunes.exe "=

R0 Shockprf;Shockprf;C:\WINDOWS\system32\DRIVERS\Apsx86.sys [2008-05-14 114728]
R0 TPDIGIMN;TPDIGIMN;C:\WINDOWS\system32\DRIVERS\ApsHM86.sys [2008-05-14 19496]
R0 TPDiskPM;TPDiskPM;C:\WINDOWS\system32\drivers\TPDiskPM.sys [2006-09-26 14848]
R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2008-08-15 11520]
R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\Drivers\IBMBLDID.sys [2008-08-15 4224]
R1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.sys [2008-07-28 160792]
R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys [2008-07-29 4442]
R1 tvtumon;tvtumon;C:\WINDOWS\system32\DRIVERS\tvtumon.sys [2008-05-09 46144]
R2 Power Manager DBC Service;Power Manager DBC Service;C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE [2008-07-29 94208]
R2 TVT Backup Protection Service;TVT Backup Protection Service;C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [2008-05-14 520192]
R2 TVT_UpdateMonitor;TVT Windows Update Monitor;C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [2008-05-09 253952]
R3 TPInput;TPInput;C:\WINDOWS\system32\DRIVERS\TPInput.sys [2006-09-26 6528]
R3 TVTI2C;Lenovo SM bus driver;C:\WINDOWS\system32\DRIVERS\Tvti2c.sys [2008-02-22 37312]
S3 PCD5SRVC{DF187064-5DA14001-05040000};PCD5SRVC{DF187064-5DA14001-05040000} - PCDR Kernel Mode Service Helper Driver;C:\PROGRA~1\PCDR5\PCD5SRVC.pkms [2007-12-10 21280]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9b17c070-8517-11dd-bc46-8a5dd6341dba}]
\Shell\AutoRun\command - E:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

BHO-{3B020928-1C28-4C7A-9889-3D0B5926381A} - C:\WINDOWS\dfmlxbpkqvd.dll
BHO-{4CA0951E-6FDD-457E-8714-EC4EE9E09011} - C:\WINDOWS\system32\ljJcbyAp.dll
BHO-{A7FAAB0D-7CB7-450C-B7AE-8EB694A0427F} - (no file)
BHO-{D3C187AD-8CB8-45E2-8882-2C769672FA71} - (no file)
BHO-{DA2E0515-F0D5-4773-8191-400CCD50783B} - C:\WINDOWS\system32\yayxyATn.dll
BHO-{E4648039-1C0E-4C9E-9E34-75745EE244F5} - (no file)
ShellExecuteHooks-{F77BBE3B-9C38-47F6-99D7-B79B453D0F50} - C:\WINDOWS\system32\nnnoOGAq.dll
ShellExecuteHooks-{DA2E0515-F0D5-4773-8191-400CCD50783B} - C:\WINDOWS\system32\yayxyATn.dll
Notify-acpie - acpie.dll
Notify-nnnoOGAq - nnnoOGAq.dll
Notify-winrzf32 - winrzf32.dll

.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\IBM Owner\Application Data\Mozilla\Firefox\Profiles\1g2hdwin.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.gmail.com
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-26 00:11:17
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\itwzoxkn.exe 90112 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PCD5SRVC{DF187064-5DA14001-05040000}]
"ImagePath "= "\??\C:\PROGRA~1\PCDR5\PCD5SRVC.pkms "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\tphklock.dll

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\RocketDock\RocketDock.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\system32\TPHDEXLG.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Lenovo\System Update\SUService.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\FomboCix\pv.cfexe
.
**************************************************************************
.
Completion time: 2008-09-26 0:13:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-26 07:13:54

Pre-Run: 145,232,445,440 bytes free
Post-Run: 145,156,939,776 bytes free

370 --- E O F --- 2008-09-18 05:00:22

noahdfear · 2008/09/27

Please run ComboFix again and post the new log.

Riser · 2008/09/27

ComboFix 08-09-26.01 - IBM Owner 2008-09-27 14:04:29.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.481 [GMT -7:00]
Running from: C:\Documents and Settings\IBM Owner\Desktop\FomboCix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-08-27 to 2008-09-27 )))))))))))))))))))))))))))))))
.

2008-10-01 06:30 . 2008-09-25 18:52 7 --a------ C:\WINDOWS\system32\axt.bin
2008-09-30 19:50 . 2008-09-30 19:50 137,728 --a------ C:\ybwnngu.exe
2008-09-30 19:50 . 2008-09-30 19:50 104,960 --a------ C:\WINDOWS\stfMeane1535.exe
2008-09-30 19:50 . 2008-09-30 19:50 96,768 --a------ C:\fveia.exe
2008-09-30 19:50 . 2008-09-30 19:50 69,632 --a------ C:\jllw.exe
2008-09-30 19:50 . 2008-09-30 19:50 22,016 --a------ C:\kcxl.exe
2008-09-30 19:50 . 2008-09-30 19:50 10,000 --a------ C:\WINDOWS\system32\gks834t.dll
2008-09-30 19:50 . 2008-09-30 19:50 8,608 --a------ C:\WINDOWS\system32\acpu.sys
2008-09-30 19:50 . 2008-09-30 19:50 6,144 --a------ C:\ggseqxs.exe
2008-09-30 19:24 . 2008-09-30 19:25 95,232 --a------ C:\WINDOWS\system32\esohujec.dll
2008-09-30 18:31 . 2008-09-26 05:42 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-30 18:19 . 2008-09-30 18:19 95,232 --a------ C:\WINDOWS\system32\ugeqqqje.dll
2008-09-30 18:17 . 2008-09-30 18:17 95,232 --a------ C:\WINDOWS\system32\prgfpdla.dll
2008-09-30 18:10 . 2008-09-30 18:10 95,232 --a------ C:\WINDOWS\system32\ubenydvw.dll
2008-09-30 18:07 . 2008-09-30 18:07 95,232 --a------ C:\WINDOWS\system32\bkjxypph.dll
2008-09-26 00:11 . 2008-09-26 00:11 90,112 --a------ C:\WINDOWS\system32\itwzoxkn.exe
2008-09-25 23:17 . 2008-09-25 23:17 90,112 --a------ C:\WINDOWS\system32\fcjefsdi.exe
2008-09-25 22:08 . 2008-09-25 22:08 <DIR> d-------- C:\Program Files\Microsoft Diagnostics and Recovery Toolset
2008-09-25 22:06 . 2008-09-25 22:06 <DIR> d-------- C:\Program Files\Alex Feinman
2008-09-25 22:00 . 2008-09-25 22:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\hyrinmfk
2008-09-25 22:00 . 2008-09-25 22:00 90,112 --a------ C:\WINDOWS\system32\kpaxebax.exe
2008-09-25 19:24 . 2008-09-25 19:24 <DIR> d--h----- C:\WINDOWS\system32\WLANProfiles
2008-09-25 19:02 . 2008-09-25 19:02 84,680 --a------ C:\WINDOWS\system32\_BLOCK.WB4
2008-09-25 15:06 . 2008-09-25 23:05 733 --a------ C:\WINDOWS\wininit.ini
2008-09-25 13:31 . 2008-09-25 13:31 71,168 --a------ C:\WINDOWS\system32\jvcankwx.dll
2008-09-25 13:27 . 2008-09-25 13:27 128,000 --a------ C:\WINDOWS\system32\wucdymbd.dll
2008-09-25 13:27 . 2008-09-25 13:27 128,000 --a------ C:\WINDOWS\system32\mgoocx.dll
2008-09-24 21:35 . 2008-09-24 21:36 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-09-24 21:35 . 2008-09-24 21:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-24 16:47 . 2008-09-30 18:08 <DIR> d-------- C:\Program Files\thriXXX
2008-09-23 21:55 . 2008-09-30 19:51 <DIR> d-------- C:\Program Files\Google
2008-09-23 16:58 . 2008-09-23 16:58 <DIR> d-------- C:\Program Files\iPod
2008-09-23 16:58 . 2008-09-23 16:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-23 14:15 . 2008-09-23 14:15 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\Final Draft
2008-09-23 14:14 . 2008-09-23 14:14 <DIR> d-------- C:\Program Files\Final Draft Tagger
2008-09-23 14:14 . 2008-09-23 14:14 <DIR> d-------- C:\Program Files\Final Draft 7
2008-09-23 14:14 . 2008-09-23 14:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Final Draft
2008-09-23 14:13 . 2008-09-23 14:13 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-23 13:12 . 2008-09-23 13:12 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2008-09-23 11:42 . 2008-09-23 11:42 <DIR> d-------- C:\Program Files\iShut
2008-09-23 11:42 . 2008-09-23 11:42 <DIR> d-------- C:\Program Files\ForceQuit
2008-09-23 11:05 . 1986-09-24 17:59 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\LimeWire
2008-09-23 06:55 . 2008-09-23 06:55 <DIR> d-------- C:\Program Files\Menu Bar
2008-09-23 02:08 . 2008-09-23 02:08 <DIR> d-------- C:\Program Files\Object Desktop
2008-09-23 02:07 . 2008-09-23 02:07 <DIR> d-------- C:\WINDOWS\Sun
2008-09-23 01:33 . 2008-09-23 01:33 7,852 --a------ C:\WINDOWS\system32\mcdmsg7.dll
2008-09-23 00:58 . 2008-09-22 23:57 139,541 --a------ C:\Leopard_2_0_by_neodesktop.rar
2008-09-23 00:43 . 2008-09-23 00:43 0 --------- C:\WINDOWS\WB.ini
2008-09-23 00:20 . 2008-09-23 00:20 <DIR> d-------- C:\Program Files\Stardock
2008-09-23 00:20 . 2008-04-13 17:12 218,624 --a--c--- C:\WINDOWS\system32\dllcache\uxtheme.dll
2008-09-23 00:20 . 2008-04-26 16:14 42,672 --a------ C:\WINDOWS\system32\wbsys.dll
2008-09-23 00:19 . 2008-09-23 00:19 <DIR> d-------- C:\Program Files\WinCustomize
2008-09-22 08:36 . 2008-09-22 08:36 <DIR> d-------- C:\Program Files\YzShadow
2008-09-22 08:36 . 2008-09-22 08:36 <DIR> d-------- C:\Program Files\WinRoll
2008-09-22 08:35 . 2008-09-25 21:50 <DIR> d-------- C:\Program Files\Tiger System Preferences v2
2008-09-22 08:35 . 2008-09-23 14:58 <DIR> d-------- C:\Program Files\SearchSpy
2008-09-22 08:35 . 2008-09-22 08:35 <DIR> d-------- C:\Program Files\RK Launcher
2008-09-22 08:35 . 2008-09-22 08:35 <DIR> d-------- C:\Program Files\ObjectDock
2008-09-22 08:35 . 2008-09-22 08:35 2,179,584 --a------ C:\WINDOWS\system32\osxboot.exe
2008-09-22 08:30 . 2008-09-27 14:10 <DIR> d--h----- C:\WINDOWS\FlyakiteOSX
2008-09-21 23:10 . 2008-09-22 07:59 <DIR> d-------- C:\Program Files\RocketDock
2008-09-21 20:57 . 2008-09-21 20:57 <DIR> d--h----- C:\WINDOWS\PIF
2008-09-21 20:57 . 2008-09-21 21:08 <DIR> d-------- C:\Program Files\Finderbar 1.5
2008-09-21 20:57 . 2008-09-21 21:04 39,424 --a------ C:\WINDOWS\zipinst.exe
2008-09-21 20:56 . 2008-09-25 21:27 24 --a------ C:\WINDOWS\LogonStudio.ini
2008-09-21 20:55 . 2000-05-17 09:52 187,392 --a------ C:\WINDOWS\system32\JPGUtils.dll
2008-09-21 19:44 . 2008-04-13 17:12 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-09-21 18:33 . 2008-09-21 18:33 <DIR> d-------- C:\Program Files\Java
2008-09-21 18:33 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-09-21 18:32 . 2008-09-21 18:32 <DIR> d-------- C:\Program Files\Common Files\Java
2008-09-21 18:23 . 2008-09-21 18:33 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\Wyzo
2008-09-21 18:23 . 2008-09-21 18:23 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\.wyzo
2008-09-21 18:21 . 2008-09-21 18:21 <DIR> d-------- C:\Program Files\Wyzo
2008-09-20 19:07 . 2008-09-20 19:07 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\Apple Computer
2008-09-20 19:06 . 2008-09-23 16:58 <DIR> d-------- C:\Program Files\iTunes
2008-09-20 19:06 . 2008-04-17 13:12 107,368 --a------ C:\WINDOWS\system32\GEARAspi.dll
2008-09-20 19:06 . 2008-04-17 13:12 15,464 --a------ C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
2008-09-20 19:05 . 2008-09-20 19:05 <DIR> d-------- C:\Program Files\QuickTime
2008-09-20 19:05 . 2008-09-20 19:05 <DIR> d-------- C:\Program Files\Apple Software Update
2008-09-20 19:05 . 2008-09-20 19:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-20 19:04 . 2008-09-20 19:05 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-09-20 19:04 . 2008-09-20 19:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-09-20 18:20 . 2008-09-20 18:20 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\ATI
2008-09-20 18:20 . 2008-09-20 18:20 <DIR> d-------- C:\Documents and Settings\Guest
2008-09-20 17:36 . 2008-09-20 17:37 44 --a------ C:\WINDOWS\SMWizard.INI
2008-09-19 16:37 . 2008-09-19 16:37 0 --a------ C:\WINDOWS\nsreg.dat
2008-09-19 16:34 . 2008-09-26 07:05 <DIR> d-------- C:\Program Files\Celtx
2008-09-19 16:34 . 2008-09-19 16:34 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\Greyfirst
2008-09-19 16:27 . 2008-09-19 16:27 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Avaya
2008-09-19 14:22 . 2008-09-19 14:22 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Intel
2008-09-17 21:57 . 2008-09-17 21:57 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-09-17 21:37 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-09-17 21:37 . 2008-09-17 21:37 376 --a------ C:\WINDOWS\ODBC.INI
2008-09-17 21:36 . 2008-09-17 21:36 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-09-17 21:36 . 2008-09-17 21:36 <DIR> d-------- C:\Program Files\Common Files\L&H
2008-09-17 21:35 . 2008-09-17 21:36 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-09-17 21:35 . 2008-09-17 21:35 <DIR> d-------- C:\Program Files\Microsoft Works
2008-09-17 21:34 . 2008-06-13 04:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-17 21:32 . 2008-05-08 07:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-09-17 21:31 . 2008-09-17 21:31 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-09-17 21:30 . 2008-09-17 21:30 <DIR> dr-h----- C:\MSOCache
2008-09-17 21:27 . 2008-04-11 12:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-09-17 21:27 . 2008-05-01 07:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-09-17 21:15 . 2008-09-17 21:15 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-09-17 21:15 . 2008-09-17 21:15 <DIR> d-------- C:\WINDOWS\system32\en
2008-09-17 21:15 . 2008-09-17 21:15 <DIR> d-------- C:\WINDOWS\system32\bits
2008-09-17 21:15 . 2008-09-17 21:15 <DIR> d-------- C:\WINDOWS\l2schemas
2008-09-17 21:12 . 2008-09-17 21:16 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-09-17 20:54 . 2004-08-03 22:29 327,040 --------- C:\WINDOWS\system32\drivers\ati2mtaa.sys
2008-09-17 20:53 . 2004-08-03 22:29 63,663 --------- C:\WINDOWS\system32\drivers\ati1rvxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 56,623 --------- C:\WINDOWS\system32\drivers\ati1btxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 36,463 --------- C:\WINDOWS\system32\drivers\ati1tuxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 34,735 --------- C:\WINDOWS\system32\drivers\ati1xsxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 30,671 --------- C:\WINDOWS\system32\drivers\ati1raxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 29,455 --------- C:\WINDOWS\system32\drivers\ati1xbxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 26,367 --------- C:\WINDOWS\system32\drivers\ati1snxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 21,343 --------- C:\WINDOWS\system32\drivers\ati1ttxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 12,047 --------- C:\WINDOWS\system32\drivers\ati1pdxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 11,615 --------- C:\WINDOWS\system32\drivers\ati1mdxx.sys
2008-09-17 20:08 . 2008-09-17 22:00 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-09-17 20:08 . 2007-08-10 20:46 26,488 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-09-17 20:06 . 2008-07-18 22:10 45,768 --a------ C:\WINDOWS\system32\wups2.dll
2008-09-17 20:06 . 2008-07-18 22:10 33,992 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-09-17 20:06 . 2008-07-18 22:09 25,800 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-09-17 20:06 . 2008-07-18 22:09 25,800 --a------ C:\WINDOWS\system32\wuapi.dll.mui

