1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved ebay-c card and other re-directs, virus-root toolkits

Discussion in 'Malware and Virus Removal Archive' started by kkrich, 2011/03/17.

Page 2 of 3
  1. 2011/03/23
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Is the redirection still present?

    Run OTL
    • Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following

      Code:
      :OTL
DRV - [2010/05/26 11:45:04 | 000,018,816 | ---- | M] (Sophos Plc) [Kernel | System | Running] -- C:\WINDOWS\system32\SAVRKBootTasks.sys -- (SAVRKBootTasks)
DRV - [2007/01/31 07:33:46 | 000,005,632 | ---- | M] (GRISOFT, s.r.o.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\avgarkt.sys -- (AVG Anti-Rootkit)
DRV - [2007/01/18 06:00:28 | 000,003,968 | ---- | M] (GRISOFT, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AvgArCln.sys -- (AvgArCln)
IE - HKU\S-1-5-21-1935655697-1957994488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings:  "ProxyServer" = :0
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - File not found
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - Reg Error: Value error. File not found
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - No CLSID value found.
O3 - HKLM\..\Toolbar: (&Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - Reg Error: Value error. File not found
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Value error. File not found
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Value error. File not found
O3 - HKU\S-1-5-21-1935655697-1957994488-839522115-1003\..\Toolbar\ShellBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Value error. File not found
O3 - HKU\S-1-5-21-1935655697-1957994488-839522115-1003\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Reg Error: Value error. File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Screen lock.cmd ()
O15 - HKU\S-1-5-21-1935655697-1957994488-839522115-1003\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKU\S-1-5-21-1935655697-1957994488-839522115-1003\..Trusted Ranges: Range1 (in Trusted sites)
O15 - HKU\S-1-5-21-1935655697-1957994488-839522115-1003\..Trusted Ranges: Range1 ([http] in Trusted sites)
O15 - HKU\S-1-5-21-1935655697-1957994488-839522115-1003\..Trusted Ranges: Range2 ([http] in Trusted sites)
O15 - HKU\S-1-5-21-1935655697-1957994488-839522115-1003\..Trusted Ranges: Range3 (in Trusted sites)
O15 - HKU\S-1-5-21-1935655697-1957994488-839522115-1003\..Trusted Ranges: Range3 ([http] in Local intranet)
O15 - HKU\S-1-5-21-1935655697-1957994488-839522115-1003\..Trusted Ranges: Range4 ([http] in Trusted sites)
O16 - DPF: {00000055-9980-0010-8000-00AA00389B71} http://codecs.microsoft.com/codecs/i386/fhg.CAB (Reg Error: Key error.)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/downlo...22/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} http://nexushawk.on-the-web.tv:8080/activex/AMC.cab (Reg Error: Key error.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {AC3FC1E2-26B3-46E5-8EC2-B1D5E4C90331} http://www.microseven.com/hrctech/front/CameraOCX.cab (Reg Error: Key error.)
[2010/09/23 11:37:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/05/06 09:33:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kerry\Application Data\41a8e9572df1b3e866f9c54ee96f22f5.8A83BD0BE459142F50C111755484E359D8DBFFF2.1
[2008/07/02 14:39:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kerry\Application Data\Uniblue
[2007/05/23 11:16:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kerry\Application Data\Viewpoint
@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\Kerry\Desktop\Screen lock.cmd:SummaryInformation
@Alternate Data Stream - 88 bytes -> C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Screen lock.cmd:SummaryInformation
@Alternate Data Stream - 330 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EFEEA74F
@Alternate Data Stream - 231 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:EEDA5B17
@Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2966AFCC
@Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A9CA5BEF
@Alternate Data Stream - 106 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2


:Services

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 "DisableMonitoring" =-

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
    • Then click the [color= "#FF0000"]Run Fix[/color] button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    =====================================================

    Last scans...

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
    Last edited: 2011/03/23
    broni,
    #21
  2. 2011/03/23
    kkrich

    kkrich Inactive Thread Starter

    Joined:
    2011/03/16
    Messages:
    25
    Likes Received:
    0
    Broni, I have not seen any redirections in a while.
     
    kkrich,
    #22


  3. to hide this advert.

  4. 2011/03/23
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Good :)
    Go on....
     
    broni,
    #23
  5. 2011/03/23
    kkrich

    kkrich Inactive Thread Starter

    Joined:
    2011/03/16
    Messages:
    25
    Likes Received:
    0
    Broni, if we are done all I can say is Thank you very much. And if so, you can close this message.

    I really appreciate all the help you have given me!

    Respectfully, Kerry
     
    kkrich,
    #24
  6. 2011/03/23
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I need you to complete all steps from my reply #21.
     
    broni,
    #25
  7. 2011/03/23
    kkrich

    kkrich Inactive Thread Starter

    Joined:
    2011/03/16
    Messages:
    25
    Likes Received:
    0
    Broni, I am sorry. My mind is mush today. I totally missed the other parts of 21. I just ran the otl again. It rebooted at about 5:23. When the Windows splash screen came up, a popup to run otl.exe came up and asked if I should allow it to run. I clicked ok; no cmd box on screen. It has been running since and I still have a blank splash screen. How long should I let it run?

    Kerry
     
    kkrich,
    #26
  8. 2011/03/23
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Restart computer manually and try again.
     
    broni,
    #27
  9. 2011/03/23
    kkrich

    kkrich Inactive Thread Starter

    Joined:
    2011/03/16
    Messages:
    25
    Likes Received:
    0
    After reboot I clicked on otl.exe and a log file popped up in notepad called 03232011-171915.log. I am assuming this is what you wanted and it is below. I will run the other programs after I post this.

