1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Active google search redirects

Discussion in 'Malware and Virus Removal Archive' started by erika, 2009/01/03.

Page 1 of 2
  1. 2009/01/03
    erika

    erika Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    56
    Likes Received:
    0
    [Active] google search redirects

    happy new year everyone!!

    help please!!

    i'm not sure if i'm in the right place but i have a similar problem as zedi, when i use the google search engine on firefox or internet explorer and click on 1 of the webpages links, it brings me to other sites..

    the sites are related though, for example if i click on air jamaica, it'll bring me to a discount travel website.

    i have done the clear private data + clicked cookies on firefox and the setting in security in internet explorer is medium high..

    i ran the malware (i found it in a previous similar thread) and it said it deleted infections

    i see the recommendations given here but i'm scared to do them because i don't know if my situation is the same..

    i don't know anything about computers so please be gentle :eek:

    i'm going to post my log for you to see

    thanks in advance


    ****************************************************

    Malwarebytes' Anti-Malware 1.31
    Database version: 1599
    Windows 5.1.2600 Service Pack 3

    1/3/2009 1:02:14 AM
    mbam-log-2009-01-03 (01-02-14).txt

    Scan type: Quick Scan
    Objects scanned: 60732
    Time elapsed: 7 minute(s), 37 second(s)

    Memory Processes Infected: 1
    Memory Modules Infected: 0
    Registry Keys Infected: 24
    Registry Values Infected: 1
    Registry Data Items Infected: 0
    Folders Infected: 1
    Files Infected: 4

    Memory Processes Infected:
    C:\WINDOWS\bolivar30.exe (Trojan.Agent) -> Unloaded process successfully.

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\application layer gateway service (alg) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\application layer gateway service (alg) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\application layer gateway service (alg) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\cryptographic services (cryptsvc) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\cryptographic services (cryptsvc) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cryptographic services (cryptsvc) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\error reporting service (ersvc) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\error reporting service (ersvc) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\error reporting service (ersvc) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\google updater service (gusvc) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\google updater service (gusvc) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\google updater service (gusvc) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ipod service (ipod service) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\ipod service (ipod service) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ipod service (ipod service) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mcafee real-time scanner (mcshield) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\mcafee real-time scanner (mcshield) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mcafee real-time scanner (mcshield) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mcafee services (mcmscsvc) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\mcafee services (mcmscsvc) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mcafee services (mcmscsvc) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\windows audio (audiosrv) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\windows audio (audiosrv) (Trojan.Proxy) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\windows audio (audiosrv) (Trojan.Proxy) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysftray2 (Trojan.Agent) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    C:\Program Files\TinyProxy (Trojan.Proxy) -> Quarantined and deleted successfully.

    Files Infected:
    C:\Program Files\TinyProxy\tinyproxy.exe (Trojan.Proxy) -> Quarantined and deleted successfully.
    C:\WINDOWS\bolivar30.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Guest\Local Settings\Temp\tt_1229716627.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Guest\Local Settings\Temp\tt_1229716631.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
     
    erika,
    #1
  2. 2009/01/03
    Aaflac

    Aaflac Inactive

    Joined:
    2008/11/02
    Messages:
    294
    Likes Received:
    1
    erika,

    We need to get a more comprehensive report of what is present in your system.

    Please download Random's System Information Tool (RSIT)
    • Save it to the Desktop
    • Double click on RSIT.exe to run the program
    • Click Continue at the disclaimer screen
    • Once the tool finishes, two logs open. Log.txt is maximized , and Info.txt is minimized. (The logs are also contained in C:\rsit)
    ~~~~
    Please provide the RSIT: Log.txt and Info.txt reports in your reply.

    You may need to do consecutive posts (one after the other) right in this thread, if the logs are too long.
     
    Aaflac,
    #2


  3. to hide this advert.

  4. 2009/01/04
    erika

    erika Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    56
    Likes Received:
    0
    thanx so much for your help...here's the 1st one:

    Logfile of random's system information tool 1.05 (written by random/random)
    Run by User at 2009-01-04 10:48:48
    Microsoft Windows XP Professional Service Pack 3
    System drive C: has 226 GB (95%) free of 238 GB
    Total RAM: 446 MB (35% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:49:11 AM, on 1/4/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Program Files\tintinyproxyy\tinyproxy.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Common Files\Teleca Shared\Generic.exe
    C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\PROGRA~1\McAfee\MSC\mcregist.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    c:\PROGRA~1\mcafee\msc\mcuimgr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Documents and Settings\User\Desktop\RSIT.exe
    C:\Program Files\trend micro\User.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9090
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
    O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155746453015
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Help and Support (helpsvc) - Unknown owner - C:\Program Files\tintinyproxyy\tinyproxy.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

    --
    End of file - 8409 bytes

    ======Scheduled tasks folder======

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job
    C:\WINDOWS\tasks\McDefragTask.job
    C:\WINDOWS\tasks\McQcTask.job