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-24 21:36 147,456 ----a-w C:\WINDOWS\fbxrqtwn.exe
2008-09-18 02:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-18 02:46 --------- d-----w C:\Program Files\Common Files\Lenovo
2008-09-18 02:44 33,536 ----a-w C:\WINDOWS\system32\drivers\tvtfilter.sys
2008-09-18 02:44 30,144 ----a-w C:\WINDOWS\system32\drivers\psadd.sys
2008-09-18 02:44 --------- d-----w C:\Program Files\Lenovo
2008-09-18 02:43 7,012 ----a-w C:\WINDOWS\system32\drivers\pmemnt.sys
2008-09-18 02:35 0 ---ha-r C:\WINDOWS\system32\drivers\IBM_2678_A44_TP.MRK
2008-09-18 00:36 --------- d-----w C:\Program Files\Broadcom
2008-09-18 00:34 --------- d-----w C:\Documents and Settings\IBM Owner\Application Data\ATI
2008-09-18 00:32 --------- d-----w C:\Program Files\ATI Technologies
2008-09-18 00:31 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-18 00:25 --------- d-----w C:\Program Files\Foxit Software
2008-09-18 00:09 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-16 03:12 4,224 ----a-w C:\WINDOWS\system32\drivers\IBMBLDID.sys
2008-08-16 03:12 11,520 ----a-w C:\WINDOWS\system32\drivers\ANC.sys
1986-09-25 01:40 53,248 --sha-w C:\WINDOWS\system32\efcccdBr.dll
.

------- Sigcheck -------

2002-12-31 05:00 577024 c72661f8552ace7c5c85e16a3cf505c4 C:\WINDOWS\$NtServicePackUninstall$\user32.dll
2008-04-13 17:12 578560 b26b135ff1b9f60c9388b4a7d16f600b C:\WINDOWS\FlyakiteOSX\Backup\user32.dll
2008-04-13 17:12 578048 ae179e8b06437cc629db4b521740ba24 C:\WINDOWS\ServicePackFiles\i386\user32.dll
2008-04-13 17:12 578560 b26b135ff1b9f60c9388b4a7d16f600b C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\user32.dll
2008-04-13 17:12 578048 ae179e8b06437cc629db4b521740ba24 C:\WINDOWS\system32\user32.dll

2008-06-23 09:01 827904 c66402a06b83b036c195242c0c8cf83c C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
2008-06-23 09:57 826368 8c13d4a7479fa0a026eda8abce82c0ed C:\WINDOWS\FlyakiteOSX\Backup\wininet.dll
2002-12-31 05:00 656384 c0823fc5469663ba63e7db88f9919d70 C:\WINDOWS\ie7\wininet.dll
2007-08-13 18:54 818688 a4a0fc92358f39538a6494c42ef99fe9 C:\WINDOWS\ie7updates\KB953838-IE7\wininet.dll
2008-06-23 09:57 803840 3a29a6c233d2c16cb7f405a9c44c6bb1 C:\WINDOWS\ServicePackFiles\i386\wininet.dll
2008-06-23 09:57 826368 8c13d4a7479fa0a026eda8abce82c0ed C:\WINDOWS\SoftwareDistribution\Download\b4e75dba041bc21ee94fbcfa88cb49de\SP2GDR\wininet.dll
2008-06-23 09:01 827904 c66402a06b83b036c195242c0c8cf83c C:\WINDOWS\SoftwareDistribution\Download\b4e75dba041bc21ee94fbcfa88cb49de\SP2QFE\wininet.dll
2008-04-13 17:12 666112 7a4f775abb2f1c97def3e73afa2faedd C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\wininet.dll
2008-06-23 09:57 803840 3a29a6c233d2c16cb7f405a9c44c6bb1 C:\WINDOWS\system32\wininet.dll
2008-06-23 09:57 803840 3a29a6c233d2c16cb7f405a9c44c6bb1 C:\WINDOWS\system32\dllcache\wininet.dll

2008-04-13 17:12 2823168 d641db52c7fe1df7202a5405a203ce75 C:\WINDOWS\explorer.exe
2002-12-31 05:00 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2008-04-13 17:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\FlyakiteOSX\Backup\explorer.exe
2008-04-13 17:12 2823168 d641db52c7fe1df7202a5405a203ce75 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
2008-04-13 17:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\explorer.exe
.
((((((((((((((((((((((((((((( snapshot@2008-09-26_ 0.13.33.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-14 00:11:56 2,061,824 ----a-w C:\WINDOWS\FlyakiteOSX\TempFiles\mstscax.dll
+ 2008-09-27 21:09:57 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_704.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C5BF49A2-94F3-42BD-F434-3604812C897D}]
2008-09-30 19:50 10000 --a------ C:\WINDOWS\system32\gks834t.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock "= "C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"SpybotSD TeaTimer "= "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]
"MntComMsg "= "C:\WINDOWS\system32\kpaxebax.exe" [2008-09-25 90112]
"ProcAplCom "= "C:\WINDOWS\system32\fcjefsdi.exe" [2008-09-25 90112]
"SrvSh "= "C:\WINDOWS\system32\itwzoxkn.exe" [2008-09-26 90112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC "= "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"TVT Scheduler Proxy "= "C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-05-14 487424]
"TPHOTKEY "= "C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-10-02 94208]
"EZEJMNAP "= "C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2008-06-05 242976]
"PWRMGRTR "= "C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2008-07-29 331776]
"BLOG "= "C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2008-07-29 208896]
"ACTray "= "C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe" [2008-08-15 425984]
"ACWLIcon "= "C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2008-08-15 143360]
"SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-07-03 1323008]
"SoundMAXPnP "= "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-09-06 413696]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"System Files Updater "= "C:\WINDOWS\FlyakiteOSX\System Files Updater.exe" [2006-01-14 153233]
"iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"TpShocks "= "TpShocks.exe" [2008-06-06 C:\WINDOWS\system32\TpShocks.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"UETmGi7RDG "= "C:\Documents and Settings\All Users\Application Data\hyrinmfk\lqvqdijo.exe" [2008-09-25 65536]

C:\Documents and Settings\IBM Owner\Start Menu\Programs\Startup\
CCC.lnk - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-09-29 49152]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-09-17 24576]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{C5BF49A2-94F3-42BD-F434-3604812C897D} "= "C:\WINDOWS\system32\gks834t.dll" [2008-09-30 10000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost "= "C:\\WINDOWS\\system32\\logonuiX.exe "

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
2008-08-15 21:37 32768 C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2005-07-05 23:45 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2005-11-30 20:16 24576 C:\WINDOWS\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=wbsys.dll mgoocx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ACGina

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\npf.sys]
@= "Driver "

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"C:\\WINDOWS\\system32\\dpvsetup.exe "=
"C:\\Program Files\\Wyzo\\wyzo.exe "=
"C:\\Program Files\\iTunes\\iTunes.exe "=

R0 Shockprf;Shockprf;C:\WINDOWS\system32\DRIVERS\Apsx86.sys [2008-05-14 114728]
R0 TPDIGIMN;TPDIGIMN;C:\WINDOWS\system32\DRIVERS\ApsHM86.sys [2008-05-14 19496]
R0 TPDiskPM;TPDiskPM;C:\WINDOWS\system32\drivers\TPDiskPM.sys [2006-09-26 14848]
R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2008-08-15 11520]
R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\Drivers\IBMBLDID.sys [2008-08-15 4224]
R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys [2008-07-29 4442]
R1 tvtumon;tvtumon;C:\WINDOWS\system32\DRIVERS\tvtumon.sys [2008-05-09 46144]
R2 Power Manager DBC Service;Power Manager DBC Service;C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE [2008-07-29 94208]
R2 TVT Backup Protection Service;TVT Backup Protection Service;C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [2008-05-14 520192]
R2 TVT_UpdateMonitor;TVT Windows Update Monitor;C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [2008-05-09 253952]
R3 TPInput;TPInput;C:\WINDOWS\system32\DRIVERS\TPInput.sys [2006-09-26 6528]
R3 TVTI2C;Lenovo SM bus driver;C:\WINDOWS\system32\DRIVERS\Tvti2c.sys [2008-02-22 37312]
S3 PCD5SRVC{DF187064-5DA14001-05040000};PCD5SRVC{DF187064-5DA14001-05040000} - PCDR Kernel Mode Service Helper Driver;C:\PROGRA~1\PCDR5\PCD5SRVC.pkms [2007-12-10 21280]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9b17c070-8517-11dd-bc46-8a5dd6341dba}]
\Shell\AutoRun\command - E:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\IBM Owner\Application Data\Mozilla\Firefox\Profiles\1g2hdwin.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.gmail.com
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-27 14:10:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PCD5SRVC{DF187064-5DA14001-05040000}]
"ImagePath "= "\??\C:\PROGRA~1\PCDR5\PCD5SRVC.pkms "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\tphklock.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\system32\TPHDEXLG.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\Lenovo\System Update\SUService.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-09-27 14:13:14 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-27 21:13:10
ComboFix2.txt 2008-09-26 07:14:00

Pre-Run: 145,167,732,736 bytes free
Post-Run: 145,150,738,432 bytes free

317 --- E O F --- 2008-09-18 05:00:22

noahdfear · 2008/09/27

Please download Malwarebytes' Anti-Malware (MBAM) from here or here and save the file to your desktop.

Double click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded, select 'Perform Quick Scan', then click Scan.

The scan may take some time to finish,so please be patient.

When the scan is complete, click OK, then Show Results to view the results.

Make sure that everything is checked, and click Remove Selected.