    All processes killed
    ========== OTL ==========
    Service SAVRKBootTasks stopped successfully!
    Service SAVRKBootTasks deleted successfully!
    C:\WINDOWS\system32\SAVRKBootTasks.sys moved successfully.
    Error: Unable to stop service AVG Anti-Rootkit!
    Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AVG Anti-Rootkit deleted successfully.
    C:\WINDOWS\system32\drivers\avgarkt.sys moved successfully.
    Service AvgArCln stopped successfully!
    Service AvgArCln deleted successfully!
    C:\WINDOWS\system32\drivers\AvgArCln.sys moved successfully.
    HKU\S-1-5-21-1935655697-1957994488-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AA58ED58-01DD-4d91-8333-CF10577473F7}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{2318C2B1-4965-11d4-9B18-009027A5CD4F} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11d4-9B18-009027A5CD4F}\ deleted successfully.
    Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
    Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
    Registry value HKEY_USERS\S-1-5-21-1935655697-1957994488-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
    Registry value HKEY_USERS\S-1-5-21-1935655697-1957994488-839522115-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Screen lock.cmd moved successfully.
    Registry key HKEY_USERS\S-1-5-21-1935655697-1957994488-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\objects\ deleted successfully.
    Registry value HKEY_USERS\S-1-5-21-1935655697-1957994488-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1\\ not found.
    Registry value HKEY_USERS\S-1-5-21-1935655697-1957994488-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range1\\http deleted successfully.
    Registry value HKEY_USERS\S-1-5-21-1935655697-1957994488-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range2\\http deleted successfully.
    Registry value HKEY_USERS\S-1-5-21-1935655697-1957994488-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range3\\ not found.
    Registry value HKEY_USERS\S-1-5-21-1935655697-1957994488-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range3\\http deleted successfully.
    Registry value HKEY_USERS\S-1-5-21-1935655697-1957994488-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges\Range4\\http deleted successfully.
    Starting removal of ActiveX control {00000055-9980-0010-8000-00AA00389B71}
    C:\WINDOWS\Downloaded Program Files\fhg.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{00000055-9980-0010-8000-00AA00389B71}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000055-9980-0010-8000-00AA00389B71}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{00000055-9980-0010-8000-00AA00389B71}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000055-9980-0010-8000-00AA00389B71}\ not found.
    Starting removal of ActiveX control {33564D57-0000-0010-8000-00AA00389B71}
    C:\WINDOWS\Downloaded Program Files\WMV9VCM.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{33564D57-0000-0010-8000-00AA00389B71}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33564D57-0000-0010-8000-00AA00389B71}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{33564D57-0000-0010-8000-00AA00389B71}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33564D57-0000-0010-8000-00AA00389B71}\ not found.
    Starting removal of ActiveX control {745395C8-D0E1-4227-8586-624CA9A10A8D}
    C:\WINDOWS\Downloaded Program Files\setup.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{745395C8-D0E1-4227-8586-624CA9A10A8D}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{745395C8-D0E1-4227-8586-624CA9A10A8D}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{745395C8-D0E1-4227-8586-624CA9A10A8D}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{745395C8-D0E1-4227-8586-624CA9A10A8D}\ not found.
    Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
    C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Starting removal of ActiveX control {AC3FC1E2-26B3-46E5-8EC2-B1D5E4C90331}
    C:\WINDOWS\Downloaded Program Files\CameraOCX.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{AC3FC1E2-26B3-46E5-8EC2-B1D5E4C90331}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AC3FC1E2-26B3-46E5-8EC2-B1D5E4C90331}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AC3FC1E2-26B3-46E5-8EC2-B1D5E4C90331}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AC3FC1E2-26B3-46E5-8EC2-B1D5E4C90331}\ not found.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9Plus folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\AxMetaStream_Win folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint folder moved successfully.
    C:\Documents and Settings\Kerry\Application Data\41a8e9572df1b3e866f9c54ee96f22f5.8A83BD0BE459142F50C111755484E359D8DBFFF2.1\Local Store\#SharedObjects folder moved successfully.
    C:\Documents and Settings\Kerry\Application Data\41a8e9572df1b3e866f9c54ee96f22f5.8A83BD0BE459142F50C111755484E359D8DBFFF2.1\Local Store folder moved successfully.
    C:\Documents and Settings\Kerry\Application Data\41a8e9572df1b3e866f9c54ee96f22f5.8A83BD0BE459142F50C111755484E359D8DBFFF2.1 folder moved successfully.
    C:\Documents and Settings\Kerry\Application Data\Uniblue\Registry Booster2 folder moved successfully.
    C:\Documents and Settings\Kerry\Application Data\Uniblue folder moved successfully.
    C:\Documents and Settings\Kerry\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 folder moved successfully.
    C:\Documents and Settings\Kerry\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 folder moved successfully.
    C:\Documents and Settings\Kerry\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 folder moved successfully.
    C:\Documents and Settings\Kerry\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 folder moved successfully.
    C:\Documents and Settings\Kerry\Application Data\Viewpoint\Viewpoint Experience Technology\Resources folder moved successfully.
    C:\Documents and Settings\Kerry\Application Data\Viewpoint\Viewpoint Experience Technology folder moved successfully.
    C:\Documents and Settings\Kerry\Application Data\Viewpoint folder moved successfully.
    Unable to delete ADS C:\Documents and Settings\Kerry\Desktop\Screen lock.cmd:SummaryInformation .
    Unable to delete ADS C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Screen lock.cmd:SummaryInformation .
    ADS C:\Documents and Settings\All Users\Application Data\TEMP:EFEEA74F deleted successfully.
    ADS C:\Documents and Settings\All Users\Application Data\TEMP:EEDA5B17 deleted successfully.
    ADS C:\Documents and Settings\All Users\Application Data\TEMP:2966AFCC deleted successfully.
    ADS C:\Documents and Settings\All Users\Application Data\TEMP:A9CA5BEF deleted successfully.
    ADS C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 deleted successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall\\DisableMonitoring deleted successfully.
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: admin2
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users
    ->Flash cache emptied: 0 bytes

    User: backup
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: HOME

    User: Kerry
    ->Temp folder emptied: 1304910 bytes
    ->Temporary Internet Files folder emptied: 1702492 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 32553501 bytes
    ->Flash cache emptied: 3057 bytes

    User: Kids
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: kkr
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 66016 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes

    User: SYSTEM

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 17123 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 114671 bytes

    Total Files Cleaned = 34.00 mb


    [EMPTYFLASH]

    User: admin2

    User: Administrator

    User: All Users
    ->Flash cache emptied: 0 bytes

    User: backup
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: HOME

    User: Kerry
    ->Flash cache emptied: 0 bytes

    User: Kids
    ->Flash cache emptied: 0 bytes

    User: kkr
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Flash cache emptied: 0 bytes

    User: NetworkService

    User: SYSTEM

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.22.3 log created on 03232011_171915

    Files\Folders moved on Reboot...
    File move failed. C:\Documents and Settings\Kerry\Local Settings\Temp\WCESLog.log scheduled to be moved on reboot.

    Registry entries deleted on Reboot...
     
    kkrich,
    #28
  10. 2011/03/23
    kkrich

    kkrich Inactive Thread Starter

    Joined:
    2011/03/16
    Messages:
    25
    Likes Received:
    0
    checkup txt

    Results of screen317's Security Check version 0.99.7
    Windows XP Service Pack 3
    Internet Explorer 7 Out of date!
    ``````````````````````````````
    Antivirus/Firewall Check:
    Windows Firewall Enabled!
    avast! Free Antivirus
    AVG Anti-Rootkit Free
    ZoneAlarm Pro
    Antivirus up to date! (On Access scanning disabled!)
    ```````````````````````````````
    Anti-malware/Other Utilities Check:
    Malwarebytes' Anti-Malware
    CCleaner
    Java(TM) 6 Update 24
    Out of date Java installed!
    Adobe Flash Player 10.1.102.64
    Adobe Reader 9
    Chinese Simplified Fonts Support For Adobe Reader 8
    Chinese Traditional Fonts Support For Adobe Reader 8
    Korean Fonts Support For Adobe Reader 8
    Japanese Fonts Support For Adobe Reader 8
    Out of date Adobe Reader installed!
    Mozilla Firefox (3.6.2)
    Mozilla Thunderbird (1.5.0) Thunderbird Out of Date!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent
    AVAST Software Avast AvastSvc.exe
    AVAST Software Avast avastUI.exe
    ``````````End of Log````````````
     
    kkrich,
    #29
  11. 2011/03/23
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Update Internet Explorer to version 8.

    Update Firefox to version 4.0.

    Update Thunderbird to the current 3.1.9 version, or uninstall it, if you don't use it.

    Update Adobe Reader

    You can download it from http://www.adobe.com/products/acrobat/readstep2.html
    After installing the latest Adobe Reader, uninstall all previous versions.
    Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

    Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
    It's a much smaller file to download and uses a lot less resources than Adobe Reader.
    Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.

    ...and Eset scan....
     
    broni,
    #30
  12. 2011/03/23
    kkrich

    kkrich Inactive Thread Starter

    Joined:
    2011/03/16
    Messages:
    25
    Likes Received:
    0
    Broni, I just tried eset on line and also the seperate program. On the Intaialization screen I get the message "Can not get update. Is the proxy configured?" I really need to keep IE 7 if at all possible as IE 8 is incompatable with some of the IP cameras I take care of part time. They only use activex so I can't use firefox. I will update firefox, tbird and adobe reader after I get the next message from you.
     
    kkrich,
    #31
  13. 2011/03/23
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Try to run Eset with Firefox.
     
    broni,
    #32
  14. 2011/03/23
    kkrich

    kkrich Inactive Thread Starter

    Joined:
    2011/03/16
    Messages:
    25
    Likes Received:
    0
    I tired both ff and ie, and it wouldn't run. I will update ff now and try it again.
     
    kkrich,
    #33
  15. 2011/03/23
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    If still a problem....

    Please run a BitDefender Online Scan

    • Disable your antivirus program.
    • Click Start Scanner button.
    • Click Free scan now button
    • Allow browser plug-in to be installed when prompted.
    • Click I Agree to agree to the EULA.
    • Please refrain from using the computer until the scan is finished.
    • When the scan is finished, click on View report.
    • Notepad will open with scan results.
    • Save the report to your desktop and post its content in your next reply.
     
    broni,
    #34
  16. 2011/03/23
    kkrich

    kkrich Inactive Thread Starter

    Joined:
    2011/03/16
    Messages:
    25
    Likes Received:
    0
    BitDefender Online Scan

    Still no go with eset so I ran BitDefender. Report is below.


    QuickScan Beta 32-bit v0.9.9.77
    -------------------------------
    Scan date: Wed Mar 23 18:49:25 2011
    Machine ID: B431016C

    Process OnlineCmdLineScanner.exe (1296) - hidden process!
    Process OnlineCmdLineScanner.exe (2084) - hidden process!
    Process OnlineCmdLineScanner.exe (2132) - hidden process!
    Process OnlineCmdLineScanner.exe (3472) - hidden process!
    Process OnlineCmdLineScanner.exe (3896) - hidden process!