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-04 320920]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
    scriptproxy - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll [2007-07-24 66880]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 322368]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
    Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll [2008-11-28 657904]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
    McAfee SiteAdvisor BHO - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll [2008-11-14 150032]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
    Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2006-09-27 544032]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
    Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-04 34816]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
    JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-04 73728]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2006-09-27 544032]
    {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll [2008-11-14 150032]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "RTHDCPL "=C:\WINDOWS\RTHDCPL.EXE [2006-04-17 16143872]
    "mcagent_exe "=C:\Program Files\McAfee.com\Agent\mcagent.exe [2007-08-03 582992]
    "QuickTime Task "=C:\Program Files\QuickTime\QTTask.exe [2008-11-04 413696]
    "iTunesHelper "=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]
    "SunJavaUpdateSched "=C:\Program Files\Java\jre6\bin\jusched.exe [2008-12-04 136600]
    " "= []
    "Sony Ericsson PC Suite "=C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2005-10-26 159744]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
    "MsnMsgr "=C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]
    "MSMSGS "=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
    C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
    C:\WINDOWS\ehome\ehtray.exe [2005-08-05 64512]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
    C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2006-03-15 208952]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
    C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2006-03-15 59392]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
    C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2006-03-15 455168]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
    C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2006-03-15 455168]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe [2005-11-10 36975]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2004-12-14 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
    C:\PROGRA~1\INTERV~1\Common\Bin\WINCIN~1.EXE [2002-08-04 98304]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    C:\PROGRA~1\MICROS~4\Office10\OSA.EXE [2001-02-13 83360]

    C:\Documents and Settings\User\Start Menu\Programs\Startup
    LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
    C:\WINDOWS\system32\Ati2evxx.dll [2006-06-16 86016]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    C:\WINDOWS\system32\WgaLogon.dll [2006-06-19 702768]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MpfService]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername "=0
    "legalnoticecaption "=
    "legalnoticetext "=
    "shutdownwithoutlogon "=1
    "undockwithoutlogon "=1
    "InstallVisualStyle "=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
    "InstallTheme "=C:\WINDOWS\Resources\Themes\Royale.theme

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveTypeAutoRun "=145

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\MSN Messenger\msnmsgr.exe "= "C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 "
    "C:\Program Files\MSN Messenger\livecall.exe "= "C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) "
    "C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe "= "C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent "
    "C:\Program Files\Bonjour\mDNSResponder.exe "= "C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour "
    "C:\Program Files\iTunes\iTunes.exe "= "C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes "
    "C:\Program Files\LimeWire\LimeWire.exe "= "C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire "
    "C:\Program Files\tinyproxy\tinyproxy.exe "= "C:\Program Files\tinyproxy\tinyproxy.exe:*:Enabled:tinyproxy "
    "C:\Program Files\tintinyproxyy\tinyproxy.exe "= "C:\Program Files\tintinyproxyy\tinyproxy.exe:*:Enabled:tinyproxy "
    "C:\Program Files\Messenger\msmsgs.exe "= "C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger "

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\MSN Messenger\msnmsgr.exe "= "C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 "
    "C:\Program Files\MSN Messenger\livecall.exe "= "C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) "

    ======List of files/folders created in the last 1 months======

    2009-01-04 10:48:49 ----D---- C:\Program Files\trend micro
    2009-01-04 10:48:48 ----D---- C:\rsit
    2009-01-03 00:52:42 ----D---- C:\Documents and Settings\User\Application Data\Malwarebytes
    2009-01-03 00:52:31 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2009-01-03 00:52:30 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2009-01-02 23:25:14 ----D---- C:\Program Files\Lavasoft
    2009-01-02 23:25:12 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2009-01-02 23:22:20 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
    2008-12-26 21:04:49 ----D---- C:\WINDOWS\system32\appmgmt
    2008-12-26 20:37:02 ----A---- C:\WINDOWS\ModemLog_Sony Ericsson Device 047 USB WMC Modem.txt
    2008-12-26 20:37:00 ----A---- C:\WINDOWS\ModemLog_Sony Ericsson Device 047 USB WMC Data Modem.txt
    2008-12-26 20:18:29 ----D---- C:\Documents and Settings\User\Application Data\Teleca
    2008-12-26 20:18:02 ----D---- C:\Documents and Settings\User\Application Data\Sony Ericsson
    2008-12-26 20:09:34 ----D---- C:\Documents and Settings\All Users\Application Data\Sony Ericsson
    2008-12-26 20:09:14 ----D---- C:\Program Files\Common Files\Teleca Shared
    2008-12-26 20:09:12 ----D---- C:\Program Files\Sony Ericsson
    2008-12-26 20:09:12 ----D---- C:\Documents and Settings\All Users\Application Data\Teleca
    2008-12-26 20:07:45 ----D---- C:\WINDOWS\Downloaded Installations
    2008-12-26 19:23:41 ----D---- C:\Program Files\tintinyproxyy
    2008-12-19 18:52:52 ----D---- C:\WINDOWS\system32\Adobe
    2008-12-11 22:37:11 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
    2008-12-11 22:36:11 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
    2008-12-11 22:35:30 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
    2008-12-11 22:35:17 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$