When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)

The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.

Post the entire report in your next reply.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Riser · 2008/09/27

Malwarebytes' Anti-Malware 1.28
Database version: 1215
Windows 5.1.2600 Service Pack 3

9/27/2008 2:57:22 PM
mbam-log-2008-09-27 (14-57-22).txt

Scan type: Quick Scan
Objects scanned: 46150
Time elapsed: 2 minute(s), 57 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 2
Registry Keys Infected: 8
Registry Values Infected: 5
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 17

Memory Processes Infected:
C:\Documents and Settings\IBM Owner\Local Settings\temp\csrssc.exe (Trojan.Clicker) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\gks834t.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\system32\mgoocx.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{c5bf49a2-94f3-42bd-f434-3604812c897d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c5bf49a2-94f3-42bd-f434-3604812c897d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1a40dfa2-2417-4acf-a56f-bdbe0833cd3e} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instbndlkeyldr (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\peltodgx.bqwv (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\peltodgx.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mntcommsg (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\procaplcom (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\uetmgi7rdg (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{c5bf49a2-94f3-42bd-f434-3604812c897d} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jnskdfmf9eldfd (Trojan.Clicker) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\kpaxebax.exe (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fcjefsdi.exe (Trojan.FakeAlert.H) -> Delete on reboot.
C:\Documents and Settings\All Users\Application Data\hyrinmfk\lqvqdijo.exe (Trojan.FakeAlert.H) -> Delete on reboot.
C:\WINDOWS\system32\gks834t.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\system32\mgoocx.dll (Trojan.Vundo) -> Delete on reboot.
C:\Documents and Settings\IBM Owner\Local Settings\temp\csrssc.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\WINDOWS\stfMeane1535.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\fbxrqtwn.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jvcankwx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wucdymbd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\efcccdBr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\fveia.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\ggseqxs.exe (Trojan,Agent) -> Quarantined and deleted successfully.
C:\jllw.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\kcxl.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\ybwnngu.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\acpu.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

noahdfear · 2008/09/27

Looks like we're making progress.

Download RSIT by random/random and save it to your desktop.

Double click RSIT.exe to start the tool.

At the disclaimer, please use the drop down box to select 3 months for the file/folder search, then click Continue.

When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.

Please post the contents of log.txt here in your next reply.

Riser · 2008/09/27

Logfile of random's system information tool 1.02 (written by random/random)
Run by IBM Owner at 2008-09-27 15:17:30
Microsoft Windows XP Professional Service Pack 3
System drive C: has 138 GB (91%) free of 153 GB
Total RAM: 1022 MB (33% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:17, on 9/27/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\System32\TPHDEXLG.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
C:\Program Files\Lenovo\System Update\SUService.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TpShocks.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\itwzoxkn.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\itwzoxkn.exe
C:\Documents and Settings\IBM Owner\Desktop\RSIT.exe
C:\Program Files\trend micro\IBM Owner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {C5BF49A2-94F3-42BD-F434-3604812C897D} - (no file)
O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [PWRMGRTR] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL,PwrMgrBkGndMonitor
O4 - HKLM\..\Run: [BLOG] rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog
O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\System Files Updater.exe /S
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe "
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SrvSh] C:\WINDOWS\system32\itwzoxkn.exe
O4 - Startup: CCC.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O14 - IERESET.INF: START_PAGE_URL=http://www.google.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1221707123968
O20 - AppInit_DLLs: wbsys.dll mgoocx.dll
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Power Manager DBC Service - Unknown owner - C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: System Update (SUService) - Lenovo Group Limited - C:\Program Files\Lenovo\System Update\SUService.exe
O23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
O23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exe
O23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe
O23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
O23 - Service: TVT Windows Update Monitor (TVT_UpdateMonitor) - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe

--
End of file - 7972 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\PMTask.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C5BF49A2-94F3-42BD-F434-3604812C897D}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"StartCCC "=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]
"TVT Scheduler Proxy "=C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe [2008-05-14 487424]
"TPHOTKEY "=C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe [2006-10-02 94208]
"EZEJMNAP "=C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe [2008-06-05 242976]
"PWRMGRTR "=rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL []
"BLOG "=rundll32 C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL []
"ACTray "=C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe [2008-08-15 425984]
"ACWLIcon "=C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe [2008-08-15 143360]
"SynTPEnh "=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2008-07-03 1323008]
"TpShocks "=C:\WINDOWS\system32\TpShocks.exe [2008-06-06 181536]
"SoundMAXPnP "=C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2004-10-14 1388544]
"QuickTime Task "=C:\Program Files\QuickTime\qttask.exe [2008-09-06 413696]
"SunJavaUpdateSched "=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"System Files Updater "=C:\WINDOWS\FlyakiteOSX\System Files Updater.exe [2006-01-14 153233]
"iTunesHelper "=C:\Program Files\iTunes\iTunesHelper.exe [2008-09-10 289576]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"RocketDock "=C:\Program Files\RocketDock\RocketDock.exe [2007-09-02 495616]
"ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"SpybotSD TeaTimer "=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [2008-07-07 2156368]
"SrvSh "=C:\WINDOWS\system32\itwzoxkn.exe [2008-09-26 90112]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe

C:\Documents and Settings\IBM Owner\Start Menu\Programs\Startup
CCC.lnk - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS "= "wbsys.dll mgoocx.dll "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ACNotify]
C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll [2008-08-15 32768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2007-06-21 118784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tpfnf2]
C:\WINDOWS\system32\notifyf2.dll [2005-07-05 28672]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tphotkey]
C:\WINDOWS\system32\tphklock.dll [2005-11-30 24576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
0aMCPClient - {F5DF91F9-15E9-416B-A7C3-7519B11ECBFC}

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages "=scecli
ACGina

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\npf.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\npf.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername "=0
"legalnoticecaption "=
"legalnoticetext "=
"shutdownwithoutlogon "=1
"undockwithoutlogon "=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives "=0
"NoFolderOptions "=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun "=
"NoDrives "=
"NoDriveAutoRun "=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 "
"%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 "
"C:\WINDOWS\system32\dpvsetup.exe "= "C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test "
"C:\Program Files\Wyzo\wyzo.exe "= "C:\Program Files\Wyzo\wyzo.exe:*:Enabled:Wyzo "
"C:\Program Files\iTunes\iTunes.exe "= "C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes "

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabledxpsp2res.dll,-22019 "
"%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000 "

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9b17c070-8517-11dd-bc46-8a5dd6341dba}]
shell\AutoRun\command - E:\setupSNK.exe