    No infection found.
    -------------------



    Processes
    ---------
    (unsigned) brother brstswnd 4064 C:\Program Files\Brownie\BrStsWnd.exe
    (unsigned) brother pjl parser 1228 C:\Program Files\Brownie\brpjp04a.exe
    (unsigned) EPSON PC-FAX SOFTWARE 2892 C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe
    (unsigned) FRXPRO 3320 C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
    (unsigned) Gadwin PrintScreen Professional 3380 C:\Program Files\Gadwin Systems\PrintScreenPro\PrintScreenPro.exe
    (unsigned) NMSAccess.exe 3248 C:\Program Files\StompSoft\PC BackUp\NMSAccess.exe
    (unsigned) NsEngine Module 3304 C:\Program Files\StompSoft\PC BackUp\NSENGINE.exe
    (unsigned) OneTouch Module 2804 C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
    (unsigned) StompSoft Backup Service 2540 C:\Program Files\StompSoft\PC BackUp\NBKCTRL.exe
    (unsigned) Windows Time Synchronizer 3800 C:\Program Files\Windows Time Synchronizer\WinTimeSync.exe

    (verified) AOL Connectivity Service 1268 C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
    (verified) AOL Service Libraries 1784 C:\Program Files\Common Files\AOL\1174865921\EE\aolsoftware.exe
    (verified) avast! Antivirus 296 C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    (verified) avast! Antivirus 3124 C:\Program Files\AVAST Software\Avast\AvastUI.exe
    (verified) EEventManager Application 2960 C:\PROGRA~1\EPSONS~1\EVENTM~1\EEventManager.exe
    (verified) EPSON Status Monitor 3 1376 C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
    (verified) EPSON Status Monitor 3 1336 C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
    (verified) Firefox 1700 E:\Program Files\Mozilla Firefox\firefox.exe
    (verified) InstallShield 1544 C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    (verified) Internet Information Services 1596 C:\WINDOWS\system32\inetsrv\inetinfo.exe
    (verified) Java(TM) Platform SE 6 U11 3172 C:\Program Files\Java\jre6\bin\jusched.exe
    (verified) Java(TM) Platform SE 6 U24 1736 C:\Program Files\Java\jre6\bin\jqs.exe
    (verified) LMIGuardianSvc 1768 C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe
    (verified) LogMeIn 2204 C:\Program Files\LogMeIn\x86\LogMeIn.exe
    (verified) LogMeIn 2652 C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
    (verified) LogMeIn 1972 C:\Program Files\LogMeIn\x86\ramaint.exe
    (verified) Microsoft ActiveSync 3188 C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    (verified) Microsoft ActiveSync 3364 C:\PROGRA~1\MICROS~4\rapimgr.exe
    (verified) Microsoft® Windows® Operating System 2160 C:\WINDOWS\explorer.exe
    (verified) Microsoft® Windows® Operating System 3408 C:\WINDOWS\system32\alg.exe
    (verified) Microsoft® Windows® Operating System 780 C:\WINDOWS\system32\csrss.exe
    (verified) Microsoft® Windows® Operating System 872 C:\WINDOWS\system32\lsass.exe
    (verified) Microsoft® Windows® Operating System 860 C:\WINDOWS\system32\services.exe
    (verified) Microsoft® Windows® Operating System 684 C:\WINDOWS\system32\smss.exe
    (verified) Microsoft® Windows® Operating System 720 C:\WINDOWS\system32\spoolsv.exe
    (verified) Microsoft® Windows® Operating System 1108 C:\WINDOWS\system32\svchost.exe
    (verified) Microsoft® Windows® Operating System 1192 C:\WINDOWS\system32\svchost.exe
    (verified) Microsoft® Windows® Operating System 1204 C:\WINDOWS\system32\svchost.exe
    (verified) Microsoft® Windows® Operating System 1348 C:\WINDOWS\system32\svchost.exe
    (verified) Microsoft® Windows® Operating System 1036 C:\WINDOWS\system32\svchost.exe
    (verified) Microsoft® Windows® Operating System 3492 C:\WINDOWS\system32\svchost.exe
    (verified) Microsoft® Windows® Operating System 1540 C:\WINDOWS\system32\svchost.exe
    (verified) Microsoft® Windows® Operating System 3640 C:\WINDOWS\system32\taskmgr.exe
    (verified) Microsoft® Windows® Operating System 816 C:\WINDOWS\system32\winlogon.exe
    (verified) Microsoft® Windows® Operating System 2420 C:\WINDOWS\system32\wscntfy.exe
    (verified) NAS Power Management Service 2588 C:\Program Files\BUFFALO\NASNAVI\nassvc.exe
    (verified) NsWrtMon Application 2784 C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
    (verified) NsWrtProc Application 2896 C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtProc.exe
    (verified) OnlineCmdLineScanner.exe 1296 C:\Program Files\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
    (verified) OnlineCmdLineScanner.exe 2132 C:\Program Files\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
    (verified) OnlineCmdLineScanner.exe 2084 C:\Program Files\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
    (verified) OnlineCmdLineScanner.exe 3472 C:\Program Files\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
    (verified) OnlineCmdLineScanner.exe 3896 C:\Program Files\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
    (verified) PMSpeed 3416 C:\Program Files\NewSoft\Presto! PageManager 8 for EP\PMSpeed.exe
    (verified) Sync 1480 E:\Program Files\seagate\seagatemanager\Sync\FreeAgentService.exe


    Network activity
    ----------------
    Process firefox.exe (1700) connected on port 80 (HTTP) --> 204.11.109.21
    Process firefox.exe (1700) connected on port 80 (HTTP) --> 199.7.51.190
    Process firefox.exe (1700) connected on port 80 (HTTP) --> 66.220.146.25
    Process firefox.exe (1700) connected on port 80 (HTTP) --> 199.7.48.190
    Process firefox.exe (1700) connected on port 80 (HTTP) --> 96.17.109.41
    Process firefox.exe (1700) connected on port 80 (HTTP) --> 184.86.141.229
    Process firefox.exe (1700) connected on port 80 (HTTP) --> 217.31.57.145
    Process firefox.exe (1700) connected on port 80 (HTTP) --> 63.235.20.176
    Process firefox.exe (1700) connected on port 80 (HTTP) --> 199.7.52.190
    Process firefox.exe (1700) connected on port 80 (HTTP) --> 217.31.57.145
    Process LogMeIn.exe (2204) connected on port 443 (HTTP over SSL) --> 216.52.233.135

    Process svchost.exe (1036) listens on ports: 3389 (Terminal Server)
    Process svchost.exe (1108) listens on ports: 135 (RPC)
    Process inetinfo.exe (1596) listens on ports: 25 (SMTP), 80 (HTTP), 443 (HTTP over SSL), 1035
    Process LogMeIn.exe (2204) listens on ports: 2002 (Cisco ACS)
    Process EEventManager.exe (2960) listens on ports: 2968
    Process rapimgr.exe (3364) listens on ports: 990 (FTP over SSL)


    Autoruns and critical files
    ---------------------------
    (unsigned) EPSON PC-FAX SOFTWARE C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe
    (unsigned) FRXPRO C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
    (unsigned) Gadwin PrintScreen Professional C:\Program Files\Gadwin Systems\PrintScreenPro\PrintScreenPro.exe
    (unsigned) OneTouch Module C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
    (unsigned) QuickTime C:\Program Files\QuickTime Alternative\QTTask.exe
    (unsigned) StompSoft Backup Service C:\Program Files\StompSoft\PC BackUp\NBKCTRL.exe
    (unsigned) SUPERAntiSpyware WinLogon Processor C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    (verified) ATI External Event Utility for Windows C:\WINDOWS\system32\ati2evxx.dll
    (verified) avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastUI.exe
    (verified) cdloader2 C:\Documents and Settings\Kerry\Application Data\mjusbsp\cdloader2.exe
    (verified) EEventManager Application C:\Program Files\Epson Software\Event Manager\EEventManager.exe
    (verified) Java(TM) Platform SE 6 U11 C:\Program Files\Java\jre6\bin\jusched.exe
    (verified) LogMeIn C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
    (verified) LogMeIn C:\WINDOWS\system32\LMIinit.dll
    (verified) Microsoft ActiveSync C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    (verified) Microsoft Genuine Advantage C:\WINDOWS\system32\WgaLogon.dll
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\browseui.dll
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\crypt32.dll
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\cryptnet.dll
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\cscdll.dll
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\dimsntfy.dll
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\logonui.exe
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\sclgntfy.dll
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\scrnsave.scr
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\shell32.dll
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\stobject.dll
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\taskmgr.exe
    (verified) Microsoft® Windows® Operating System c:\windows\system32\userinit.exe
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\wlnotify.dll
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\WPDShServiceObj.dll
    (verified) NsWrtMon Application C:\WINDOWS\system32\spool\drivers\w32x86\3\WrtMon.exe
    (verified) PMSpeed C:\Program Files\NewSoft\Presto! PageManager 8 for EP\PMSpeed.exe
    (verified) Windows® Internet Explorer C:\WINDOWS\system32\webcheck.dll
    (verified) ZoneAlarm Client E:\Program Files\ZoneAlarm\zlclient.exe