    ======List of files/folders modified in the last 1 months======

    2009-01-04 10:49:01 ----D---- C:\WINDOWS\Temp
    2009-01-04 10:48:49 ----RD---- C:\Program Files
    2009-01-04 10:45:50 ----D---- C:\Program Files\Mozilla Firefox
    2009-01-04 10:39:35 ----D---- C:\Program Files\LimeWire
    2009-01-03 11:00:17 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater
    2009-01-03 08:32:21 ----D---- C:\WINDOWS\Registration
    2009-01-03 08:30:37 ----D---- C:\WINDOWS
    2009-01-03 08:30:33 ----D---- C:\Documents and Settings\User\Application Data\LimeWire
    2009-01-03 01:11:47 ----A---- C:\WINDOWS\SchedLgU.Txt
    2009-01-03 01:06:02 ----D---- C:\WINDOWS\system32\drivers
    2009-01-03 00:52:36 ----D---- C:\WINDOWS\Prefetch
    2009-01-03 00:34:19 ----D---- C:\WINDOWS\network diagnostic
    2009-01-02 23:26:14 ----SHD---- C:\WINDOWS\Installer
    2009-01-02 23:25:12 ----D---- C:\WINDOWS\system32
    2009-01-02 23:22:20 ----D---- C:\Program Files\Common Files
    2008-12-31 23:06:00 ----SD---- C:\Documents and Settings\User\Application Data\Microsoft
    2008-12-26 22:42:47 ----D---- C:\Documents and Settings\User\Application Data\Apple Computer
    2008-12-26 20:15:53 ----HD---- C:\WINDOWS\inf
    2008-12-26 20:15:29 ----D---- C:\WINDOWS\system32\ReinstallBackups
    2008-12-26 20:14:40 ----DC---- C:\WINDOWS\system32\DRVSTORE
    2008-12-26 20:14:30 ----D---- C:\WINDOWS\system32\CatRoot2
    2008-12-26 20:07:40 ----D---- C:\Program Files\Common Files\InstallShield
    2008-12-19 19:02:13 ----D---- C:\Documents and Settings\User\Application Data\Adobe
    2008-12-19 14:55:52 ----D---- C:\Documents and Settings
    2008-12-19 10:40:57 ----D---- C:\Program Files\McAfee
    2008-12-18 19:50:51 ----RSHDC---- C:\WINDOWS\system32\dllcache
    2008-12-18 19:50:31 ----HD---- C:\WINDOWS\$hf_mig$
    2008-12-13 01:40:02 ----A---- C:\WINDOWS\system32\mshtml.dll
    2008-12-12 20:06:52 ----A---- C:\WINDOWS\imsins.BAK
    2008-12-11 22:36:52 ----D---- C:\Program Files\Internet Explorer

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
    R1 mfehidk;McAfee Inc. mfehidk; C:\WINDOWS\system32\drivers\mfehidk.sys [2007-11-22 201320]
    R1 MPFP;MPFP; C:\WINDOWS\System32\Drivers\Mpfp.sys [2007-07-13 113952]
    R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-06-16 1611776]
    R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
    R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
    R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
    R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-04-17 4262912]
    R3 mfeavfk;McAfee Inc. mfeavfk; C:\WINDOWS\system32\drivers\mfeavfk.sys [2007-11-22 79304]
    R3 mfebopk;McAfee Inc. mfebopk; C:\WINDOWS\system32\drivers\mfebopk.sys [2007-11-22 35240]
    R3 mfesmfk;McAfee Inc. mfesmfk; C:\WINDOWS\system32\drivers\mfesmfk.sys [2007-12-02 40488]
    R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-15 12160]
    R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-01-18 80512]
    R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
    R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
    R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
    S3 mferkdk;McAfee Inc. mferkdk; C:\WINDOWS\system32\drivers\mferkdk.sys [2007-11-22 33832]
    S3 MHNDRV;MHN driver; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
    S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
    S3 s116bus;Sony Ericsson Device 116 driver (WDM); C:\WINDOWS\system32\DRIVERS\s116bus.sys [2007-04-03 83336]
    S3 SE2Fbus;Sony Ericsson Device 047 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\SE2Fbus.sys [2006-11-10 61600]
    S3 SE2Fmdfl;Sony Ericsson Device 047 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\SE2Fmdfl.sys [2006-11-10 9360]
    S3 SE2Fmdm;Sony Ericsson Device 047 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\SE2Fmdm.sys [2006-11-10 97184]
    S3 SE2Fmgmt;Sony Ericsson Device 047 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\SE2Fmgmt.sys [2006-11-10 88688]
    S3 se2Fnd5;Sony Ericsson Device 047 USB Ethernet Emulation SEMC47 (NDIS); C:\WINDOWS\system32\DRIVERS\se2Fnd5.sys [2006-11-10 18704]
    S3 SE2Fobex;Sony Ericsson Device 047 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\SE2Fobex.sys [2006-11-10 86560]
    S3 se2Funic;Sony Ericsson Device 047 USB Ethernet Emulation SEMC47 (WDM); C:\WINDOWS\system32\DRIVERS\se2Funic.sys [2006-11-10 90800]
    S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
    S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-09-10 611664]
    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
    R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-06-16 389120]
    R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
    R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2006-06-29 237568]
    R2 ehSched;Media Center Scheduler Service; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 102912]
    R2 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-28 168432]
    R2 Help and Support (helpsvc) ;Help and Support (helpsvc) ; C:\Program Files\tintinyproxyy\tinyproxy.exe [2008-12-26 8960]
    R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-04 152984]
    R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2005-09-22 53248]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [2008-12-05 206096]
    R2 mcmscsvc;McAfee Services; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [2008-01-09 767976]
    R2 McNASvc;McAfee Network Agent; c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe [2008-01-25 2458128]
    R2 McProxy;McAfee Proxy Service; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2007-08-15 359248]
    R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
    R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2007-07-24 144704]
    R2 MpfService;McAfee Personal Firewall Service; C:\Program Files\McAfee\MPF\MPFSrv.exe [2007-07-18 856864]
    R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
    R3 McSysmon;McAfee SystemGuards; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [2007-07-25 695624]
    R3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-04-13 33632]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-04-13 68952]
    S3 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2007-11-07 378184]
    S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
    S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-08-03 38912]
    S3 WMConnectCDS;Windows Media Connect Service; C:\Program Files\Windows Media Connect 2\wmccds.exe [2005-10-06 855552]