======List of files/folders created in the last 3 months======

2008-10-01 06:24:43 ----SHD---- C:\WINDOWS\CSC
2008-10-01 06:19:43 ----A---- C:\WINDOWS\ntbtlog.txt
2008-09-30 19:52:01 ----D---- C:\WINDOWS\Minidump
2008-09-30 19:24:59 ----A---- C:\WINDOWS\system32\esohujec.dll
2008-09-30 18:31:14 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-30 18:19:33 ----A---- C:\WINDOWS\system32\ugeqqqje.dll
2008-09-30 18:17:23 ----A---- C:\WINDOWS\system32\prgfpdla.dll
2008-09-30 18:10:22 ----A---- C:\WINDOWS\system32\ubenydvw.dll
2008-09-30 18:07:22 ----A---- C:\WINDOWS\system32\bkjxypph.dll
2008-09-27 15:17:30 ----D---- C:\rsit
2008-09-27 15:17:30 ----D---- C:\Program Files\trend micro
2008-09-27 15:02:23 ----SHD---- C:\RECYCLER
2008-09-27 14:45:54 ----D---- C:\Documents and Settings\IBM Owner\Application Data\Malwarebytes
2008-09-27 14:45:49 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-27 14:45:49 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-27 14:13:14 ----A---- C:\ComboFix.txt
2008-09-26 00:11:19 ----A---- C:\WINDOWS\system32\itwzoxkn.exe
2008-09-25 23:56:30 ----D---- C:\WINDOWS\erdnt
2008-09-25 23:55:52 ----A---- C:\WINDOWS\Nircmd.exe
2008-09-25 23:55:51 ----A---- C:\WINDOWS\zip.exe
2008-09-25 23:55:51 ----A---- C:\WINDOWS\VFind.exe
2008-09-25 23:55:51 ----A---- C:\WINDOWS\swxcacls.exe
2008-09-25 23:55:51 ----A---- C:\WINDOWS\SWSC.exe
2008-09-25 23:55:51 ----A---- C:\WINDOWS\swreg.exe
2008-09-25 23:55:51 ----A---- C:\WINDOWS\sed.exe
2008-09-25 23:55:51 ----A---- C:\WINDOWS\grep.exe
2008-09-25 23:55:51 ----A---- C:\WINDOWS\fdsv.exe
2008-09-25 23:15:08 ----D---- C:\Program Files\msn gaming zone
2008-09-25 22:08:22 ----D---- C:\Program Files\Microsoft Diagnostics and Recovery Toolset
2008-09-25 22:06:52 ----D---- C:\Program Files\Alex Feinman
2008-09-25 22:00:27 ----D---- C:\Documents and Settings\All Users\Application Data\hyrinmfk
2008-09-25 21:38:16 ----SHD---- C:\Config.Msi
2008-09-25 21:21:16 ----D---- C:\Qoobox
2008-09-25 19:24:20 ----HD---- C:\WINDOWS\system32\WLANProfiles
2008-09-25 15:06:08 ----A---- C:\WINDOWS\wininit.ini
2008-09-24 21:35:50 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-09-24 21:35:50 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-24 16:47:33 ----D---- C:\Program Files\thriXXX
2008-09-23 21:55:54 ----D---- C:\Program Files\Google
2008-09-23 16:58:13 ----D---- C:\Program Files\iPod
2008-09-23 16:58:10 ----D---- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-23 14:46:48 ----D---- C:\WINDOWS\system32\appmgmt
2008-09-23 14:15:20 ----D---- C:\Documents and Settings\IBM Owner\Application Data\Final Draft
2008-09-23 14:14:09 ----D---- C:\Documents and Settings\All Users\Application Data\Final Draft
2008-09-23 14:14:01 ----D---- C:\Program Files\Final Draft Tagger
2008-09-23 14:14:01 ----D---- C:\Program Files\Final Draft 7
2008-09-23 14:13:43 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-23 13:12:44 ----A---- C:\WINDOWS\_MSRSTRT.EXE
2008-09-23 11:42:59 ----D---- C:\Program Files\iShut
2008-09-23 11:42:58 ----D---- C:\Program Files\ForceQuit
2008-09-23 11:05:50 ----D---- C:\Documents and Settings\IBM Owner\Application Data\LimeWire
2008-09-23 06:55:26 ----D---- C:\Program Files\Menu Bar
2008-09-23 02:08:42 ----D---- C:\Program Files\Object Desktop
2008-09-23 02:07:10 ----D---- C:\WINDOWS\Sun
2008-09-23 02:07:10 ----D---- C:\Documents and Settings\IBM Owner\Application Data\Sun
2008-09-23 01:33:17 ----A---- C:\WINDOWS\system32\mcdmsg7.dll
2008-09-23 01:01:57 ----D---- C:\Documents and Settings\IBM Owner\Application Data\WinRAR
2008-09-23 01:01:38 ----D---- C:\Program Files\WinRAR
2008-09-23 00:43:25 ----N---- C:\WINDOWS\WB.ini
2008-09-23 00:20:56 ----A---- C:\WINDOWS\system32\wbsys.dll
2008-09-23 00:20:54 ----D---- C:\Program Files\Stardock
2008-09-23 00:19:10 ----D---- C:\Program Files\WinCustomize
2008-09-22 08:36:04 ----D---- C:\Program Files\YzShadow
2008-09-22 08:36:03 ----D---- C:\Program Files\WinRoll
2008-09-22 08:35:59 ----D---- C:\Program Files\Tiger System Preferences v2
2008-09-22 08:35:54 ----D---- C:\Program Files\SearchSpy
2008-09-22 08:35:42 ----D---- C:\Program Files\RK Launcher
2008-09-22 08:35:40 ----D---- C:\Program Files\ObjectDock
2008-09-22 08:35:27 ----A---- C:\WINDOWS\system32\osxboot.exe
2008-09-22 08:30:54 ----HD---- C:\WINDOWS\FlyakiteOSX
2008-09-21 23:10:08 ----D---- C:\Program Files\RocketDock
2008-09-21 20:57:47 ----A---- C:\WINDOWS\zipinst.exe
2008-09-21 20:57:46 ----HD---- C:\WINDOWS\PIF
2008-09-21 20:57:44 ----D---- C:\Program Files\Finderbar 1.5
2008-09-21 20:56:05 ----A---- C:\WINDOWS\LogonStudio.ini
2008-09-21 20:55:41 ----A---- C:\WINDOWS\system32\JPGUtils.dll
2008-09-21 20:05:25 ----A---- C:\moduleName.txt
2008-09-21 19:44:32 ----A---- C:\WINDOWS\system32\wmpns.dll
2008-09-21 19:41:30 ----A---- C:\WINDOWS\RestoreFlyakiteOSX.txt
2008-09-21 18:33:55 ----A---- C:\WINDOWS\system32\javaws.exe
2008-09-21 18:33:55 ----A---- C:\WINDOWS\system32\javaw.exe
2008-09-21 18:33:55 ----A---- C:\WINDOWS\system32\java.exe
2008-09-21 18:33:04 ----D---- C:\Program Files\Java
2008-09-21 18:32:40 ----D---- C:\Program Files\Common Files\Java
2008-09-21 18:23:07 ----D---- C:\Documents and Settings\IBM Owner\Application Data\Wyzo
2008-09-21 18:23:07 ----D---- C:\Documents and Settings\IBM Owner\Application Data\.wyzo
2008-09-21 18:21:33 ----D---- C:\Program Files\Wyzo
2008-09-21 12:48:48 ----A---- C:\WINDOWS\ModemLog_ThinkPad Integrated 56K Modem.txt
2008-09-20 19:07:02 ----D---- C:\Documents and Settings\IBM Owner\Application Data\Apple Computer
2008-09-20 19:06:53 ----A---- C:\WINDOWS\system32\GEARAspi.dll
2008-09-20 19:06:24 ----D---- C:\Program Files\iTunes
2008-09-20 19:05:20 ----D---- C:\Program Files\QuickTime
2008-09-20 19:05:18 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-20 19:05:01 ----D---- C:\Program Files\Apple Software Update
2008-09-20 19:04:10 ----D---- C:\Program Files\Common Files\Apple
2008-09-20 19:04:09 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2008-09-20 17:36:52 ----A---- C:\WINDOWS\SMWizard.INI
2008-09-19 16:36:44 ----D---- C:\Program Files\Mozilla Firefox
2008-09-19 16:34:13 ----D---- C:\Documents and Settings\IBM Owner\Application Data\Mozilla
2008-09-19 16:34:12 ----D---- C:\Documents and Settings\IBM Owner\Application Data\Greyfirst
2008-09-19 16:34:01 ----D---- C:\Program Files\Celtx
2008-09-19 16:31:12 ----D---- C:\Documents and Settings\IBM Owner\Application Data\Macromedia
2008-09-17 22:00:19 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-09-17 22:00:13 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-09-17 22:00:07 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-09-17 22:00:02 ----HDC---- C:\WINDOWS\$NtUninstallKB953839$
2008-09-17 21:59:55 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2008-09-17 21:59:50 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-09-17 21:59:45 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-09-17 21:59:34 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-09-17 21:57:29 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-09-17 21:57:23 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-09-17 21:57:18 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-09-17 21:57:11 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2008-09-17 21:57:05 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-09-17 21:57:00 ----D---- C:\Program Files\MSXML 4.0
2008-09-17 21:37:57 ----A---- C:\WINDOWS\ODBC.INI
2008-09-17 21:37:45 ----A---- C:\WINDOWS\system32\mdimon.dll
2008-09-17 21:36:36 ----D---- C:\Program Files\Common Files\L&H
2008-09-17 21:36:10 ----D---- C:\Program Files\Microsoft ActiveSync
2008-09-17 21:35:35 ----D---- C:\Program Files\Common Files\DESIGNER
2008-09-17 21:35:30 ----D---- C:\Program Files\Microsoft Works
2008-09-17 21:35:18 ----D---- C:\Program Files\Microsoft Visual Studio
2008-09-17 21:35:06 ----D---- C:\WINDOWS\SHELLNEW
2008-09-17 21:31:44 ----D---- C:\Program Files\Microsoft.NET
2008-09-17 21:31:44 ----D---- C:\Program Files\Microsoft Office
2008-09-17 21:30:30 ----RHD---- C:\MSOCache
2008-09-17 21:22:30 ----D---- C:\WINDOWS\Prefetch
2008-09-17 21:16:08 ----D---- C:\Program Files\Messenger
2008-09-17 21:15:32 ----D---- C:\WINDOWS\system32\scripting
2008-09-17 21:15:30 ----D---- C:\WINDOWS\l2schemas
2008-09-17 21:15:29 ----D---- C:\WINDOWS\system32\en
2008-09-17 21:15:29 ----D---- C:\WINDOWS\system32\bits
2008-09-17 21:15:29 ----D---- C:\Program Files\msn
2008-09-17 21:12:38 ----D---- C:\WINDOWS\ServicePackFiles
2008-09-17 21:05:22 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2008-09-17 20:22:08 ----A---- C:\Log.txt
2008-09-17 20:20:35 ----D---- C:\WINDOWS\ie7updates
2008-09-17 20:20:15 ----D---- C:\WINDOWS\WBEM
2008-09-17 20:20:14 ----D---- C:\WINDOWS\system32\en-US
2008-09-17 20:19:02 ----HDC---- C:\WINDOWS\ie7
2008-09-17 20:18:52 ----HDC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
2008-09-17 20:18:39 ----HDC---- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
2008-09-17 20:18:24 ----HDC---- C:\WINDOWS\$NtUninstallKB915865$
2008-09-17 20:18:23 ----A---- C:\WINDOWS\system32\xmllite.dll
2008-09-17 20:17:27 ----A---- C:\WINDOWS\system32\MRT.exe
2008-09-17 20:17:23 ----D---- C:\WINDOWS\network diagnostic
2008-09-17 20:17:22 ----HDC---- C:\WINDOWS\$NtUninstallKB914440$
2008-09-17 20:17:20 ----A---- C:\WINDOWS\system32\xpsp3res.dll
2008-09-17 20:17:17 ----HDC---- C:\WINDOWS\$NtUninstallKB904942$
2008-09-17 20:08:36 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2008-09-17 20:08:25 ----D---- C:\WINDOWS\system32\PreInstall
2008-09-17 20:08:25 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2008-09-17 20:08:24 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2008-09-17 20:08:24 ----HD---- C:\WINDOWS\$hf_mig$
2008-09-17 20:06:05 ----A---- C:\WINDOWS\system32\wups2.dll
2008-09-17 20:06:05 ----A---- C:\WINDOWS\system32\wucltui.dll.mui
2008-09-17 20:06:04 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2008-09-17 20:06:04 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui
2008-09-17 20:06:04 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
2008-09-17 20:05:07 ----D---- C:\Documents and Settings\IBM Owner\Application Data\Adobe
2008-09-17 19:58:08 ----D---- C:\Documents and Settings\All Users\Application Data\CyberLink
2008-09-17 19:58:03 ----D---- C:\Program Files\CyberLink
2008-09-17 19:54:41 ----D---- C:\Documents and Settings\IBM Owner\Application Data\Intel
2008-09-17 19:53:33 ----A---- C:\WINDOWS\system32\ICAutoUpdate.log.bak
2008-09-17 19:52:36 ----RSHD---- C:\RRbackups
2008-09-17 19:49:31 ----A---- C:\WINDOWS\system32\ksuser.dll
2008-09-17 19:49:28 ----A---- C:\WINDOWS\system32\wdmioctl.dll
2008-09-17 19:49:28 ----A---- C:\WINDOWS\system32\SMMedia.dll
2008-09-17 19:49:27 ----D---- C:\Program Files\Analog Devices
2008-09-17 19:49:27 ----A---- C:\WINDOWS\system32\DSndUp.exe
2008-09-17 19:49:27 ----A---- C:\WINDOWS\system32\CleanUp.exe
2008-09-17 19:47:14 ----D---- C:\Documents and Settings\All Users\Application Data\PC-Doctor
2008-09-17 19:46:40 ----D---- C:\Program Files\PCDR5
2008-09-17 19:45:00 ----A---- C:\WINDOWS\system32\pxinsi64.exe