    Browser plugins
    ---------------
    (unsigned) VideoDeviceControl C:\WINDOWS\Downloaded Program Files\BitmapOverlayFilter.ax
    (unsigned) AOL Media Playback Plugin E:\Program Files\Mozilla Firefox\plugins\npunagi2.dll
    (unsigned) APPROTECH MPEG4TransFilter C:\WINDOWS\Downloaded Program Files\MPEG4TransFilter.ax
    (unsigned) APPROTECH VideoDeviceControl C:\WINDOWS\Downloaded Program Files\JPEGTransFilter.ax
    (unsigned) AudioUploadControl ActiveX Control Modu C:\WINDOWS\Downloaded Program Files\AudioUploadControl.ocx
    (unsigned) avformat.dll C:\WINDOWS\Downloaded Program Files\avformat.dll
    (unsigned) avformat.dll C:\WINDOWS\Downloaded Program Files\CONFLICT.1\avformat.dll
    (unsigned) AVSynchronizer Dynamic Link Library C:\WINDOWS\Downloaded Program Files\AVSynchronizer.dll
    (unsigned) AxVideoView ActiveX Control Module C:\WINDOWS\Downloaded Program Files\AxVideoView.ocx
    (unsigned) CamCli Module C:\WINDOWS\Downloaded Program Files\CamCli.dll
    (unsigned) CamCli Module C:\WINDOWS\Downloaded Program Files\CONFLICT.1\CamCli.dll
    (unsigned) CamCli Module C:\WINDOWS\Downloaded Program Files\CONFLICT.2\CamCli.dll
    (unsigned) evt.dll C:\WINDOWS\Downloaded Program Files\evt.dll
    (unsigned) ffdshow.exe C:\WINDOWS\Downloaded Program Files\ffdshow.exe
    (unsigned) GSM_codec.dll C:\WINDOWS\Downloaded Program Files\GSM_codec.dll
    (unsigned) HP Peripheral Interrogator C:\Program Files\Internet Explorer\plugins\nphppi.dll
    (unsigned) IMMP4Control C:\WINDOWS\Downloaded Program Files\IMMP4.OCX
    (unsigned) IMMP4Control C:\WINDOWS\Downloaded Program Files\IMMP4Control.ocx
    (unsigned) InstallShield Update Service C:\WINDOWS\Downloaded Program Files\isusweb.dll
    (unsigned) Intel® JPEG Library C:\WINDOWS\Downloaded Program Files\ijl10.dll
    (unsigned) IPCamera ActiveX Control Module C:\WINDOWS\Downloaded Program Files\PLANETCamV.ocx
    (unsigned) Java(TM) Platform SE 6 U24 C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
    (unsigned) KSaveToDisk.ocx C:\WINDOWS\Downloaded Program Files\KSaveToDisk.ocx
    (unsigned) libBackupFile Dynamic Link Library C:\WINDOWS\Downloaded Program Files\libBackupFile.dll
    (unsigned) libWespNet Dynamic Link Library C:\WINDOWS\Downloaded Program Files\libWespNet.dll
    (unsigned) LuxRiot Digital Video Recorder C:\WINDOWS\Downloaded Program Files\DVRClientTools.dll
    (unsigned) MetaStream 3 Plugin C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
    (unsigned) Mozilla ActiveX control and plugin supp E:\Program Files\Mozilla Firefox\plugins\npmozax.dll
    (unsigned) mwcliun C:\WINDOWS\Downloaded Program Files\mwcliun.exe
    (unsigned) npRACtrl.dll E:\Program Files\Mozilla Firefox\plugins\npRACtrl.dll
    (unsigned) NuCodec.dll C:\WINDOWS\Downloaded Program Files\NuCodec.dll
    (unsigned) nuproc.dll C:\WINDOWS\Downloaded Program Files\nuproc.dll
    (unsigned) nusysd.dll C:\WINDOWS\Downloaded Program Files\nusysd.dll
    (unsigned) NVSViewerCtrl ActiveX Control Module C:\WINDOWS\Downloaded Program Files\NVSViewerCtrl.ocx
    (unsigned) OCXDownloadChecker ActiveX Control Modu C:\WINDOWS\Downloaded Program Files\OCXDownloadChecker_8120.ocx
    (unsigned) OCXDownloadChecker ActiveX Control Modu C:\WINDOWS\Downloaded Program Files\OCXDownloadChecker_8310.ocx
    (unsigned) parsedatapacket library C:\WINDOWS\Downloaded Program Files\parsedatapacket.dll
    (unsigned) Pixord Module C:\WINDOWS\Downloaded Program Files\Pixord.dll
    (unsigned) proplaym4 Dynamic Link Library C:\WINDOWS\Downloaded Program Files\ProPlaym4.dll
    (unsigned) ractrlkeyhook.dll E:\Program Files\Mozilla Firefox\plugins\ractrlkeyhook.dll
    (unsigned) rtp.dll C:\WINDOWS\Downloaded Program Files\rtp.dll
    (unsigned) RtspVapgDecoder C:\WINDOWS\Downloaded Program Files\RtspVapgDecoder.dll
    (unsigned) TSBnwCam ActiveX Control Module C:\WINDOWS\Downloaded Program Files\CONFLICT.1\TSBnwCam.ocx
    (unsigned) TSBnwCam ActiveX Control Module C:\WINDOWS\Downloaded Program Files\TSBnwCam.ocx
    (unsigned) TVicHW32 Generic Device Driver for Wind C:\WINDOWS\Downloaded Program Files\tvichw32.sys
    (unsigned) UltraCam device ActiveX Control C:\WINDOWS\Downloaded Program Files\UltraCamX.ocx
    (unsigned) VatDecoder C:\WINDOWS\Downloaded Program Files\VATDecoder.dll
    (unsigned) VideoDeviceControl C:\WINDOWS\Downloaded Program Files\LanDeviceSourceFilter.ax
    (unsigned) WESPDiscovery Module C:\WINDOWS\Downloaded Program Files\WESPDiscovery.dll
    (unsigned) WESPEvent Module C:\WINDOWS\Downloaded Program Files\WESPEvent.dll
    (unsigned) WESPMonitor Module C:\WINDOWS\Downloaded Program Files\WESPMonitor.dll
    (unsigned) WESPPlayback Module C:\WINDOWS\Downloaded Program Files\WESPPlayback.dll
    (unsigned) WESPPTZ Module C:\WINDOWS\Downloaded Program Files\WESPPTZ.dll
    (unsigned) 웹게이트(주) WISEDec C:\WINDOWS\Downloaded Program Files\WISEDec.dll