    -----------------EOF-----------------
     
    erika,
    #3
  5. 2009/01/04
    erika

    erika Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    56
    Likes Received:
    0
    and the 2nd one...

    info.txt logfile of random's system information tool 1.05 2009-01-04 10:49:17

    ======Uninstall list======

    -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
    Ad-Aware-->MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}
    Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
    Adobe Reader 7.0-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70000000000}
    Adobe Shockwave Player 11-->C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
    Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
    Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
    ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
    Bejeweled Twist 1.0-->C:\Program Files\PopCap Games\Bejeweled Twist\PopUninstall.exe "C:\Program Files\PopCap Games\Bejeweled Twist\Install.log "
    Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
    Costco Photo Organizer-->MsiExec.exe /X{B79498A8-0C5F-478D-AE64-A517C423C33B}
    Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
    Google Updater--> "C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
    Hammer Heads Deluxe 1.1-->C:\Program Files\PopCap Games\Hammer Heads Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Hammer Heads Deluxe\Install.log "
    High Definition Audio Driver Package - KB888111--> "C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe "
    HijackThis 2.0.2--> "C:\Program Files\trend micro\HijackThis.exe" /uninstall
    Hotfix for Windows Internet Explorer 7 (KB947864)--> "C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe "
    Hotfix for Windows Media Player 10 (KB903157)--> "C:\WINDOWS\$NtUninstallKB903157$\spuninst\spuninst.exe "
    Hotfix for Windows XP (KB952287)--> "C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe "
    InterVideo WinDVD 4--> "C:\Program Files\InstallShield Installation Information\{98E8A2EF-4EAE-43B8-A172-74842B764777}\setup.exe" REMOVEALL
    iTunes-->MsiExec.exe /I{318AB667-3230-41B5-A617-CB3BF748D371}
    J2SE Runtime Environment 5.0 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150060}
    Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
    LimeWire 4.18.8--> "C:\Program Files\LimeWire\uninstall.exe "
    Macromedia Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
    Malwarebytes' Anti-Malware--> "C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe "
    Map Button (Windows Live Toolbar)-->MsiExec.exe /X{ECDA9BD9-A54E-462A-8191-A2B569D9AB34}
    McAfee SecurityCenter-->C:\Program Files\McAfee\MSC\mcuninst.exe
    Microsoft .NET Framework 1.1 Hotfix (KB928366)--> "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp "
    Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
    Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
    Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
    Microsoft Base Smart Card Cryptographic Service Provider Package--> "C:\WINDOWS\$NtUninstallbasecsp$\spuninst\spuninst.exe "
    Microsoft Digital Image Standard 2006--> "C:\Program Files\Common Files\Microsoft Shared\Picture It!\RmvSuite.exe" ADDREMOVE=1 SKU=PREM VERSION=11
    Microsoft Encarta Encyclopedia Standard 2006-->MsiExec.exe /I{06040048-3E21-46D6-9A91-D927BA08F41D}
    Microsoft Internationalized Domain Names Mitigation APIs--> "C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe "
    Microsoft Location Finder-->MsiExec.exe /I{9D18F7F8-B984-4249-8512-CC621BC59F12}
    Microsoft Money 2006--> "c:\program files\microsoft money 2006\MNYCoreFiles\Setup\uninst.exe" /s:120
    Microsoft National Language Support Downlevel APIs--> "C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe "
    Microsoft Streets & Trips 2006-->MsiExec.exe /I{83ED1E80-A1B7-4226-BCF1-AC4A88151A6B}
    Microsoft Word 2002-->MsiExec.exe /I{911B0409-6000-11D3-8CFE-0050048383C9}
    Microsoft Works Suite 2006 Setup Launcher-->C:\Program Files\Microsoft Works Suite 2006\Setup\Launcher.exe /ARP D:\
    Microsoft Works Suite Add-in for Microsoft Word-->MsiExec.exe /I{17E3A651-12B9-4149-BAE8-E6FB9A5ADC4F}
    Microsoft Works-->MsiExec.exe /I{6D52C408-B09A-4520-9B18-475B81D393F1}
    Mozilla Firefox (3.0.5)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
    MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
    MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
    Nero OEM-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
    OneCare Advisor (Windows Live Toolbar)-->MsiExec.exe /X{DF821FC5-C198-452B-A0D4-82433EFEAE9B}
    PopCap Browser Plugin-->C:\Program Files\PopCap Games\PopCap Browser Plugin\Uninstall.exe
    Popup Blocker (Windows Live Toolbar)-->MsiExec.exe /X{117CD9C0-0F15-4633-93D7-F957B50535A5}
    QuickTime-->MsiExec.exe /I{F958CA02-BB40-4007-894B-258729456EE4}
    REALTEK GbE & FE Ethernet PCI NIC Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\setup.exe" -l0x9 -removeonly
    Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x9 -removeonly