Riser · 2008/09/27

2008-09-17 19:45:00 ----A---- C:\WINDOWS\system32\pxinsa64.exe
2008-09-17 19:45:00 ----A---- C:\WINDOWS\system32\pxhpinst.exe
2008-09-17 19:45:00 ----A---- C:\WINDOWS\system32\pxcpyi64.exe
2008-09-17 19:45:00 ----A---- C:\WINDOWS\system32\pxcpya64.exe
2008-09-17 19:44:59 ----A---- C:\WINDOWS\system32\vxblock.dll
2008-09-17 19:44:59 ----A---- C:\WINDOWS\system32\pxwave.dll
2008-09-17 19:44:59 ----A---- C:\WINDOWS\system32\pxsfs.dll
2008-09-17 19:44:59 ----A---- C:\WINDOWS\system32\pxmas.dll
2008-09-17 19:44:59 ----A---- C:\WINDOWS\system32\pxdrv.dll
2008-09-17 19:44:59 ----A---- C:\WINDOWS\system32\pxafs.dll
2008-09-17 19:44:59 ----A---- C:\WINDOWS\system32\px.dll
2008-09-17 19:44:51 ----A---- C:\sysiclog.txt
2008-09-17 19:44:36 ----D---- C:\SWSHARE
2008-09-17 19:44:27 ----D---- C:\Drivers
2008-09-17 19:43:49 ----D---- C:\WINDOWS\Downloaded Installations
2008-09-17 19:41:18 ----D---- C:\Program Files\Digital Line Detect
2008-09-17 19:41:16 ----D---- C:\Program Files\NetWaiting
2008-09-17 19:41:08 ----D---- C:\Program Files\CONEXANT
2008-09-17 19:41:03 ----A---- C:\WINDOWS\system32\Uci32101.dll
2008-09-17 19:41:03 ----A---- C:\WINDOWS\system32\mdmxsdk.dll
2008-09-17 19:40:27 ----HDC---- C:\WINDOWS\$NtUninstallKB910728$
2008-09-17 19:39:31 ----A---- C:\WINDOWS\system32\results.txt
2008-09-17 19:39:04 ----D---- C:\Documents and Settings\All Users\Application Data\Intel
2008-09-17 19:38:42 ----A---- C:\WINDOWS\system32\Netw2r32.dll
2008-09-17 19:38:42 ----A---- C:\WINDOWS\system32\Netw2c32.dll
2008-09-17 19:38:37 ----D---- C:\Program Files\Intel
2008-09-17 19:37:15 ----HDC---- C:\WINDOWS\$NtUninstallKB896613$
2008-09-17 19:35:52 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-09-17 19:35:49 ----A---- C:\WINDOWS\system32\SynTPCo4.dll
2008-09-17 19:35:49 ----A---- C:\WINDOWS\system32\SynTPAPI.dll
2008-09-17 19:35:49 ----A---- C:\WINDOWS\system32\SynCtrl.dll
2008-09-17 19:35:49 ----A---- C:\WINDOWS\system32\SynCOM.dll
2008-09-17 19:35:48 ----D---- C:\Program Files\Synaptics
2008-09-17 19:35:27 ----A---- C:\WINDOWS\system32\tvt_gina_api.dll
2008-09-17 19:35:27 ----A---- C:\WINDOWS\system32\tvt_gina.dll
2008-09-17 19:35:27 ----A---- C:\WINDOWS\system32\MFC71.dll
2008-09-17 19:34:53 ----N---- C:\WINDOWS\PWMBTHLP.EXE
2008-09-17 19:34:29 ----D---- C:\Program Files\ThinkPad
2008-09-17 19:33:11 ----HDC---- C:\WINDOWS\$NtUninstallKB889816$
2008-09-17 17:37:35 ----D---- C:\WINDOWS\system32\(null)
2008-09-17 17:37:29 ----D---- C:\Program Files\Lenovo
2008-09-17 17:37:29 ----D---- C:\Program Files\Common Files\Lenovo
2008-09-17 17:36:08 ----DC---- C:\WINDOWS\system32\DRVSTORE
2008-09-17 17:36:07 ----D---- C:\Program Files\Broadcom
2008-09-17 17:34:25 ----D---- C:\Documents and Settings\IBM Owner\Application Data\ATI
2008-09-17 17:29:47 ----RSD---- C:\WINDOWS\assembly
2008-09-17 17:29:28 ----D---- C:\WINDOWS\Microsoft.NET
2008-09-17 17:29:06 ----A---- C:\WINDOWS\system32\spmsg.dll
2008-09-17 17:28:57 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2008-09-17 17:28:32 ----D---- C:\Program Files\ATI Technologies
2008-09-17 17:28:30 ----HD---- C:\Program Files\InstallShield Installation Information
2008-09-17 17:28:07 ----D---- C:\Program Files\Common Files\InstallShield
2008-09-17 17:25:20 ----D---- C:\Program Files\Foxit Software
2008-09-17 17:24:20 ----A---- C:\WINDOWS\system32\Oemdspif.dll
2008-09-17 17:24:19 ----A---- C:\WINDOWS\system32\ativvaxx.dll
2008-09-17 17:24:18 ----A---- C:\WINDOWS\system32\atitvo32.dll
2008-09-17 17:24:18 ----A---- C:\WINDOWS\system32\atipdlxx.dll
2008-09-17 17:24:18 ----A---- C:\WINDOWS\system32\atiok3x2.dll
2008-09-17 17:24:17 ----A---- C:\WINDOWS\system32\atioglxx.dll
2008-09-17 17:24:17 ----A---- C:\WINDOWS\system32\atioglx2.dll
2008-09-17 17:24:16 ----A---- C:\WINDOWS\system32\Atioglgl.dll
2008-09-17 17:24:16 ----A---- C:\WINDOWS\system32\atikvmag.dll
2008-09-17 17:24:16 ----A---- C:\WINDOWS\system32\atiiiexx.dll
2008-09-17 17:24:16 ----A---- C:\WINDOWS\system32\ATIDEMGX.dll
2008-09-17 17:24:16 ----A---- C:\WINDOWS\system32\ATIDDC.DLL
2008-09-17 17:24:16 ----A---- C:\WINDOWS\system32\ati3duag.dll
2008-09-17 17:24:15 ----A---- C:\WINDOWS\system32\Ati2mdxx.exe
2008-09-17 17:24:15 ----A---- C:\WINDOWS\system32\ati2evxx.exe
2008-09-17 17:24:15 ----A---- C:\WINDOWS\system32\ati2evxx.dll
2008-09-17 17:24:15 ----A---- C:\WINDOWS\system32\ati2edxx.dll
2008-09-17 17:24:15 ----A---- C:\WINDOWS\system32\ati2dvag.dll
2008-09-17 17:24:15 ----A---- C:\WINDOWS\system32\ati2cqag.dll
2008-09-17 17:18:06 ----D---- C:\Documents and Settings\IBM Owner\Application Data\Identities
2008-09-17 17:17:55 ----ASH---- C:\Documents and Settings\IBM Owner\Application Data\desktop.ini
2008-09-17 17:17:54 ----SD---- C:\Documents and Settings\IBM Owner\Application Data\Microsoft
2008-09-17 17:15:14 ----HD---- C:\Program Files\Uninstall Information
2008-09-17 17:14:10 ----D---- C:\WINDOWS\SoftwareDistribution
2008-09-17 17:14:09 ----SD---- C:\WINDOWS\system32\Microsoft
2008-09-17 17:14:08 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-09-17 17:09:34 ----D---- C:\WINDOWS\system32\xircom
2008-09-17 17:09:34 ----D---- C:\Program Files\xerox
2008-09-17 17:09:34 ----D---- C:\Program Files\microsoft frontpage
2008-09-17 17:09:19 ----A---- C:\WINDOWS\control.ini
2008-09-17 17:09:19 ----A---- C:\AUTOEXEC.BAT
2008-09-17 17:09:04 ----A---- C:\WINDOWS\OEWABLog.txt
2008-09-17 17:09:00 ----A---- C:\WINDOWS\system32\mapi32.dll
2008-09-17 17:08:16 ----SD---- C:\WINDOWS\Downloaded Program Files
2008-09-17 17:08:16 ----RD---- C:\WINDOWS\Offline Web Pages
2008-09-17 17:08:16 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2008-09-17 17:08:10 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2008-09-17 17:08:06 ----HD---- C:\Program Files\WindowsUpdate
2008-09-17 17:08:03 ----D---- C:\Program Files\Online Services
2008-09-17 17:07:45 ----D---- C:\WINDOWS\system32\DirectX
2008-09-17 17:07:20 ----A---- C:\WINDOWS\system32\atrace.dll
2008-09-17 17:07:17 ----A---- C:\WINDOWS\system32\desktop.ini
2008-09-17 17:07:17 ----A---- C:\WINDOWS\desktop.ini
2008-09-17 17:07:09 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2008-09-17 17:07:07 ----A---- C:\WINDOWS\system32\acctres.dll
2008-09-17 17:07:06 ----D---- C:\Program Files\Common Files\Services
2008-09-17 17:07:03 ----SD---- C:\WINDOWS\Tasks
2008-09-17 17:07:03 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2008-09-17 17:07:02 ----D---- C:\Program Files\Common Files\MSSoap
2008-09-17 17:06:57 ----D---- C:\WINDOWS\srchasst
2008-09-17 17:06:56 ----D---- C:\WINDOWS\system32\Macromed
2008-09-17 17:06:52 ----A---- C:\WINDOWS\system32\wuweb.dll
2008-09-17 17:06:52 ----A---- C:\WINDOWS\system32\wucltui.dll
2008-09-17 17:06:52 ----A---- C:\WINDOWS\system32\wuauserv.dll
2008-09-17 17:06:52 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2008-09-17 17:06:51 ----A---- C:\WINDOWS\system32\wups.dll
2008-09-17 17:06:51 ----A---- C:\WINDOWS\system32\wuaueng.dll
2008-09-17 17:06:51 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2008-09-17 17:06:51 ----A---- C:\WINDOWS\system32\wuauclt.exe
2008-09-17 17:06:50 ----A---- C:\WINDOWS\system32\wuapi.dll
2008-09-17 17:06:50 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2008-09-17 17:06:50 ----A---- C:\WINDOWS\system32\qmgr.dll
2008-09-17 17:06:50 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2008-09-17 17:06:50 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2008-09-17 17:06:45 ----D---- C:\Program Files\Movie Maker
2008-09-17 17:06:40 ----A---- C:\WINDOWS\system32\safrslv.dll
2008-09-17 17:06:40 ----A---- C:\WINDOWS\system32\safrdm.dll
2008-09-17 17:06:40 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2008-09-17 17:06:40 ----A---- C:\WINDOWS\system32\racpldlg.dll
2008-09-17 17:06:34 ----D---- C:\WINDOWS\system32\Restore
2008-09-17 17:06:34 ----A---- C:\WINDOWS\system32\srsvc.dll
2008-09-17 17:06:34 ----A---- C:\WINDOWS\system32\srrstr.dll
2008-09-17 17:06:34 ----A---- C:\WINDOWS\system32\fltmc.exe
2008-09-17 17:06:34 ----A---- C:\WINDOWS\system32\fltlib.dll
2008-09-17 17:06:33 ----A---- C:\WINDOWS\system32\srclient.dll
2008-09-17 17:06:33 ----A---- C:\WINDOWS\system32\ils.dll
2008-09-17 17:06:32 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2008-09-17 17:06:32 ----A---- C:\WINDOWS\system32\msconf.dll
2008-09-17 17:06:32 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2008-09-17 17:06:32 ----A---- C:\WINDOWS\system32\mnmdd.dll
2008-09-17 17:06:32 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2008-09-17 17:06:28 ----D---- C:\Program Files\NetMeeting
2008-09-17 17:06:28 ----A---- C:\WINDOWS\system32\msoert2.dll
2008-09-17 17:06:28 ----A---- C:\WINDOWS\system32\msoeacct.dll
2008-09-17 17:06:27 ----A---- C:\WINDOWS\system32\inetres.dll
2008-09-17 17:06:26 ----A---- C:\WINDOWS\system32\inetcomm.dll
2008-09-17 17:06:24 ----D---- C:\Program Files\Outlook Express
2008-09-17 17:06:24 ----A---- C:\WINDOWS\system32\schedsvc.dll
2008-09-17 17:06:24 ----A---- C:\WINDOWS\system32\mstinit.exe
2008-09-17 17:06:23 ----A---- C:\WINDOWS\system32\mstask.dll
2008-09-17 17:06:23 ----A---- C:\WINDOWS\system32\isign32.dll
2008-09-17 17:06:23 ----A---- C:\WINDOWS\system32\inetcfg.dll
2008-09-17 17:06:23 ----A---- C:\WINDOWS\system32\icwphbk.dll
2008-09-17 17:06:23 ----A---- C:\WINDOWS\system32\icwdial.dll
2008-09-17 17:06:15 ----D---- C:\Program Files\Common Files\System
2008-09-17 17:06:09 ----D---- C:\Program Files\Internet Explorer
2008-09-17 17:05:41 ----D---- C:\Program Files\ComPlus Applications
2008-09-17 17:05:40 ----A---- C:\WINDOWS\vbaddin.ini
2008-09-17 17:05:40 ----A---- C:\WINDOWS\vb.ini
2008-09-17 17:05:35 ----D---- C:\WINDOWS\Registration
2008-09-17 17:05:29 ----D---- C:\Program Files\Windows Media Player
2008-09-17 17:05:25 ----A---- C:\WINDOWS\system32\write.exe
2008-09-17 17:05:19 ----A---- C:\WINDOWS\system32\sndvol32.exe
2008-09-17 17:05:18 ----A---- C:\WINDOWS\system32\hticons.dll
2008-09-17 17:05:18 ----A---- C:\WINDOWS\system32\avwav.dll
2008-09-17 17:05:18 ----A---- C:\WINDOWS\system32\avtapi.dll
2008-09-17 17:05:18 ----A---- C:\WINDOWS\system32\avmeter.dll
2008-09-17 17:05:17 ----A---- C:\WINDOWS\system32\winchat.exe
2008-09-17 17:05:10 ----A---- C:\WINDOWS\system32\getuname.dll
2008-09-17 17:05:09 ----A---- C:\WINDOWS\system32\reset.exe
2008-09-17 17:05:09 ----A---- C:\WINDOWS\system32\charmap.exe
2008-09-17 17:05:09 ----A---- C:\WINDOWS\system32\calc.exe
2008-09-17 17:05:08 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2008-09-17 17:05:08 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2008-09-17 17:05:08 ----A---- C:\WINDOWS\system32\tslabels.ini
2008-09-17 17:05:08 ----A---- C:\WINDOWS\system32\tskill.exe
2008-09-17 17:05:08 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2008-09-17 17:05:08 ----A---- C:\WINDOWS\system32\tscon.exe
2008-09-17 17:05:08 ----A---- C:\WINDOWS\system32\shadow.exe
2008-09-17 17:05:08 ----A---- C:\WINDOWS\system32\rwinsta.exe
2008-09-17 17:05:08 ----A---- C:\WINDOWS\system32\regini.exe
2008-09-17 17:05:08 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2008-09-17 17:05:08 ----A---- C:\WINDOWS\system32\qwinsta.exe
2008-09-17 17:05:08 ----A---- C:\WINDOWS\system32\qappsrv.exe
2008-09-17 17:05:07 ----A---- C:\WINDOWS\system32\msg.exe
2008-09-17 17:05:07 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2008-09-17 17:05:07 ----A---- C:\WINDOWS\system32\logoff.exe
2008-09-17 17:05:07 ----A---- C:\WINDOWS\system32\cdmodem.dll
2008-09-17 17:05:06 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2008-09-17 17:05:06 ----A---- C:\WINDOWS\system32\mtxex.dll
2008-09-17 17:05:06 ----A---- C:\WINDOWS\system32\mtxdm.dll
2008-09-17 17:05:06 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2008-09-17 17:05:06 ----A---- C:\WINDOWS\system32\comaddin.dll
2008-09-17 17:05:05 ----A---- C:\WINDOWS\system32\stclient.dll
2008-09-17 17:05:05 ----A---- C:\WINDOWS\system32\comsnap.dll
2008-09-17 17:05:05 ----A---- C:\WINDOWS\system32\comrepl.dll
2008-09-17 17:04:59 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2008-09-17 17:04:59 ----A---- C:\WINDOWS\system32\accwiz.exe
2008-09-17 17:04:58 ----A---- C:\WINDOWS\system32\sndrec32.exe
2008-09-17 17:04:58 ----A---- C:\WINDOWS\system32\mplay32.exe
2008-09-17 17:04:58 ----A---- C:\WINDOWS\system32\hypertrm.dll
2008-09-17 17:04:57 ----D---- C:\Program Files\Windows NT
2008-09-17 17:04:57 ----A---- C:\WINDOWS\system32\mspaint.exe
2008-09-17 17:04:57 ----A---- C:\WINDOWS\system32\clipbrd.exe
2008-09-17 17:04:56 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2008-09-17 17:04:56 ----A---- C:\WINDOWS\system32\mstscax.dll
2008-09-17 17:04:55 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2008-09-17 17:04:55 ----A---- C:\WINDOWS\system32\sessmgr.exe
2008-09-17 17:04:55 ----A---- C:\WINDOWS\system32\remotepg.dll
2008-09-17 17:04:55 ----A---- C:\WINDOWS\system32\rdshost.exe
2008-09-17 17:04:55 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2008-09-17 17:04:55 ----A---- C:\WINDOWS\system32\rdchost.dll
2008-09-17 17:04:55 ----A---- C:\WINDOWS\system32\mstsc.exe
2008-09-17 17:04:54 ----A---- C:\WINDOWS\system32\termsrv.dll
2008-09-17 17:04:54 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2008-09-17 17:04:54 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2008-09-17 17:04:54 ----A---- C:\WINDOWS\system32\rdpclip.exe
2008-09-17 17:04:54 ----A---- C:\WINDOWS\system32\qprocess.exe
2008-09-17 17:04:54 ----A---- C:\WINDOWS\system32\icaapi.dll
2008-09-17 17:04:54 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2008-09-17 17:04:53 ----D---- C:\WINDOWS\system32\MsDtc
2008-09-17 17:04:53 ----A---- C:\WINDOWS\system32\mtxoci.dll
2008-09-17 17:04:53 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2008-09-17 17:04:53 ----A---- C:\WINDOWS\system32\msdtctm.dll
2008-09-17 17:04:53 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2008-09-17 17:04:52 ----A---- C:\WINDOWS\system32\xolehlp.dll
2008-09-17 17:04:52 ----A---- C:\WINDOWS\system32\msdtclog.dll
2008-09-17 17:04:52 ----A---- C:\WINDOWS\system32\msdtc.exe
2008-09-17 17:04:51 ----D---- C:\WINDOWS\system32\Com
2008-09-17 17:04:51 ----A---- C:\WINDOWS\system32\colbact.dll
2008-09-17 17:04:51 ----A---- C:\WINDOWS\system32\clbcatex.dll
2008-09-17 17:04:51 ----A---- C:\WINDOWS\system32\catsrvps.dll
2008-09-17 17:04:50 ----A---- C:\WINDOWS\system32\catsrvut.dll
2008-09-17 17:04:50 ----A---- C:\WINDOWS\system32\catsrv.dll
2008-09-17 17:04:49 ----A---- C:\WINDOWS\system32\comuid.dll
2008-09-17 17:04:49 ----A---- C:\WINDOWS\system32\comsvcs.dll
2008-09-17 17:04:48 ----A---- C:\WINDOWS\system32\clbcatq.dll
2008-09-17 17:04:41 ----A---- C:\WINDOWS\system32\servdeps.dll
2008-09-17 17:04:41 ----A---- C:\WINDOWS\system32\mmfutil.dll
2008-09-17 17:04:41 ----A---- C:\WINDOWS\system32\licwmi.dll
2008-09-17 17:04:40 ----A---- C:\WINDOWS\system32\cmprops.dll
2008-09-17 10:04:00 ----A---- C:\WINDOWS\system32\h323log.txt
2008-09-17 10:03:17 ----A---- C:\WINDOWS\system32\wshirda.dll
2008-09-17 10:03:17 ----A---- C:\WINDOWS\system32\irmon.dll
2008-09-17 10:03:17 ----A---- C:\WINDOWS\system32\irftp.exe
2008-09-17 10:02:36 ----A---- C:\WINDOWS\system32\usbui.dll
2008-09-17 10:01:43 ----A---- C:\WINDOWS\imsins.BAK
2008-09-17 10:01:41 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-09-17 10:01:40 ----SHD---- C:\WINDOWS\Installer
2008-09-17 10:01:40 ----D---- C:\Program Files\Common Files\ODBC
2008-09-17 10:01:40 ----A---- C:\WINDOWS\ODBCINST.INI
2008-09-17 10:01:35 ----D---- C:\Program Files\Common Files\SpeechEngines
2008-09-17 10:01:35 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-09-17 10:01:34 ----D---- C:\Program Files\Common Files
2008-09-17 10:01:34 ----D---- C:\Program Files
2008-09-17 10:01:32 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2008-09-17 10:01:31 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2008-09-17 10:01:31 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2008-09-17 10:01:29 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2008-09-17 10:01:29 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2008-09-17 10:01:29 ----RA---- C:\WINDOWS\system32\kbdur.dll
2008-09-17 10:01:29 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2008-09-17 10:01:29 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2008-09-17 10:01:29 ----RA---- C:\WINDOWS\system32\kbdru.dll
2008-09-17 10:01:29 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2008-09-17 10:01:29 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2008-09-17 10:01:29 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2008-09-17 10:01:29 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2008-09-17 10:01:29 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2008-09-17 10:01:29 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2008-09-17 10:01:26 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2008-09-17 10:01:26 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2008-09-17 10:01:26 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2008-09-17 10:01:26 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2008-09-17 10:01:26 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2008-09-17 10:01:26 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2008-09-17 10:01:26 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2008-09-17 10:01:24 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2008-09-17 10:01:24 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2008-09-17 10:01:24 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2008-09-17 10:01:24 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2008-09-17 10:01:24 ----RA---- C:\WINDOWS\system32\kbdest.dll
2008-09-17 10:01:21 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2008-09-17 10:01:21 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2008-09-17 10:01:21 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2008-09-17 10:01:21 ----RA---- C:\WINDOWS\system32\kbdro.dll
2008-09-17 10:01:21 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2008-09-17 10:01:21 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2008-09-17 10:01:21 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2008-09-17 10:01:21 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2008-09-17 10:01:21 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2008-09-17 10:01:21 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2008-09-17 10:01:21 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2008-09-17 10:01:21 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2008-09-17 10:01:21 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2008-09-17 10:01:19 ----A---- C:\WINDOWS\system32\irclass.dll
2008-09-17 10:01:18 ----A---- C:\WINDOWS\system32\spxcoins.dll
2008-09-17 10:01:18 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2008-09-17 10:01:18 ----A---- C:\WINDOWS\system32\dgsetup.dll
2008-09-17 10:01:18 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2008-09-17 10:01:16 ----A---- C:\WINDOWS\TASKMAN.EXE
2008-09-17 10:01:15 ----A---- C:\WINDOWS\system32\CONFIG.TMP
2008-09-17 10:01:15 ----A---- C:\WINDOWS\system32\batt.dll
2008-09-17 10:01:14 ----A---- C:\WINDOWS\notepad.exe
2008-09-17 10:01:13 ----A---- C:\WINDOWS\system32\storprop.dll
2008-09-17 10:01:06 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2008-09-17 10:01:02 ----RA---- C:\WINDOWS\SET8.tmp
2008-09-17 10:00:59 ----RA---- C:\WINDOWS\SET4.tmp
2008-09-17 10:00:57 ----RA---- C:\WINDOWS\SET3.tmp
2008-09-17 10:00:50 ----D---- C:\WINDOWS\system32\CatRoot2
2008-09-17 10:00:50 ----D---- C:\WINDOWS\system32\CatRoot
2008-09-17 10:00:45 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2008-09-17 10:00:18 ----A---- C:\WINDOWS\setuplog.txt
2008-09-17 10:00:14 ----SHD---- C:\System Volume Information
2008-09-17 10:00:14 ----D---- C:\Documents and Settings
2008-09-17 09:59:30 ----SH---- C:\boot.ini
2008-09-17 09:53:53 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-09-17 09:53:53 ----RSD---- C:\WINDOWS\Fonts
2008-09-17 09:53:53 ----RD---- C:\WINDOWS\Web
2008-09-17 09:53:53 ----HD---- C:\WINDOWS\inf
2008-09-17 09:53:53 ----D---- C:\WINDOWS\WinSxS
2008-09-17 09:53:53 ----D---- C:\WINDOWS\twain_32
2008-09-17 09:53:53 ----D---- C:\WINDOWS\Temp
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\wins
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\wbem
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\usmt
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\spool
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\ShellExt
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\Setup
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\ras
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\oobe
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\npp
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\mui
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\inetsrv
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\IME
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\icsxml
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\ias
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\export
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\drivers
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\dhcp
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\config
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\3com_dmi
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\3076
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\2052
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\1054
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\1042
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\1041
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\1037
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\1033
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\1031
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\1028
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32\1025
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system32
2008-09-17 09:53:53 ----D---- C:\WINDOWS\system
2008-09-17 09:53:53 ----D---- C:\WINDOWS\security
2008-09-17 09:53:53 ----D---- C:\WINDOWS\Resources
2008-09-17 09:53:53 ----D---- C:\WINDOWS\repair
2008-09-17 09:53:53 ----D---- C:\WINDOWS\Provisioning
2008-09-17 09:53:53 ----D---- C:\WINDOWS\PeerNet
2008-09-17 09:53:53 ----D---- C:\WINDOWS\pchealth
2008-09-17 09:53:53 ----D---- C:\WINDOWS\mui
2008-09-17 09:53:53 ----D---- C:\WINDOWS\msapps
2008-09-17 09:53:53 ----D---- C:\WINDOWS\msagent
2008-09-17 09:53:53 ----D---- C:\WINDOWS\Media
2008-09-17 09:53:53 ----D---- C:\WINDOWS\java
2008-09-17 09:53:53 ----D---- C:\WINDOWS\ime
2008-09-17 09:53:53 ----D---- C:\WINDOWS\Help
2008-09-17 09:53:53 ----D---- C:\WINDOWS\ehome
2008-09-17 09:53:53 ----D---- C:\WINDOWS\Driver Cache
2008-09-17 09:53:53 ----D---- C:\WINDOWS\Debug
2008-09-17 09:53:53 ----D---- C:\WINDOWS\Cursors
2008-09-17 09:53:53 ----D---- C:\WINDOWS\Connection Wizard
2008-09-17 09:53:53 ----D---- C:\WINDOWS\Config
2008-09-17 09:53:53 ----D---- C:\WINDOWS\AppPatch
2008-09-17 09:53:53 ----D---- C:\WINDOWS\addins
2008-09-17 09:53:53 ----D---- C:\WINDOWS