    (verified) 2007 Microsoft Office system E:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
    (verified) 93X0MP4Control C:\WINDOWS\Downloaded Program Files\93X0MP4.ocx
    (verified) AAC decoder C:\WINDOWS\Downloaded Program Files\AxAacDec.dll
    (verified) ActiveTouch General Plugin Container E:\Program Files\Mozilla Firefox\plugins\npatgpc.dll
    (verified) Adobe Acrobat C:\Program Files\Internet Explorer\plugins\nppdf32.dll
    (verified) Adobe Acrobat E:\Program Files\Mozilla Firefox\plugins\nppdf32.dll
    (verified) atcliun C:\WINDOWS\Downloaded Program Files\atcliun.exe
    (verified) AtMgr Module E:\Program Files\Mozilla Firefox\plugins\atmgr.exe
    (verified) avast! WebRep c:\program files\avast software\avast\aswwebrepie.dll
    (verified) BitDefender QuickScan C:\Documents and Settings\Kerry\Application Data\Mozilla\Firefox\Profiles\f2otyrlm.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
    (verified) Bonjour C:\Program Files\Bonjour\mdnsNSP.dll
    (verified) ECOM Server C:\WINDOWS\Downloaded Program Files\ecmsvr32.dll
    (verified) FlashCatch c:\program files\flashcatch\flashcatch.dll
    (verified) G726 Player Control C:\WINDOWS\Downloaded Program Files\pmjpegaudio.ocx
    (verified) G726 Player Control C:\WINDOWS\Downloaded Program Files\pmjpegaudioV4.ocx
    (verified) getPlus+(R) C:\WINDOWS\Downloaded Program Files\gp.ocx
    (verified) getPlusPlus for Adobe 16241 E:\Program Files\Mozilla Firefox\plugins\np_gp.dll
    (verified) InstallShield Update Service C:\WINDOWS\Downloaded Program Files\dwusplay.dll
    (verified) InstallShield Update Service C:\WINDOWS\Downloaded Program Files\dwusplay.exe
    (verified) IPSViewer ActiveX Control Module C:\WINDOWS\Downloaded Program Files\IPSViewer.ocx
    (verified) iqeye ActiveX Control Module C:\WINDOWS\Downloaded Program Files\iqeye.ocx.gz
    (verified) IQeye ActiveX Control Module C:\WINDOWS\Downloaded Program Files\iqweb.ocx
    (verified) iqeye ActiveX Control Module C:\WINDOWS\Downloaded Program Files\iqweb.ocx.gz
    (verified) Java Deployment Toolkit 6.0.240.7 E:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
    (verified) Java(TM) Platform SE 6 U24 c:\program files\java\jre6\bin\jp2ssv.dll
    (verified) Java(TM) Platform SE 6 U24 c:\program files\java\jre6\bin\ssv.dll
    (verified) Java(TM) Platform SE 6 U24 c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    (verified) LMIGuardian C:\WINDOWS\Downloaded Program Files\LMIGuardian.exe
    (verified) LMIGuardianDll C:\WINDOWS\Downloaded Program Files\LMIGuardianDll.dll
    (verified) LMIGuardianEvt C:\WINDOWS\Downloaded Program Files\LMIGuardianEvt.dll
    (verified) LMIProxyHelper.exe C:\WINDOWS\Downloaded Program Files\LMIProxyHelper.exe
    (verified) LMIProxyHelper.exe E:\Program Files\Mozilla Firefox\plugins\LMIProxyHelper.exe
    (verified) LuxRiot Digital Video Recorder C:\WINDOWS\Downloaded Program Files\DVRInstallStub-DVRCodecs.dll
    (verified) Messenger C:\Program Files\Messenger\msmsgs.exe
    (verified) Microsoft (R) Windows (R) 95, Windows ( E:\Program Files\Mozilla Firefox\plugins\unicows.dll
    (verified) Microsoft Office 2003 E:\Program Files\Mozilla Firefox\plugins\NPOFFICE.DLL
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\mswsock.dll
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\System32\nwprovau.dll
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\rsvpsp.dll
    (verified) Microsoft® Windows® Operating System C:\WINDOWS\system32\winrnr.dll
    (verified) Moonlight MPEG-4 Video Decoder C:\WINDOWS\Downloaded Program Files\mmpeg4dec.ax
    (verified) Mozilla Default Plug-in E:\Program Files\Mozilla Firefox\plugins\npnul32.dll
    (verified) Network Camera View3 C:\WINDOWS\Downloaded Program Files\CONFLICT.1\nwcv3setup.exe
    (verified) Network Camera View3 C:\WINDOWS\Downloaded Program Files\CONFLICT.2\nwcv3setup.exe
    (verified) Network Camera View3 C:\WINDOWS\Downloaded Program Files\CONFLICT.3\nwcv3setup.exe
    (verified) Network Camera View3 C:\WINDOWS\Downloaded Program Files\CONFLICT.4\nwcv3setup.exe
    (verified) Network Camera View3 C:\WINDOWS\Downloaded Program Files\nwcv3setup.exe
    (verified) npitunes.dll E:\itunes\Mozilla Plugins\npitunes.dll
    (verified) NPSWF32.dll C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
    (verified) Panasonic Network Camera C:\WINDOWS\Downloaded Program Files\AudioClient.ocx
    (verified) Panasonic Network Camera C:\WINDOWS\Downloaded Program Files\ipv6cam.ocx
    (verified) pmjpegcam Control C:\WINDOWS\Downloaded Program Files\pmjpegcamV4.ocx
    (verified) QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin.dll
    (verified) QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin2.dll
    (verified) QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin3.dll
    (verified) QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin4.dll
    (verified) QuickTime Plug-in 7.6.4 C:\Program Files\Internet Explorer\plugins\npqtplugin5.dll
    (verified) QuickTime Plug-in 7.6.4 E:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
    (verified) QuickTime Plug-in 7.6.4 E:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
    (verified) QuickTime Plug-in 7.6.4 E:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
    (verified) QuickTime Plug-in 7.6.4 E:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
    (verified) QuickTime Plug-in 7.6.4 E:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
    (verified) RACtrl.dll C:\WINDOWS\Downloaded Program Files\RACtrl.dll
    (verified) RtspVapgDecoder C:\WINDOWS\Downloaded Program Files\RtspVapgDecoderNew.dll
    (verified) Symantec Antivirus Engine C:\WINDOWS\Downloaded Program Files\naveng32.dll
    (verified) Symantec Antivirus Engine C:\WINDOWS\Downloaded Program Files\navex32a.dll
    (verified) Video Device Control Module C:\WINDOWS\Downloaded Program Files\VideoDeviceControl.dll
    (verified) WebEx Download Module C:\WINDOWS\Downloaded Program Files\atgpcdec.dll
    (verified) WebEx Download Module C:\WINDOWS\Downloaded Program Files\atgpcext.dll
    (verified) WebEx Download Module E:\Program Files\Mozilla Firefox\plugins\atgpcdec.dll
    (verified) WebEx Download Module E:\Program Files\Mozilla Firefox\plugins\atgpcext.dll
    (verified) WebEx Download Module E:\Program Files\Mozilla Firefox\plugins\ieatgpc.dll
    (verified) Windows Presentation Foundation C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
    (verified) Windows® Internet Explorer C:\WINDOWS\system32\ieframe.dll
    (verified) Yahoo Application State Plugin C:\Program Files\Yahoo!\Shared\npYState.dll
    (verified) Yahoo! activeX Plug-in Bridge C:\Program Files\Yahoo!\Common\npyaxmpb.dll