    Security Update for Microsoft .NET Framework 2.0 (KB928365)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {8056AC9E-49C5-4375-9ADE-B2F862C9DF51} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}
    Security Update for Windows Internet Explorer 7 (KB938127-v2)--> "C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe "
    Security Update for Windows Internet Explorer 7 (KB956390)--> "C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe "
    Security Update for Windows Internet Explorer 7 (KB958215)--> "C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe "
    Security Update for Windows Internet Explorer 7 (KB960714)--> "C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe "
    Security Update for Windows Media Player (KB952069)--> "C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe "
    Security Update for Windows Media Player 10 (KB917734)--> "C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe "
    Security Update for Windows Media Player 10 (KB936782)--> "C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB913433)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB913433.inf
    Security Update for Windows XP (KB923689)--> "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB938464)--> "C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB941569)--> "C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB946648)--> "C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB950762)--> "C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB950974)--> "C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB951066)--> "C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB951376-v2)--> "C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB951698)--> "C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB952954)--> "C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB954211)--> "C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB954459)--> "C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB954600)--> "C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB955069)--> "C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB956391)--> "C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB956802)--> "C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB956803)--> "C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB956841)--> "C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB957095)--> "C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB957097)--> "C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe "
    Security Update for Windows XP (KB958644)--> "C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe "
    Smart Menus (Windows Live Toolbar)-->MsiExec.exe /X{95FC661A-A0C5-4B18-92CE-90347DA79CC9}
    Sony Ericsson PC Suite-->MsiExec.exe /I{B56B1487-9A26-4AFD-A1FD-949C40F5F2BC}
    Update for Windows Media Player 10 (KB913800)--> "C:\WINDOWS\$NtUninstallKB913800$\spuninst\spuninst.exe "
    Update for Windows XP (KB942763)--> "C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe "
    Update for Windows XP (KB951072-v2)--> "C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe "
    Update for Windows XP (KB951978)--> "C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe "
    Update for Windows XP (KB955839)--> "C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe "
    Update Rollup 2 for Windows XP Media Center Edition 2005-->C:\WINDOWS\$NtUninstallKB900325$\spuninst\spuninst.exe
    Windows Internet Explorer 7--> "C:\WINDOWS\ie7\spuninst\spuninst.exe "
    Windows Live Favorites for Windows Live Toolbar-->MsiExec.exe /X{DCE65B11-710D-4C54-9DE5-1A6A0BD2186B}
    Windows Live Messenger-->MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F}
    Windows Live Outlook Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{A40D6757-B145-4FE7-B694-89180A9F3F64}
    Windows Live Sign-in Assistant-->MsiExec.exe /I{49672EC2-171B-47B4-8CE7-50D7806360D7}
    Windows Live Toolbar Extension (Windows Live Toolbar)-->MsiExec.exe /X{3727B920-F5A3-46A4-AC02-94F421A039C7}
    Windows Live Toolbar--> "C:\Program Files\Windows Live Toolbar\UnInstall.exe" {DA0FFF7B-DA9D-46A2-A329-87804ECA58EA}
    Windows Live Toolbar-->MsiExec.exe /X{DA0FFF7B-DA9D-46A2-A329-87804ECA58EA}
    Windows Media Connect--> "C:\WINDOWS\$NtUninstallWMCSetup$\spuninst\spuninst.exe "
    Windows Media Format Runtime--> "C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
    Windows Media Format SDK Hotfix - KB891122--> "C:\WINDOWS\$NtUninstallKB891122$\spuninst\spuninst.exe "
    Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
    Windows XP Media Center Edition 2005 KB919803--> "C:\WINDOWS\$NtUninstallKB919803$\spuninst\spuninst.exe "
    Windows XP Service Pack 3--> "C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe "
    XP Codec Pack-->C:\Program Files\XP Codec Pack\Uninstall.exe

    ======Security center information======

    AV: McAfee VirusScan (outdated)
    FW: McAfee Personal Firewall

    System event log

    Computer Name: USER-0DA9DBC783
    Event Code: 4377
    Message: Windows XP Hotfix KB938127-v2-IE7 was installed.