======List of files/folders modified in the last 3 months======

2008-09-30 20:15:14 ----RSHD---- C:\minint
2008-09-27 14:09:53 ----A---- C:\WINDOWS\system.ini
2008-09-25 13:24:23 ----A---- C:\WINDOWS\system32\0bd7a6a3-.txt
2008-09-23 01:05:39 ----A---- C:\WINDOWS\win.ini
2008-07-18 22:10:48 ----A---- C:\WINDOWS\system32\cdm.dll
2008-07-11 05:42:28 ----A---- C:\WINDOWS\system32\tzchange.exe
2008-07-07 13:26:58 ----A---- C:\WINDOWS\system32\es.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 ANC;ANC; C:\WINDOWS\System32\drivers\ANC.SYS [2008-08-15 11520]
R1 IBMTPCHK;IBMTPCHK; \??\C:\WINDOWS\system32\Drivers\IBMBLDID.sys []
R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 Smapint;Smapint; C:\WINDOWS\System32\drivers\Smapint.sys [2006-10-02 14848]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
R1 TDSMAPI;TDSMAPI; C:\WINDOWS\System32\drivers\TDSMAPI.SYS [2006-10-02 9343]
R1 TPHKDRV;TPHKDRV; C:\WINDOWS\system32\drivers\TPHKDRV.sys [2005-07-05 17699]
R1 TPPWRIF;TPPWRIF; C:\WINDOWS\System32\drivers\Tppwrif.sys [2008-07-29 4442]
R1 tvtumon;tvtumon; C:\WINDOWS\system32\DRIVERS\tvtumon.sys [2008-05-09 46144]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.7.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-09-17 21361]
R2 irda;IrDA Protocol; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-13 88192]
R2 mdmxsdk;mdmxsdk; C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys [2005-10-05 12544]
R2 pmem;pmem; \??\C:\WINDOWS\System32\drivers\pmemnt.sys []
R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2007-11-20 12288]
R2 tvtfilter;tvtfilter; C:\WINDOWS\system32\DRIVERS\tvtfilter.sys [2008-09-17 33536]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2004-05-17 133200]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-06-21 2156032]
R3 b57w2k;Broadcom NetXtreme Gigabit Ethernet; C:\WINDOWS\system32\DRIVERS\b57xp32.sys [2007-05-02 161792]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
R3 HSF_DPV;HSF_DPV; C:\WINDOWS\system32\DRIVERS\HSF_DPV.sys [2005-10-18 998656]
R3 HSFHWICH;HSFHWICH; C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys [2005-10-18 242304]
R3 IBMPMDRV;IBMPMDRV; C:\WINDOWS\system32\DRIVERS\ibmpmdrv.sys [2008-03-31 23720]
R3 NSCIRDA;NSC Infrared Device Driver; C:\WINDOWS\system32\DRIVERS\nscirda.sys [2008-04-13 28672]
R3 psadd;Lenovo Parties Service Access Device Driver; C:\WINDOWS\system32\DRIVERS\psadd.sys [2008-09-17 30144]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2005-02-10 260224]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2008-07-03 225664]
R3 TPInput;TPInput; C:\WINDOWS\System32\DRIVERS\TPInput.sys [2006-09-26 6528]
R3 TPM;Winbond Trusted Platform Module; C:\WINDOWS\system32\DRIVERS\tpm.sys [2005-10-09 17792]
R3 TVTI2C;Lenovo SM bus driver; C:\WINDOWS\system32\DRIVERS\Tvti2c.sys [2008-02-22 37312]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 w29n51;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows XP; C:\WINDOWS\system32\DRIVERS\w29n51.sys [2007-07-25 2210048]
R3 winachsf;winachsf; C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys [2005-10-18 721280]
S3 catchme;catchme; \??\C:\FomboCix\catchme.sys []
S3 PCD5SRVC{DF187064-5DA14001-05040000};PCD5SRVC{DF187064-5DA14001-05040000} - PCDR Kernel Mode Service Helper Driver; \??\C:\PROGRA~1\PCDR5\PCD5SRVC.pkms []
S3 PcdrNdisuio;PCDRNDISUIO Usermode I/O Protocol; C:\WINDOWS\system32\DRIVERS\pcdrndisuio.sys []
S3 UIUSys;Conexant Setup API; C:\WINDOWS\system32\drivers\UIUSys.sys []
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AcPrfMgrSvc;Ac Profile Manager Service; C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe [2008-08-15 90112]
R2 AcSvc;Access Connections Main Service; C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe [2008-08-15 212992]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-09-10 116040]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-06-21 483328]
R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2007-11-19 794624]
R2 IBMPMSVC;ThinkPad PM Service; C:\WINDOWS\system32\ibmpmsvc.exe [2008-03-31 36640]
R2 Irmon;Infrared Monitor; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 Power Manager DBC Service;Power Manager DBC Service; C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE [2008-07-29 94208]
R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2007-11-19 483328]
R2 S24EventMonitor;Intel(R) PROSet/Wireless Service; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2007-11-19 1183744]
R2 SUService;System Update; C:\Program Files\Lenovo\System Update\SUService.exe [2008-05-16 32768]
R2 ThinkVantage Registry Monitor Service;ThinkVantage Registry Monitor Service; C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe [2007-09-26 644408]
R2 TPHDEXLGSVC;ThinkPad HDD APS Logging Service; C:\WINDOWS\System32\TPHDEXLG.exe [2008-05-14 37416]
R2 TVT Backup Protection Service;TVT Backup Protection Service; C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [2008-05-14 520192]
R2 TVT Backup Service;TVT Backup Service; C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe [2008-05-14 950272]
R2 TVT Scheduler;TVT Scheduler; C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe [2008-05-14 1155072]
R2 TVT_UpdateMonitor;TVT Windows Update Monitor; C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [2008-05-09 253952]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-09-10 536872]
S2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-04-13 33632]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-04-13 68952]
S3 Imapi Helper;Imapi Helper; C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe [2006-01-05 163840]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]