    Scan
    ----
    (unsigned) MD5: 4c6468bdc7485502c21f0c12d9c1f1d5 C:\Documents and Settings\Kerry\Application Data\Mozilla\Firefox\Profiles\f2otyrlm.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc_fireftp.dll
    (unsigned) MD5: 2d37f0e8ac8121dd6c6319f6ab5ee8c3 C:\Program Files\AVAST Software\Avast\defs\11032301\algo.dll
    (unsigned) MD5: f7ce4837b39e862de7179e8e5e2e7d4a C:\Program Files\Brownie\brlm03a.dll
    (unsigned) MD5: 8ca93f5c7df25d6540292f5afeece95a C:\Program Files\Brownie\brpjp04a.exe
    (unsigned) MD5: 770fbce78784075d18f86d6e663ec8aa C:\Program Files\Brownie\BrStsWnd.exe
    (unsigned) MD5: e8f503eb5f9633a1547b3f0968f3b662 C:\Program Files\BUFFALO\NASNAVI\nasdmn.dll
    (unsigned) MD5: 08de24b7b61cbca3aefdf201a25f5d4e C:\Program Files\BUFFALO\NASNAVI\nasexo.dll
    (unsigned) MD5: 3b471d0ca6bc4486dbf057e8298e8aeb C:\Program Files\Common Files\AOL\1174865921\EE\AOLSvcMgr.dll
    (unsigned) MD5: 255af34c14e3f5ce45cc515efb65fc41 C:\Program Files\Common Files\AOL\1174865921\EE\services\localStorage\ver7_3_3_1\clsSvc.dll
    (unsigned) MD5: 7204f76e069854a2785796a0911afb27 C:\Program Files\Common Files\AOL\1174865921\EE\services\metrics\ver3_6_16_1\cmls.dll
    (unsigned) MD5: 272dda68347f2a265f4b9a12fdbf01df C:\Program Files\Common Files\AOL\1174865921\EE\services\notification\ver6_4_1_1\Notify.dll
    (unsigned) MD5: 1337ef044854f38b9dfd085e56ebc3a2 C:\Program Files\Common Files\AOL\1174865921\EE\services\os\ver5_2_1_1\AOLIdleMon.dll
    (unsigned) MD5: 483302397a9a1334fb9d44dd16638898 C:\Program Files\Common Files\AOL\1174865921\EE\services\os\ver5_2_1_1\os.dll
    (unsigned) MD5: bf9d64e0ecd591bc1b38bd335156b66f C:\Program Files\Common Files\AOL\1174865921\EE\xprt5.dll
    (unsigned) MD5: fa3161dd7242d6d3f289e12ae7db09e2 C:\Program Files\Common Files\AOL\1174865921\EE\xprt6.dll
    (unsigned) MD5: 15b9cc21717f3cd0f660af315521e3c0 C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
    (unsigned) MD5: d7bb6d7be2ff99578c85646648f11d89 C:\Program Files\Common Files\Zinio\ZSHExt.dll
    (unsigned) MD5: 10628fba8f3a646c4e8a9e7140b18d3b C:\Program Files\Epson Software\FAX Utility\EbpD4Fax.dll
    (unsigned) MD5: 454b4597ccab2a9c1ac56ab4a7627fd4 C:\Program Files\Epson Software\FAX Utility\FUADRFIL.dll
    (unsigned) MD5: 88e703c2b2b046d9594b4ac33bc8e496 C:\Program Files\Epson Software\FAX Utility\FUFAXCFG.dll
    (unsigned) MD5: b456ecb177782a07919d9fdb32df32fa C:\Program Files\Epson Software\FAX Utility\FUFAXCSR.dll
    (unsigned) MD5: 098e01788db0a151ffe47bcdbd30469d C:\Program Files\Epson Software\FAX Utility\FUFAXLDB.dll
    (unsigned) MD5: b05763cd99eb4ca9f8d0a95bd182736b C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe
    (unsigned) MD5: 0747433908a47c49e3b7db6d51d7447c C:\Program Files\Epson Software\FAX Utility\FUFAXTIF.dll
    (unsigned) MD5: 543194e2595ee689d13750f4b77042a8 C:\Program Files\Epson Software\FAX Utility\FUIMGCDC.dll
    (unsigned) MD5: b14d5ac2f7f5583d9945afe911734e8b C:\Program Files\Epson Software\FAX Utility\FUSTMMSG.dll
    (unsigned) MD5: 7d470198b1e596ee9f8cb3695cff6815 C:\Program Files\Epson Software\FAX Utility\FUSVCCLT.dll
    (unsigned) MD5: 1a969bc3e4216d21816bf85677c96c2d C:\Program Files\Epson Software\FAX Utility\FUUSBHLP.dll
    (unsigned) MD5: 53d22eaa51c503dc92b37218d0bef981 C:\Program Files\Epson Software\FAX Utility\FUVERDLG.dll
    (unsigned) MD5: 684f88b5b258464c75acf9f3b80dd601 C:\Program Files\Epson Software\FAX Utility\Library\ENCM.dll
    (unsigned) MD5: 86ef02941b66a97001165113d44762cb C:\Program Files\Epson Software\FAX Utility\Library\ENNW.dll
    (unsigned) MD5: fec316b4f870807bdb7aa5829ebf4918 C:\Program Files\Epson Software\FAX Utility\Library\ENUTIL.dll
    (unsigned) MD5: 1311ee72da75652ee4259182fef9abfe C:\Program Files\Epson Software\FAX Utility\Library\FUDEVCOM.dll
    (unsigned) MD5: 2fd5fe04c8301ff3372d2771641cfd71 C:\Program Files\Epson Software\FAX Utility\Library\FUDRVUTL.dll
    (unsigned) MD5: bacc136da74d87338a1d7d34b62d1925 C:\Program Files\Epson Software\FAX Utility\Library\FUPRBDEV.dll
    (unsigned) MD5: 5e9d825913a97b934b9f73f4851d1fa9 C:\Program Files\Epson Software\FAX Utility\Library\FUSNMPUT.dll
    (unsigned) MD5: 29f477570fdd796d979bb5a781bd07f3 C:\Program Files\Epson Software\FAX Utility\Resource\FUCMNMSG.dll
    (unsigned) MD5: dcff1d3fa1aba1e701bfc321e3fb0b13 C:\Program Files\Epson Software\FAX Utility\Resource\FUFAXCFGRes.dll
    (unsigned) MD5: 7beb1df81373e7327a01a5ef4ddce42e C:\Program Files\Epson Software\FAX Utility\Resource\FUFAXSTM.dll
    (unsigned) MD5: 3cbde730e43f5cec3b5886ca0688324d C:\Program Files\Epson Software\FAX Utility\Resource\FUPRBDEVRes.dll
    (unsigned) MD5: 01b7c70130d046d2c186ba1de87653b9 C:\Program Files\Gadwin Systems\PrintScreenPro\PrintScreenPro.exe
    (unsigned) MD5: 52e276ce67464d35602cfd59a87895a6 C:\Program Files\Internet Explorer\plugins\nphppi.dll
    (unsigned) MD5: 4ebb5b4dcabec18b29d01f9f607b0114 C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
    (unsigned) MD5: b428173b2dafd1caa1ac91630b38f925 C:\Program Files\NewSoft\Presto! PageManager 8 for EP\MFC42.DLL
    (unsigned) MD5: 3f12bdfc669499dae6b0fba152c94390 C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll
    (unsigned) MD5: aa59c4c6b7cc91479deb47a40bee96e7 C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\stlport_vc7145.dll
    (unsigned) MD5: 8cbd57d84729debee1e83cb5fa3e3d7a C:\Program Files\QuickTime Alternative\QTTask.exe
    (unsigned) MD5: 38bac8ccb58206451c656d1b5d5cf8a5 C:\Program Files\StompSoft\PC BackUp\BlowFish.dll
    (unsigned) MD5: ccef776184489780750d8269e0e79bd0 C:\Program Files\StompSoft\PC BackUp\MailObj.dll
    (unsigned) MD5: 507a32a82522bd676254f32f4c652826 C:\Program Files\StompSoft\PC BackUp\NB_XSS.dll
    (unsigned) MD5: 7648a5b16ccdf7a4f9ecb70c25e59918 C:\Program Files\StompSoft\PC BackUp\NBKCTRL.exe
    (unsigned) MD5: 037b766ab9cec2f2f0e5963f40e63cbc C:\Program Files\StompSoft\PC BackUp\NMSAccess.exe
    (unsigned) MD5: 6a5098f8d12a7d36bead0040fb7105fc C:\Program Files\StompSoft\PC BackUp\NsDb.dll
    (unsigned) MD5: b90b8aebefa713066dcf0bd78165d097 C:\Program Files\StompSoft\PC BackUp\NsDisc.dll
    (unsigned) MD5: 7d08876a995df9e49730409253cf11a6 C:\Program Files\StompSoft\PC BackUp\nsecore.dll
    (unsigned) MD5: 71e23b404b00d4358a971b7a2b2e3aaa C:\Program Files\StompSoft\PC BackUp\NSENGINE.exe
    (unsigned) MD5: 247ac3ee16b69d25a193013169e825ff C:\Program Files\StompSoft\PC BackUp\NsSched.dll
    (unsigned) MD5: 7cca40cdd5b0b3b3d863bf51a4b0ccd0 C:\Program Files\StompSoft\PC BackUp\NsUtils.dll
    (unsigned) MD5: bf1fe9c864728b8c83b006d83f920fd9 C:\Program Files\StompSoft\PC BackUp\pkgdatabase.dll
    (unsigned) MD5: 5c91ebebca371c5f498af6f6bd3bae39 C:\Program Files\StompSoft\PC BackUp\pkgdbffile.dll
    (unsigned) MD5: e760c074a76c907c87dcb4ad8f4f47dd C:\Program Files\StompSoft\PC BackUp\pkgsysfile.dll
    (unsigned) MD5: 705f9176cad5ec73de01f095411a043e C:\Program Files\StompSoft\PC BackUp\pkgsysstate.dll
    (unsigned) MD5: 9e2a012746a8b4b57484520edb37be6e C:\Program Files\StompSoft\PC BackUp\VssClient.dll
    (unsigned) MD5: 972edede23ac8d59aac0c09799c6f18a C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    (unsigned) MD5: bcdff548f7d31a2bcf1cf98da7eb5445 C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
    (unsigned) MD5: 56ba0398301d8ce67242c12541b3a3e0 C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
    (unsigned) MD5: 0e40366ac6eb0337b0392b762691d9bd C:\Program Files\Visioneer OneTouch\OneTouchRes.dll
    (unsigned) MD5: 7a158ce90cc0591a422d08be10bd4052 C:\Program Files\Windows Time Synchronizer\WinTimeSync.exe
    (unsigned) MD5: 667f078955a93fe382f74d5f109dfe31 C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