    Record Number: 348
    Source Name: NtServicePack
    Time Written: 20081111213039.000000-300
    Event Type: information
    User: NT AUTHORITY\SYSTEM

    Computer Name: USER-0DA9DBC783
    Event Code: 19
    Message: Installation Successful: Windows successfully installed the following update: Security Update for Microsoft Office 2002 (KB956464)

    Record Number: 347
    Source Name: Windows Update Agent
    Time Written: 20081111213033.000000-300
    Event Type: information
    User:

    Computer Name: USER-0DA9DBC783
    Event Code: 19
    Message: Installation Successful: Windows successfully installed the following update: Security Update for Windows XP (KB956841)

    Record Number: 346
    Source Name: Windows Update Agent
    Time Written: 20081111213011.000000-300
    Event Type: information
    User:

    Computer Name: USER-0DA9DBC783
    Event Code: 4377
    Message: Windows XP Hotfix KB956841 was installed.

    Record Number: 345
    Source Name: NtServicePack
    Time Written: 20081111213011.000000-300
    Event Type: information
    User: NT AUTHORITY\SYSTEM

    Computer Name: USER-0DA9DBC783
    Event Code: 19
    Message: Installation Successful: Windows successfully installed the following update: Security Update for Windows XP (KB950762)

    Record Number: 344
    Source Name: Windows Update Agent
    Time Written: 20081111213001.000000-300
    Event Type: information
    User:

    Application event log

    Computer Name: USER-0DA9DBC783
    Event Code: 11500
    Message: Product: Sony Ericsson PC Suite -- Error 1500.Another installation is in progress. You must complete that installation before continuing this one.

    Record Number: 527
    Source Name: MsiInstaller
    Time Written: 20081226212449.000000-300
    Event Type: error
    User: USER-0DA9DBC783\User

    Computer Name: USER-0DA9DBC783
    Event Code: 11500
    Message: Product: Sony Ericsson PC Suite -- Error 1500.Another installation is in progress. You must complete that installation before continuing this one.

    Record Number: 526
    Source Name: MsiInstaller
    Time Written: 20081226212448.000000-300
    Event Type: error
    User: USER-0DA9DBC783\User

    Computer Name: USER-0DA9DBC783
    Event Code: 11729
    Message: Product: Sony Ericsson PC Suite -- Configuration failed.

    Record Number: 525
    Source Name: MsiInstaller
    Time Written: 20081226211030.000000-300
    Event Type: information
    User: USER-0DA9DBC783\User

    Computer Name: USER-0DA9DBC783
    Event Code: 11500
    Message: Product: Sony Ericsson PC Suite -- Error 1500.Another installation is in progress. You must complete that installation before continuing this one.

    Record Number: 524
    Source Name: MsiInstaller
    Time Written: 20081226211011.000000-300
    Event Type: error
    User: USER-0DA9DBC783\User

    Computer Name: USER-0DA9DBC783
    Event Code: 1002
    Message: The shell stopped unexpectedly and Explorer.exe was restarted.

    Record Number: 523
    Source Name: Winlogon
    Time Written: 20081226202051.000000-300
    Event Type: information
    User:

    ======Environment variables======

    "ComSpec "=%SystemRoot%\system32\cmd.exe
    "Path "=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Common Files\Teleca Shared
    "windir "=%SystemRoot%
    "FP_NO_HOST_CHECK "=NO
    "OS "=Windows_NT
    "PROCESSOR_ARCHITECTURE "=x86
    "PROCESSOR_LEVEL "=15
    "PROCESSOR_IDENTIFIER "=x86 Family 15 Model 4 Stepping 7, GenuineIntel
    "PROCESSOR_REVISION "=0407
    "NUMBER_OF_PROCESSORS "=2
    "PATHEXT "=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
    "TEMP "=%SystemRoot%\TEMP
    "TMP "=%SystemRoot%\TEMP
    "CLASSPATH "=.;C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
    "QTJAVA "=C:\Program Files\Java\jre1.5.0_06\lib\ext\QTJava.zip
    "DEFAULT_CA_NR "=CA6

    -----------------EOF-----------------
     
    erika,
    #4
  6. 2009/01/04
    erika

    erika Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    56
    Likes Received:
    0
    my 1st log hasn't shown up yet...i'll wait a few minutes and post it again..sorry if it gets duplicated
     
    erika,
    #5
  7. 2009/01/04
    erika

    erika Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    56
    Likes Received:
    0
    Aaflac, i've been doing searches today and they all seem to be working now!!

    if u don't mind tho, can u still take a look and let me know if there's anything i should be worried about?
     
    erika,
    #6
  8. 2009/01/04
    Aaflac

    Aaflac Inactive

    Joined:
    2008/11/02
    Messages:
    294
    Likes Received:
    1
    erika,

    There are malware entries showing in your report.

    Por favor, haga lo siguiente:

    Temporarily disable real-time protection applications as they may interfere with running programs needed to eradicate infections. Check the list in How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs for any programs run.