-----------------EOF-----------------

noahdfear · 2008/09/27

Please disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

Filename: CFScript.txt
Save As Type: All Files (*.*)
Code:
http://www.windowsbbs.com/malware-virus-removal/77265-virus-administrator-can-not-do-anything-computer.html#post419024
http://www.windowsbbs.com/malware-virus-removal/77265-virus-administrator-can-not-do-anything-computer.html#post419108
http://www.windowsbbs.com/malware-virus-removal/77265-virus-administrator-can-not-do-anything-computer-2.html#post419111

KillAll::
Collect::
C:\WINDOWS\system32\esohujec.dll
C:\WINDOWS\system32\ugeqqqje.dll
C:\WINDOWS\system32\prgfpdla.dll
C:\WINDOWS\system32\ubenydvw.dll
C:\WINDOWS\system32\bkjxypph.dll
C:\WINDOWS\system32\itwzoxkn.exe
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
 "AppInit_DLLS "= "wbsys.dll "
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
 "SrvSh "=-
DirLook::
C:\WINDOWS\system32\(null)
Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.

Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

Please note that I have instructed CFScript to collect some files. This means that when ComboFix finishes, you will be prompted to allow ComboFix to upload a zip file that was created on your desktop. The zip contains the aforementioned files. Please copy the path shown in the prompt and paste it into the box, then click Send. This will assist the author in adding the files for removal in future updates. Thanks!

Riser · 2008/09/27

ComboFix 08-09-26.01 - IBM Owner 2008-09-27 15:46:20.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.690 [GMT -7:00]
Running from: C:\Documents and Settings\IBM Owner\Desktop\FomboCix.exe
Command switches used :: C:\Documents and Settings\IBM Owner\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\bkjxypph.dll
C:\WINDOWS\system32\esohujec.dll
C:\WINDOWS\system32\itwzoxkn.exe
C:\WINDOWS\system32\prgfpdla.dll
C:\WINDOWS\system32\ubenydvw.dll
C:\WINDOWS\system32\ugeqqqje.dll

.
((((((((((((((((((((((((( Files Created from 2008-08-27 to 2008-09-27 )))))))))))))))))))))))))))))))
.

2008-10-01 06:30 . 2008-09-25 18:52 7 --a------ C:\WINDOWS\system32\axt.bin
2008-09-30 18:31 . 2008-09-26 05:42 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-27 15:17 . 2008-09-27 15:17 <DIR> d-------- C:\rsit
2008-09-27 15:17 . 2008-09-27 15:17 <DIR> d-------- C:\Program Files\trend micro
2008-09-27 14:45 . 2008-09-27 14:49 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-27 14:45 . 2008-09-27 14:45 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\Malwarebytes
2008-09-27 14:45 . 2008-09-27 14:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-27 14:45 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-27 14:45 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-25 22:08 . 2008-09-25 22:08 <DIR> d-------- C:\Program Files\Microsoft Diagnostics and Recovery Toolset
2008-09-25 22:06 . 2008-09-25 22:06 <DIR> d-------- C:\Program Files\Alex Feinman
2008-09-25 22:00 . 2008-09-27 15:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\hyrinmfk
2008-09-25 19:24 . 2008-09-25 19:24 <DIR> d--h----- C:\WINDOWS\system32\WLANProfiles
2008-09-25 19:02 . 2008-09-25 19:02 84,680 --a------ C:\WINDOWS\system32\_BLOCK.WB4
2008-09-25 15:06 . 2008-09-25 23:05 733 --a------ C:\WINDOWS\wininit.ini
2008-09-24 21:35 . 2008-09-24 21:36 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-09-24 21:35 . 2008-09-24 21:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-24 16:47 . 2008-09-30 18:08 <DIR> d-------- C:\Program Files\thriXXX
2008-09-23 21:55 . 2008-09-30 19:51 <DIR> d-------- C:\Program Files\Google
2008-09-23 16:58 . 2008-09-23 16:58 <DIR> d-------- C:\Program Files\iPod
2008-09-23 16:58 . 2008-09-23 16:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-09-23 14:15 . 2008-09-23 14:15 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\Final Draft
2008-09-23 14:14 . 2008-09-23 14:14 <DIR> d-------- C:\Program Files\Final Draft Tagger
2008-09-23 14:14 . 2008-09-23 14:14 <DIR> d-------- C:\Program Files\Final Draft 7
2008-09-23 14:14 . 2008-09-23 14:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Final Draft
2008-09-23 14:13 . 2008-09-23 14:13 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-23 13:12 . 2008-09-23 13:12 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2008-09-23 11:42 . 2008-09-23 11:42 <DIR> d-------- C:\Program Files\iShut
2008-09-23 11:42 . 2008-09-23 11:42 <DIR> d-------- C:\Program Files\ForceQuit
2008-09-23 11:05 . 1986-09-24 17:59 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\LimeWire
2008-09-23 06:55 . 2008-09-23 06:55 <DIR> d-------- C:\Program Files\Menu Bar
2008-09-23 02:08 . 2008-09-23 02:08 <DIR> d-------- C:\Program Files\Object Desktop
2008-09-23 02:07 . 2008-09-23 02:07 <DIR> d-------- C:\WINDOWS\Sun
2008-09-23 01:33 . 2008-09-23 01:33 7,852 --a------ C:\WINDOWS\system32\mcdmsg7.dll
2008-09-23 00:58 . 2008-09-22 23:57 139,541 --a------ C:\Leopard_2_0_by_neodesktop.rar
2008-09-23 00:43 . 2008-09-23 00:43 0 --------- C:\WINDOWS\WB.ini
2008-09-23 00:20 . 2008-09-23 00:20 <DIR> d-------- C:\Program Files\Stardock
2008-09-23 00:20 . 2008-04-13 17:12 218,624 --a--c--- C:\WINDOWS\system32\dllcache\uxtheme.dll
2008-09-23 00:20 . 2008-04-26 16:14 42,672 --a------ C:\WINDOWS\system32\wbsys.dll
2008-09-23 00:19 . 2008-09-23 00:19 <DIR> d-------- C:\Program Files\WinCustomize
2008-09-22 08:36 . 2008-09-22 08:36 <DIR> d-------- C:\Program Files\YzShadow
2008-09-22 08:36 . 2008-09-22 08:36 <DIR> d-------- C:\Program Files\WinRoll
2008-09-22 08:35 . 2008-09-25 21:50 <DIR> d-------- C:\Program Files\Tiger System Preferences v2
2008-09-22 08:35 . 2008-09-23 14:58 <DIR> d-------- C:\Program Files\SearchSpy
2008-09-22 08:35 . 2008-09-22 08:35 <DIR> d-------- C:\Program Files\RK Launcher
2008-09-22 08:35 . 2008-09-22 08:35 <DIR> d-------- C:\Program Files\ObjectDock
2008-09-22 08:35 . 2008-09-22 08:35 2,179,584 --a------ C:\WINDOWS\system32\osxboot.exe
2008-09-22 08:30 . 2008-09-27 15:50 <DIR> d--h----- C:\WINDOWS\FlyakiteOSX
2008-09-21 23:10 . 2008-09-22 07:59 <DIR> d-------- C:\Program Files\RocketDock
2008-09-21 20:57 . 2008-09-21 20:57 <DIR> d--h----- C:\WINDOWS\PIF
2008-09-21 20:57 . 2008-09-21 21:08 <DIR> d-------- C:\Program Files\Finderbar 1.5
2008-09-21 20:57 . 2008-09-21 21:04 39,424 --a------ C:\WINDOWS\zipinst.exe
2008-09-21 20:56 . 2008-09-25 21:27 24 --a------ C:\WINDOWS\LogonStudio.ini
2008-09-21 20:55 . 2000-05-17 09:52 187,392 --a------ C:\WINDOWS\system32\JPGUtils.dll
2008-09-21 19:44 . 2008-04-13 17:12 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-09-21 18:33 . 2008-09-21 18:33 <DIR> d-------- C:\Program Files\Java
2008-09-21 18:33 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-09-21 18:32 . 2008-09-21 18:32 <DIR> d-------- C:\Program Files\Common Files\Java
2008-09-21 18:23 . 2008-09-21 18:33 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\Wyzo
2008-09-21 18:23 . 2008-09-21 18:23 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\.wyzo
2008-09-21 18:21 . 2008-09-21 18:21 <DIR> d-------- C:\Program Files\Wyzo
2008-09-20 19:07 . 2008-09-20 19:07 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\Apple Computer
2008-09-20 19:06 . 2008-09-23 16:58 <DIR> d-------- C:\Program Files\iTunes
2008-09-20 19:06 . 2008-04-17 13:12 107,368 --a------ C:\WINDOWS\system32\GEARAspi.dll
2008-09-20 19:06 . 2008-04-17 13:12 15,464 --a------ C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
2008-09-20 19:05 . 2008-09-20 19:05 <DIR> d-------- C:\Program Files\QuickTime
2008-09-20 19:05 . 2008-09-20 19:05 <DIR> d-------- C:\Program Files\Apple Software Update
2008-09-20 19:05 . 2008-09-20 19:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-20 19:04 . 2008-09-20 19:05 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-09-20 19:04 . 2008-09-20 19:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-09-20 18:20 . 2008-09-20 18:20 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\ATI
2008-09-20 18:20 . 2008-09-20 18:20 <DIR> d-------- C:\Documents and Settings\Guest
2008-09-20 17:36 . 2008-09-20 17:37 44 --a------ C:\WINDOWS\SMWizard.INI
2008-09-19 16:37 . 2008-09-19 16:37 0 --a------ C:\WINDOWS\nsreg.dat
2008-09-19 16:34 . 2008-09-26 07:05 <DIR> d-------- C:\Program Files\Celtx
2008-09-19 16:34 . 2008-09-19 16:34 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\Greyfirst
2008-09-19 16:27 . 2008-09-19 16:27 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Avaya
2008-09-19 14:22 . 2008-09-19 14:22 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Intel
2008-09-17 21:57 . 2008-09-17 21:57 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-09-17 21:37 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-09-17 21:37 . 2008-09-17 21:37 376 --a------ C:\WINDOWS\ODBC.INI
2008-09-17 21:36 . 2008-09-17 21:36 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-09-17 21:36 . 2008-09-17 21:36 <DIR> d-------- C:\Program Files\Common Files\L&H
2008-09-17 21:35 . 2008-09-17 21:36 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-09-17 21:35 . 2008-09-17 21:35 <DIR> d-------- C:\Program Files\Microsoft Works
2008-09-17 21:34 . 2008-06-13 04:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-17 21:32 . 2008-05-08 07:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-09-17 21:31 . 2008-09-17 21:31 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-09-17 21:30 . 2008-09-17 21:30 <DIR> dr-h----- C:\MSOCache
2008-09-17 21:27 . 2008-04-11 12:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-09-17 21:27 . 2008-05-01 07:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-09-17 21:15 . 2008-09-17 21:15 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-09-17 21:15 . 2008-09-17 21:15 <DIR> d-------- C:\WINDOWS\system32\en
2008-09-17 21:15 . 2008-09-17 21:15 <DIR> d-------- C:\WINDOWS\system32\bits
2008-09-17 21:15 . 2008-09-17 21:15 <DIR> d-------- C:\WINDOWS\l2schemas
2008-09-17 21:12 . 2008-09-17 21:16 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-09-17 20:54 . 2004-08-03 22:29 327,040 --------- C:\WINDOWS\system32\drivers\ati2mtaa.sys
2008-09-17 20:53 . 2004-08-03 22:29 63,663 --------- C:\WINDOWS\system32\drivers\ati1rvxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 56,623 --------- C:\WINDOWS\system32\drivers\ati1btxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 36,463 --------- C:\WINDOWS\system32\drivers\ati1tuxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 34,735 --------- C:\WINDOWS\system32\drivers\ati1xsxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 30,671 --------- C:\WINDOWS\system32\drivers\ati1raxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 29,455 --------- C:\WINDOWS\system32\drivers\ati1xbxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 26,367 --------- C:\WINDOWS\system32\drivers\ati1snxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 21,343 --------- C:\WINDOWS\system32\drivers\ati1ttxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 12,047 --------- C:\WINDOWS\system32\drivers\ati1pdxx.sys
2008-09-17 20:53 . 2004-08-03 22:29 11,615 --------- C:\WINDOWS\system32\drivers\ati1mdxx.sys
2008-09-17 20:08 . 2008-09-17 22:00 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-09-17 20:08 . 2007-08-10 20:46 26,488 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-09-17 20:06 . 2008-07-18 22:10 45,768 --a------ C:\WINDOWS\system32\wups2.dll
2008-09-17 20:06 . 2008-07-18 22:10 33,992 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-09-17 20:06 . 2008-07-18 22:09 25,800 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-09-17 20:06 . 2008-07-18 22:09 25,800 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-09-17 20:06 . 2008-07-18 22:08 20,680 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-09-17 20:05 . 2008-09-17 20:05 <DIR> d--hs---- C:\Documents and Settings\IBM Owner\UserData
2008-09-17 19:58 . 2008-09-17 19:58 <DIR> d-------- C:\Program Files\CyberLink
2008-09-17 19:58 . 2008-09-17 19:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
2008-09-17 19:54 . 2008-09-17 19:54 <DIR> d-------- C:\Documents and Settings\IBM Owner\Application Data\Intel
2008-09-17 19:53 . 2008-09-27 15:48 3,120 --a------ C:\WINDOWS\system32\ICAutoUpdate.log.bak
2008-09-17 19:52 . <DIR> C:\RRbackups
2008-09-17 19:49 . 2008-09-17 19:49 <DIR> d-------- C:\Program Files\Analog Devices
2008-09-17 19:47 . 2008-09-17 19:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC-Doctor
2008-09-17 19:46 . 2008-09-21 12:37 <DIR> d-------- C:\Program Files\PCDR5
2008-09-17 19:45 . 2008-09-17 19:43 118,520 --a------ C:\WINDOWS\system32\pxinsi64.exe
2008-09-17 19:45 . 2008-09-17 19:43 116,472 --a------ C:\WINDOWS\system32\pxcpyi64.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-18 02:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-18 02:46 --------- d-----w C:\Program Files\Common Files\Lenovo
2008-09-18 02:44 33,536 ----a-w C:\WINDOWS\system32\drivers\tvtfilter.sys
2008-09-18 02:44 30,144 ----a-w C:\WINDOWS\system32\drivers\psadd.sys
2008-09-18 02:44 --------- d-----w C:\Program Files\Lenovo
2008-09-18 02:43 7,012 ----a-w C:\WINDOWS\system32\drivers\pmemnt.sys
2008-09-18 02:35 0 ---ha-r C:\WINDOWS\system32\drivers\IBM_2678_A44_TP.MRK
2008-09-18 00:36 --------- d-----w C:\Program Files\Broadcom
2008-09-18 00:34 --------- d-----w C:\Documents and Settings\IBM Owner\Application Data\ATI
2008-09-18 00:32 --------- d-----w C:\Program Files\ATI Technologies
2008-09-18 00:31 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-18 00:25 --------- d-----w C:\Program Files\Foxit Software
2008-09-18 00:09 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-16 03:12 4,224 ----a-w C:\WINDOWS\system32\drivers\IBMBLDID.sys
2008-08-16 03:12 11,520 ----a-w C:\WINDOWS\system32\drivers\ANC.sys
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\WINDOWS\system32\(null) ----