    (unsigned) MD5: dfd0d26d2056f1d01adcdbb1e851119f C:\PROGRA~1\EPSONS~1\EVENTM~1\ASSIST~1\SCANAS~1\fioall32.dll
    (unsigned) MD5: 0bf1785d199b5da3cb6c61d7aeece654 C:\PROGRA~1\EPSONS~1\EVENTM~1\ASSIST~1\SCANAS~1\Ism.dll
    (unsigned) MD5: 2fe95d0dbceba4ed77a342dc6086b28d C:\PROGRA~1\EPSONS~1\EVENTM~1\ASSIST~1\SCANAS~1\SASM.dll
    (unsigned) MD5: d3f8a00d598090bfb18e70e02c12e38e C:\PROGRA~1\EPSONS~1\EVENTM~1\ASSIST~1\SCANAS~1\Satwain.dll
    (unsigned) MD5: 80bc3382a00f4e6d89cbfbf46989317a C:\PROGRA~1\EPSONS~1\EVENTM~1\ASSIST~1\SCANAS~1\SCANEN~1.DLL
    (unsigned) MD5: 7741f775060e84319198a7a67f1fe664 C:\PROGRA~1\EPSONS~1\EVENTM~1\ASSIST~1\SCANAS~1\Tcm.dll
    (unsigned) MD5: baf7bdd5a1eb63acd6eea20d4f731cb0 C:\PROGRA~1\EPSONS~1\EVENTM~1\EPNSM.dll
    (unsigned) MD5: 637124cdbff5819cb8a8478838a33048 C:\PROGRA~1\EPSONS~1\EVENTM~1\ESPSUTL.dll
    (unsigned) MD5: 4d197238fdfaa5793d1b0961aaef649a C:\PROGRA~1\EPSONS~1\EVENTM~1\Mfc42.dll
    (unsigned) MD5: bb2f8a045c4ed148840f37d29cdd96fa C:\PROGRA~1\VISION~1\ON68E8~1.DLL
    (unsigned) MD5: 6f91ee13bada1380b74afd4782ac9410 C:\WINDOWS\Downloaded Program Files\AudioUploadControl.ocx
    (unsigned) MD5: aed903a302cedd5eab3f3d66d7f83e8d C:\WINDOWS\Downloaded Program Files\avformat.dll
    (unsigned) MD5: 02e6d603e63ada190a55b67309086e8f C:\WINDOWS\Downloaded Program Files\AVSynchronizer.dll
    (unsigned) MD5: 535a2f49cf62374cb689405996bdf474 C:\WINDOWS\Downloaded Program Files\AxVideoView.ocx
    (unsigned) MD5: 939f06ca60d4040c29010c7bf1de70b8 C:\WINDOWS\Downloaded Program Files\BitmapOverlayFilter.ax
    (unsigned) MD5: 8eaac7186c4f356c6fb1192653ce32e3 C:\WINDOWS\Downloaded Program Files\CamCli.dll
    (unsigned) MD5: aed903a302cedd5eab3f3d66d7f83e8d C:\WINDOWS\Downloaded Program Files\CONFLICT.1\avformat.dll
    (unsigned) MD5: d7a15b47472d6eb51111e00c77a92354 C:\WINDOWS\Downloaded Program Files\CONFLICT.1\CamCli.dll
    (unsigned) MD5: 8f2164006a12f2e45635508c38542796 C:\WINDOWS\Downloaded Program Files\CONFLICT.1\TSBnwCam.ocx
    (unsigned) MD5: 8eaac7186c4f356c6fb1192653ce32e3 C:\WINDOWS\Downloaded Program Files\CONFLICT.2\CamCli.dll
    (unsigned) MD5: 2f1baeb90f59559f62549da7860d1d36 C:\WINDOWS\Downloaded Program Files\DVRClientTools.dll
    (unsigned) MD5: 6b2ab81be8e27b24013fc89e678a61e4 C:\WINDOWS\Downloaded Program Files\evt.dll
    (unsigned) MD5: 8cc3dfb827aab967eb532703e3a95394 C:\WINDOWS\Downloaded Program Files\ffdshow.exe
    (unsigned) MD5: a0853b8b95e5b3ce667353ba3b2a61ba C:\WINDOWS\Downloaded Program Files\GSM_codec.dll
    (unsigned) MD5: 1fe7721489712e47631f50ae11129815 C:\WINDOWS\Downloaded Program Files\ijl10.dll
    (unsigned) MD5: 5cb0f19a2151a53cba3aec0f16b5a298 C:\WINDOWS\Downloaded Program Files\IMMP4.OCX
    (unsigned) MD5: ac2e162a12f364043f2a9bb237c47c6d C:\WINDOWS\Downloaded Program Files\IMMP4Control.ocx
    (unsigned) MD5: 0c78701c6f42345dff2b2b6c3c3d01ef C:\WINDOWS\Downloaded Program Files\isusweb.dll
    (unsigned) MD5: 8bb797effc25643cc06d1a39616e8c9b C:\WINDOWS\Downloaded Program Files\JPEGTransFilter.ax
    (unsigned) MD5: 6b50f8428b5d7b9c2f3af93cfae7ab89 C:\WINDOWS\Downloaded Program Files\KSaveToDisk.ocx
    (unsigned) MD5: 5a108e8457b8b42136d574eb20525a64 C:\WINDOWS\Downloaded Program Files\LanDeviceSourceFilter.ax
    (unsigned) MD5: bf5797c556cf93b9b2ae2a920ae0d818 C:\WINDOWS\Downloaded Program Files\libBackupFile.dll
    (unsigned) MD5: 59d5e6ab7acb8c92d5ca435762104645 C:\WINDOWS\Downloaded Program Files\libWespNet.dll
    (unsigned) MD5: aebed2030fd024e0c4307e89920a4f8b C:\WINDOWS\Downloaded Program Files\MPEG4TransFilter.ax
    (unsigned) MD5: 56b18df82458606ab34288fa69814be7 C:\WINDOWS\Downloaded Program Files\mwcliun.exe
    (unsigned) MD5: b99c170223ac85dd0ce60470edd353dd C:\WINDOWS\Downloaded Program Files\NuCodec.dll
    (unsigned) MD5: 5d9f4c54dcd9a6f2984d46e446776a71 C:\WINDOWS\Downloaded Program Files\nuproc.dll
    (unsigned) MD5: 7c9e2ceb5f9a155731d4e42d8f061ec0 C:\WINDOWS\Downloaded Program Files\nusysd.dll
    (unsigned) MD5: 242975404daaa5eac29a5007e317fceb C:\WINDOWS\Downloaded Program Files\NVSViewerCtrl.ocx
    (unsigned) MD5: b1f5128148a4891814e372713d6aec5d C:\WINDOWS\Downloaded Program Files\OCXDownloadChecker_8120.ocx
    (unsigned) MD5: 4c58b7e59c17ac16661eb995b6437fac C:\WINDOWS\Downloaded Program Files\OCXDownloadChecker_8310.ocx
    (unsigned) MD5: 60793298fe477dcd9c46a3d8dc965184 C:\WINDOWS\Downloaded Program Files\parsedatapacket.dll
    (unsigned) MD5: 97b41e4c184b5c0d9a6dc0722341e48c C:\WINDOWS\Downloaded Program Files\Pixord.dll
    (unsigned) MD5: 27b26361d6530bb5f7d21b2423bd7e0a C:\WINDOWS\Downloaded Program Files\PLANETCamV.ocx
    (unsigned) MD5: 67eb410c62a7eaca514a36e4041d58fa C:\WINDOWS\Downloaded Program Files\ProPlaym4.dll
    (unsigned) MD5: 29c102e836fb17d39875b7517aa16504 C:\WINDOWS\Downloaded Program Files\rtp.dll
    (unsigned) MD5: 97b9612de12f192e792557ac082cfc25 C:\WINDOWS\Downloaded Program Files\RtspVapgDecoder.dll
    (unsigned) MD5: d2cbba6f1440731aa4ccb9e018df3eb6 C:\WINDOWS\Downloaded Program Files\TSBnwCam.ocx
    (unsigned) MD5: e266683fc95abdec17cd378564e1b54b C:\WINDOWS\Downloaded Program Files\tvichw32.sys
    (unsigned) MD5: 9d48c5a2f890db4e255784019d08fb50 C:\WINDOWS\Downloaded Program Files\UltraCamX.ocx
    (unsigned) MD5: e615413fe0b5ee7bd329f3a51d03e689 C:\WINDOWS\Downloaded Program Files\VATDecoder.dll
    (unsigned) MD5: 7d08a748a24a7bb39bdff68088acdd2a C:\WINDOWS\Downloaded Program Files\WESPDiscovery.dll
    (unsigned) MD5: 3db196cac1f5112e4a1dd1539ba5c683 C:\WINDOWS\Downloaded Program Files\WESPEvent.dll
    (unsigned) MD5: 831a6a5f928285235b2bd6bfde83695d C:\WINDOWS\Downloaded Program Files\WESPMonitor.dll
    (unsigned) MD5: 633a0659d64ab28d83cbdcf39602c6af C:\WINDOWS\Downloaded Program Files\WESPPlayback.dll
    (unsigned) MD5: 9a5317ac38dbc2c2ac29ffe25226804c C:\WINDOWS\Downloaded Program Files\WESPPTZ.dll
    (unsigned) MD5: db43f60b3b3340756153a6c8246619e7 C:\WINDOWS\Downloaded Program Files\WISEDec.dll
    (unsigned) MD5: b7e2734c702df3efc8347f12d7263712 C:\WINDOWS\system32\cutemon2k.dll
    (unsigned) MD5: e266683fc95abdec17cd378564e1b54b C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS
    (unsigned) MD5: e6bc5b364df5696b7888545b54a56ab7 C:\WINDOWS\system32\drivers\UDFReadr.sys
    (unsigned) MD5: 198b1a2308eae17cfc0d0b5c77936d68 C:\WINDOWS\system32\DRIVERS\vusbser.sys
    (unsigned) MD5: 4f0df2d4de4a23a507135230ab5a028b C:\WINDOWS\system32\nt5CDLmn.dll
    (unsigned) MD5: 0c3898fe37fd511d99fd35b24338e951 C:\WINDOWS\system32\ptprop.dll
    (unsigned) MD5: 158b4ce03655bc448b29f27f730f2cb7 C:\WINDOWS\system32\ptpropr.dll
    (unsigned) MD5: 7fe90e1a5034893d6909658dc5b02a48 C:\WINDOWS\system32\pttzpcl.dll
    (unsigned) MD5: 73e61f1978f37b659718d6f33d9946da C:\WINDOWS\system32\ventmon.dll
    (unsigned) MD5: c8413f5b1a6868ab81fb1c15200343e4 C:\WINDOWS\wanmpsvc.exe
    (unsigned) MD5: 686b224b4987c22b153fbb545fee9657 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\mfc80u.dll
    (unsigned) MD5: 8c7efbb06d10dc915809a4931409f06f E:\Program Files\Mozilla Firefox\freebl3.dll
    (unsigned) MD5: f32e5182eebab7698a6c1dd1eb9b2cfc E:\Program Files\Mozilla Firefox\nssdbm3.dll
    (unsigned) MD5: bb2fd4632cbf410c584bab0be026b733 E:\Program Files\Mozilla Firefox\plugins\npmozax.dll
    (unsigned) MD5: 4c1b4976f161fb54bbdd16a611b8b851 E:\Program Files\Mozilla Firefox\plugins\npRACtrl.dll
    (unsigned) MD5: 4b0e1ad13e44536bfa0d995e474c3efc E:\Program Files\Mozilla Firefox\plugins\npunagi2.dll
    (unsigned) MD5: a2c1855c23f722db2765612696bcc7c1 E:\Program Files\Mozilla Firefox\plugins\ractrlkeyhook.dll
    (unsigned) MD5: 1733738c15ad02fb4ca9f3ce13f40623 E:\Program Files\Mozilla Firefox\softokn3.dll