    Then, download ComboFix
    Save to the Desktop <<< Important!!
    • Now, close all open windows
    • Double-click combofix.exe to run the program
    • Follow the prompts.
      (Don't click on the window while the program is running, it may cause your system to stall.)
    • CF may reboot the computer and resume running when it restarts.
    • When finished, a log, ComboFix.txt, is produced.

    If, after running ComboFix, you cannot get back on the Internet, do the following:

    Open Internet Explorer
    Using the top bar, go to Tools > Internet Options > Connections Tab > LAN Settings
    In LAN Settings, uncheck "use a proxy server" or reconfigure the Proxy server again if you set it previously.

    If you use Firefox, go to the Tools Menu > Options... > Advanced Tab > Network Tab > "Settings ", and, under Connection, uncheck the proxyserver.

    ~~~~
    Now, run Random's System Information Tool (RSIT) once again.

    ~~~~
    Please provide the contents of the ComboFix report, and the new RSIT: Log.txt in your reply.
     
    Aaflac,
    #7
  9. 2009/01/05
    erika

    erika Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    56
    Likes Received:
    0
    buenas tardes Aaflac, doing searches still works fine today but i still ran the combofix and here's the log:

    thanks again :D

    ***************************************************

    ComboFix 09-01-05.03 - User 2009-01-05 18:16:33.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.2.1033.18.446.102 [GMT -5:00]
    Running from: c:\documents and settings\User\Desktop\ComboFix.exe
    AV: McAfee VirusScan *On-access scanning disabled* (Outdated)
    FW: McAfee Personal Firewall *enabled*
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\tintinyproxyy\tinyproxy.exe
    c:\windows\f49f4daa.dat

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_APPLICATION_LAYER_GATEWAY_SERVICE_(ALG)_
    -------\Legacy_HELP_AND_SUPPORT_(HELPSVC)_
    -------\Legacy_WINDOWS_AUDIO_(AUDIOSRV)_
    -------\Service_Help and Support (helpsvc)


    ((((((((((((((((((((((((( Files Created from 2008-12-05 to 2009-01-05 )))))))))))))))))))))))))))))))
    .

    2009-01-04 10:48 . 2009-01-04 10:49 <DIR> d-------- C:\rsit
    2009-01-04 10:48 . 2009-01-04 10:49 <DIR> d-------- c:\program files\trend micro
    2009-01-03 00:52 . 2009-01-03 00:52 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
    2009-01-03 00:52 . 2009-01-03 00:52 <DIR> d-------- c:\documents and settings\User\Application Data\Malwarebytes
    2009-01-03 00:52 . 2009-01-03 00:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-01-03 00:52 . 2008-12-03 19:59 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
    2009-01-03 00:52 . 2008-12-03 19:59 15,504 --a------ c:\windows\system32\drivers\mbam.sys
    2009-01-02 23:25 . 2009-01-02 23:25 <DIR> d-------- c:\program files\Lavasoft
    2009-01-02 23:25 . 2009-01-02 23:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
    2009-01-02 23:22 . 2009-01-02 23:22 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
    2008-12-26 20:50 . 2008-12-26 20:50 54,156 --ah----- c:\windows\QTFont.qfn
    2008-12-26 20:50 . 2008-12-26 20:50 1,409 --a------ c:\windows\QTFont.for
    2008-12-26 20:18 . 2008-12-26 20:19 <DIR> d-------- c:\documents and settings\User\Application Data\Teleca
    2008-12-26 20:18 . 2008-12-26 20:18 <DIR> d-------- c:\documents and settings\User\Application Data\Sony Ericsson
    2008-12-26 20:16 . 2006-11-10 09:55 90,800 -ra------ c:\windows\system32\drivers\se2Funic.sys
    2008-12-26 20:16 . 2006-11-10 09:55 88,688 -ra------ c:\windows\system32\drivers\SE2Fmgmt.sys
    2008-12-26 20:16 . 2006-11-10 09:55 86,560 -ra------ c:\windows\system32\drivers\SE2Fobex.sys
    2008-12-26 20:16 . 2006-11-10 09:55 18,704 -ra------ c:\windows\system32\drivers\se2Fnd5.sys
    2008-12-26 20:16 . 2006-11-10 09:55 4,128 -ra------ c:\windows\system32\drivers\se2Fcr.sys
    2008-12-26 20:15 . 2006-11-10 09:55 97,184 -ra------ c:\windows\system32\drivers\SE2Fmdm.sys
    2008-12-26 20:15 . 2006-11-10 09:55 61,600 -ra------ c:\windows\system32\drivers\SE2Fbus.sys
    2008-12-26 20:15 . 2006-11-10 09:55 9,360 -ra------ c:\windows\system32\drivers\SE2Fmdfl.sys
    2008-12-26 20:15 . 2006-11-10 09:55 6,240 -ra------ c:\windows\system32\drivers\SE2Fcmnt.sys
    2008-12-26 20:15 . 2006-11-10 09:55 6,240 -ra------ c:\windows\system32\drivers\SE2Fcm.sys
    2008-12-26 20:15 . 2006-11-10 09:55 5,872 -ra------ c:\windows\system32\drivers\SE2Fwhnt.sys
    2008-12-26 20:15 . 2006-11-10 09:55 5,872 -ra------ c:\windows\system32\drivers\se2Fwh.sys
    2008-12-26 20:09 . 2008-12-26 20:09 <DIR> d-------- c:\program files\Sony Ericsson
    2008-12-26 20:09 . 2008-12-26 20:11 <DIR> d-------- c:\program files\Common Files\Teleca Shared
    2008-12-26 20:09 . 2008-12-26 20:10 <DIR> d-------- c:\documents and settings\All Users\Application Data\Teleca
    2008-12-26 20:09 . 2008-12-26 20:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\Sony Ericsson
    2008-12-26 20:07 . 2008-12-26 20:08 <DIR> d-------- c:\windows\Downloaded Installations
    2008-12-26 19:23 . 2009-01-05 18:17 <DIR> d-------- c:\program files\tintinyproxyy
    2008-12-19 18:52 . 2008-12-19 20:56 <DIR> d-------- c:\windows\system32\Adobe
    2008-12-19 15:00 . 2008-12-19 15:00 268 --ah----- C:\sqmdata02.sqm
    2008-12-19 15:00 . 2008-12-19 15:00 244 --ah----- C:\sqmnoopt02.sqm
    2008-12-19 14:55 . 2008-12-19 14:55 <DIR> d-------- c:\documents and settings\Guest
    2008-12-19 14:15 . 2008-12-19 14:15 268 --ah----- C:\sqmdata01.sqm
    2008-12-19 14:15 . 2008-12-19 14:15 244 --ah----- C:\sqmnoopt01.sqm
    2008-12-19 12:11 . 2008-12-19 12:11 268 --ah----- C:\sqmdata00.sqm
    2008-12-19 12:11 . 2008-12-19 12:11 244 --ah----- C:\sqmnoopt00.sqm
    2008-12-12 19:57 . 2008-12-12 19:57 1 ---h----- c:\windows\fm123.dat