2008-09-17 17:48 304 --a------ C:\WINDOWS\system32\(null)\tvtsched.log

------- Sigcheck -------

2002-12-31 05:00 577024 c72661f8552ace7c5c85e16a3cf505c4 C:\WINDOWS\$NtServicePackUninstall$\user32.dll
2008-04-13 17:12 578560 b26b135ff1b9f60c9388b4a7d16f600b C:\WINDOWS\FlyakiteOSX\Backup\user32.dll
2008-04-13 17:12 578048 ae179e8b06437cc629db4b521740ba24 C:\WINDOWS\ServicePackFiles\i386\user32.dll
2008-04-13 17:12 578560 b26b135ff1b9f60c9388b4a7d16f600b C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\user32.dll
2008-04-13 17:12 578048 ae179e8b06437cc629db4b521740ba24 C:\WINDOWS\system32\user32.dll

2008-06-23 09:01 827904 c66402a06b83b036c195242c0c8cf83c C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
2008-06-23 09:57 826368 8c13d4a7479fa0a026eda8abce82c0ed C:\WINDOWS\FlyakiteOSX\Backup\wininet.dll
2002-12-31 05:00 656384 c0823fc5469663ba63e7db88f9919d70 C:\WINDOWS\ie7\wininet.dll
2007-08-13 18:54 818688 a4a0fc92358f39538a6494c42ef99fe9 C:\WINDOWS\ie7updates\KB953838-IE7\wininet.dll
2008-06-23 09:57 803840 3a29a6c233d2c16cb7f405a9c44c6bb1 C:\WINDOWS\ServicePackFiles\i386\wininet.dll
2008-06-23 09:57 826368 8c13d4a7479fa0a026eda8abce82c0ed C:\WINDOWS\SoftwareDistribution\Download\b4e75dba041bc21ee94fbcfa88cb49de\SP2GDR\wininet.dll
2008-06-23 09:01 827904 c66402a06b83b036c195242c0c8cf83c C:\WINDOWS\SoftwareDistribution\Download\b4e75dba041bc21ee94fbcfa88cb49de\SP2QFE\wininet.dll
2008-04-13 17:12 666112 7a4f775abb2f1c97def3e73afa2faedd C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\wininet.dll
2008-06-23 09:57 803840 3a29a6c233d2c16cb7f405a9c44c6bb1 C:\WINDOWS\system32\wininet.dll
2008-06-23 09:57 803840 3a29a6c233d2c16cb7f405a9c44c6bb1 C:\WINDOWS\system32\dllcache\wininet.dll

2008-04-13 17:12 2823168 d641db52c7fe1df7202a5405a203ce75 C:\WINDOWS\explorer.exe
2002-12-31 05:00 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2008-04-13 17:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\FlyakiteOSX\Backup\explorer.exe
2008-04-13 17:12 2823168 d641db52c7fe1df7202a5405a203ce75 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
2008-04-13 17:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\explorer.exe
.
((((((((((((((((((((((((((((( snapshot@2008-09-26_ 0.13.33.06 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-14 00:11:56 2,061,824 ----a-w C:\WINDOWS\FlyakiteOSX\TempFiles\mstscax.dll
+ 2008-09-27 22:49:31 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_700.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock "= "C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"SpybotSD TeaTimer "= "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC "= "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"TVT Scheduler Proxy "= "C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe" [2008-05-14 487424]
"TPHOTKEY "= "C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-10-02 94208]
"EZEJMNAP "= "C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2008-06-05 242976]
"PWRMGRTR "= "C:\PROGRA~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2008-07-29 331776]
"BLOG "= "C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL" [2008-07-29 208896]
"ACTray "= "C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe" [2008-08-15 425984]
"ACWLIcon "= "C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe" [2008-08-15 143360]
"SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2008-07-03 1323008]
"SoundMAXPnP "= "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2008-09-06 413696]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"System Files Updater "= "C:\WINDOWS\FlyakiteOSX\System Files Updater.exe" [2006-01-14 153233]
"iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"TpShocks "= "TpShocks.exe" [2008-06-06 C:\WINDOWS\system32\TpShocks.exe]

C:\Documents and Settings\IBM Owner\Start Menu\Programs\Startup\
CCC.lnk - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-09-29 49152]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2008-09-17 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost "= "C:\\WINDOWS\\system32\\logonuiX.exe "

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ACNotify]
2008-08-15 21:37 32768 C:\Program Files\ThinkPad\ConnectUtilities\ACNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
2005-07-05 23:45 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2005-11-30 20:16 24576 C:\WINDOWS\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=wbsys.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli ACGina

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\npf.sys]
@= "Driver "

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"C:\\WINDOWS\\system32\\dpvsetup.exe "=
"C:\\Program Files\\Wyzo\\wyzo.exe "=
"C:\\Program Files\\iTunes\\iTunes.exe "=

R0 Shockprf;Shockprf;C:\WINDOWS\system32\DRIVERS\Apsx86.sys [2008-05-14 114728]
R0 TPDIGIMN;TPDIGIMN;C:\WINDOWS\system32\DRIVERS\ApsHM86.sys [2008-05-14 19496]
R0 TPDiskPM;TPDiskPM;C:\WINDOWS\system32\drivers\TPDiskPM.sys [2006-09-26 14848]
R1 ANC;ANC;C:\WINDOWS\system32\drivers\ANC.SYS [2008-08-15 11520]
R1 IBMTPCHK;IBMTPCHK;C:\WINDOWS\system32\Drivers\IBMBLDID.sys [2008-08-15 4224]
R1 TPPWRIF;TPPWRIF;C:\WINDOWS\system32\drivers\Tppwrif.sys [2008-07-29 4442]
R1 tvtumon;tvtumon;C:\WINDOWS\system32\DRIVERS\tvtumon.sys [2008-05-09 46144]
R2 Power Manager DBC Service;Power Manager DBC Service;C:\Program Files\ThinkPad\Utilities\PWMDBSVC.EXE [2008-07-29 94208]
R2 TVT Backup Protection Service;TVT Backup Protection Service;C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exe [2008-05-14 520192]
R2 TVT_UpdateMonitor;TVT Windows Update Monitor;C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exe [2008-05-09 253952]
R3 TPInput;TPInput;C:\WINDOWS\system32\DRIVERS\TPInput.sys [2006-09-26 6528]
R3 TVTI2C;Lenovo SM bus driver;C:\WINDOWS\system32\DRIVERS\Tvti2c.sys [2008-02-22 37312]
S3 PCD5SRVC{DF187064-5DA14001-05040000};PCD5SRVC{DF187064-5DA14001-05040000} - PCDR Kernel Mode Service Helper Driver;C:\PROGRA~1\PCDR5\PCD5SRVC.pkms [2007-12-10 21280]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9b17c070-8517-11dd-bc46-8a5dd6341dba}]
\Shell\AutoRun\command - E:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

BHO-{C5BF49A2-94F3-42BD-F434-3604812C897D} - (no file)

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-27 15:49:41
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\PCD5SRVC{DF187064-5DA14001-05040000}]
"ImagePath "= "\??\C:\PROGRA~1\PCDR5\PCD5SRVC.pkms "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\tphklock.dll

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\RocketDock\RocketDock.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exe
C:\WINDOWS\system32\TPHDEXLG.exe
C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exe
C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\Lenovo\System Update\SUService.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ThinkPad\UltraNav Wizard\UNavTray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
.
**************************************************************************
.
Completion time: 2008-09-27 15:52:58 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-27 22:52:53
ComboFix2.txt 2008-09-27 21:13:14
ComboFix3.txt 2008-09-26 07:14:00

Pre-Run: 145,121,509,376 bytes free
Post-Run: 145,106,554,880 bytes free

320 --- E O F --- 2008-09-18 05:00:22

Riser · 2008/09/27

A zip drive never showed up on my desktop after the combofix log, also Spybot won't let me turn it off. It autoruns no matter what so when Combofix rebooted the drive Spybot started up. I know there is a start up items list somewhere but I only know how to get to it on a mac.

noahdfear · 2008/09/27

I need to update my instructions. The zipped file should be located in C:\Qoobox, not on the desktop. It will be named similar to [4]-Submit 2008-27-09@
Please upload it to the author's submission channel.

Lets see if we can get an online scan done now. Please do an online scan with Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.

Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.

Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.

Click View scan report at the bottom.

Click the Save Report As... button.

Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.

Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

Post the Kaspersky log here.

Riser · 2008/09/27

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Saturday, September 27, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, September 28, 2008 00:05:23
Records in database: 1266812
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 47756
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 00:00:24

No malware has been detected. The scan area is clean.

The selected area was scanned.

noahdfear · 2008/09/27

Awesome! How's the computer running now?

Were you successful in uploading the zip file?

Riser · 2008/09/27

My computer seems to be running fine. My access to the C: (from "my computer ") is back and I seem to be the administrator again. The internet is lightning fast, although my Final Draft program keeps crashing when I try to save, which has been extremely frustrating but I think I'll just save my .fdr files and reinstall the program completely.

So I've got "spybot" and now this "malwarebytes" software on here and I am about to download "Comodo firewall." Will that keep me safe or should I still download AVG?

Log in or Sign up

Solved Virus as administrator (can not do ANYTHING with computer)

noahdfear Inactive

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

Share This Page

Log in or Sign up

Solved Virus as administrator (can not do ANYTHING with computer)

noahdfear Inactive

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

noahdfear Inactive

Riser Inactive Thread Starter

Share This Page

Useful Searches