    The following file(s) must be uploaded for server-side scanning:
    C:\WINDOWS\Downloaded Program Files\WESPMonitor.dll
    C:\WINDOWS\Downloaded Program Files\WESPPTZ.dll
    C:\WINDOWS\Downloaded Program Files\libWespNet.dll
    C:\WINDOWS\Downloaded Program Files\WESPDiscovery.dll
    C:\WINDOWS\Downloaded Program Files\WESPPlayback.dll
    C:\WINDOWS\Downloaded Program Files\KSaveToDisk.ocx
    C:\WINDOWS\Downloaded Program Files\WESPEvent.dll
    C:\WINDOWS\Downloaded Program Files\libBackupFile.dll

    Upload started - 8 file(s)
    KSaveToDisk.ocx (77824)
    libBackupFile.dll (135168)
    libWespNet.dll (143360)
    WESPDiscovery.dll (159744)
    WESPEvent.dll (176128)
    WESPPTZ.dll (184320)
    WESPPlayback.dll (327680)
    WESPMonitor.dll (331776)
    Upload speed - 39 KB/s
    Upload finished - 8 uploaded, 0 failed

    The uploaded file(s) were found clean.

    Scan finished - communication took 40 sec
    Total traffic - 1.54 MB sent, 1.45 KB recvd
    Scanned 1326 files and modules - 90 seconds

    ==============================================================================
     
    kkrich,
    #35
  17. 2011/03/23
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Your computer is clean :)

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current.

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. Run defrag at your convenience.

    11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    12. Please, let me know, how your computer is doing.
     
    broni,
    #36
  18. 2011/03/23
    kkrich

    kkrich Inactive Thread Starter

    Joined:
    2011/03/16
    Messages:
    25
    Likes Received:
    0
    otl last run, I hope

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: admin2
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users
    ->Flash cache emptied: 0 bytes

    User: backup
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: HOME

    User: Kerry
    ->Temp folder emptied: 214021 bytes
    ->Temporary Internet Files folder emptied: 403347 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 43436516 bytes
    ->Flash cache emptied: 656 bytes

    User: Kids
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: kkr
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 66016 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Flash cache emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: SYSTEM

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 22386 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 42.00 mb


    [EMPTYFLASH]

    User: admin2

    User: Administrator

    User: All Users
    ->Flash cache emptied: 0 bytes

    User: backup
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: HOME

    User: Kerry
    ->Flash cache emptied: 0 bytes

    User: Kids
    ->Flash cache emptied: 0 bytes

    User: kkr
    ->Flash cache emptied: 0 bytes

    User: LocalService
    ->Flash cache emptied: 0 bytes

    User: NetworkService

    User: SYSTEM

    Total Flash Files Cleaned = 0.00 mb

    Restore points cleared and new OTL Restore Point set!

    OTL by OldTimer - Version 3.2.22.3 log created on 03232011_191930

    Files\Folders moved on Reboot...
    File move failed. C:\Documents and Settings\Kerry\Local Settings\Temp\WCESLog.log scheduled to be moved on reboot.
    C:\Documents and Settings\Kerry\Local Settings\Temp\~DFDBB4.tmp moved successfully.
    File\Folder C:\WINDOWS\temp\_avast_\Webshlock.txt not found!
    File\Folder C:\WINDOWS\temp\Perflib_Perfdata_ff0.dat not found!
    File\Folder C:\WINDOWS\temp\ZLT03204.TMP not found!

    Registry entries deleted on Reboot...
     
    kkrich,
    #37
  19. 2011/03/23
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Whenever ready....
     
    broni,
    #38
  20. 2011/03/23
    kkrich

    kkrich Inactive Thread Starter

    Joined:
    2011/03/16
    Messages:
    25
    Likes Received:
    0
    questions

    Broni, I can't thank you enough for your help!

    OTL cleanup ran and rebooted computer.

    Will remove all tools but will keep copies of logs/txt files.

    I have used CCleaner weekly to delete temp files and more often if I am doing a lot of research on the net but I will start using TFC.

    Malwarebytes still on computer. Will run once a week.

    I have download PSI and will install it probably tomorrow but maybe tonight.
    The same for Filehippo and WOT.

    Currently I check defrag once per month. Should I do it more?

    This computer is on a LAN with 5 other computers in my home. Usually, it and one one other are connected to the LAN most of the time. Should I worry about malware/virus I had moved to the other computers over the LAN? Also, 1 NAS running full time.

    I will keep to know websites and programs tonight and tomorrow will make a trip to MicroCenter and get a couple of hard drives to ghost C:\ and E:\ so I know I will have clean drives I can change if needed (I sure hope not).

    Again, thank you very much for your time and expert advice.

    Sincerely,
    Kerry
     
    kkrich,
    #39
  21. 2011/03/24
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You're very welcome :)

    Good enough.

    As for other computer...keep an eye on them.
    If you see something unusual, you can always create new topic.

    Good luck and stay safe :)
     
    broni,
    #40
Page 2 of 3

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...