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-01-05 22:46 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
    2009-01-04 15:39 --------- d-----w c:\program files\LimeWire
    2009-01-03 13:30 --------- d-----w c:\documents and settings\User\Application Data\LimeWire
    2008-12-27 03:42 --------- d-----w c:\documents and settings\User\Application Data\Apple Computer
    2008-12-27 01:07 --------- d-----w c:\program files\Common Files\InstallShield
    2008-12-19 15:40 --------- d-----w c:\program files\McAfee
    2008-12-05 13:54 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore
    2008-12-04 23:22 410,984 ----a-w c:\windows\system32\deploytk.dll
    2008-12-04 23:22 --------- d-----w c:\program files\Java
    2008-11-29 00:57 --------- d-----w c:\program files\Google
    2008-11-23 18:35 --------- d-----w c:\program files\iTunes
    2008-11-23 18:35 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
    2008-11-23 18:34 --------- d-----w c:\program files\iPod
    2008-11-23 18:34 --------- d-----w c:\program files\Common Files\Apple
    2008-11-23 18:34 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
    2008-11-23 18:33 --------- d-----w c:\program files\Bonjour
    2008-11-23 18:32 --------- d-----w c:\program files\QuickTime
    2008-11-23 18:30 --------- d-----w c:\program files\Apple Software Update
    2008-11-23 18:28 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
    2008-11-22 21:45 --------- d-----w c:\program files\PopCap Games
    2008-11-22 21:45 --------- d-----w c:\documents and settings\All Users\Application Data\PopCap Games
    2008-11-19 18:54 --------- d-----w c:\documents and settings\User\Application Data\Costco Photo Viewer CA-EN
    2008-11-19 18:32 --------- d-----w c:\documents and settings\User\Application Data\Costco Photo Organizer
    2008-11-19 18:31 --------- d-----w c:\program files\Costco
    2008-11-19 18:31 --------- d-----w c:\program files\Common Files\HP
    2008-11-18 04:25 784 ----a-w c:\documents and settings\User\Application Data\wklnhst.dat
    2008-11-14 18:59 80,960 ----a-w c:\documents and settings\User\Application Data\GDIPFONTCACHEV1.DAT
    2008-11-14 00:47 --------- d-----w c:\documents and settings\All Users\Application Data\PopCap
    2008-11-12 23:28 --------- d-----w c:\documents and settings\All Users\Application Data\SiteAdvisor
    2008-11-12 23:27 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee
    2008-11-12 02:27 --------- d-----w c:\program files\MSXML 4.0
    2008-11-12 02:27 --------- d-----w c:\program files\Microsoft Works
    2008-11-11 21:14 --------- d-----w c:\program files\Windows Live Toolbar
    2008-11-11 21:14 --------- d-----w c:\program files\Windows Live Favorites
    2008-11-11 21:14 --------- d-----w c:\documents and settings\All Users\Application Data\Windows Live Toolbar
    2008-11-11 21:12 --------- d-----w c:\program files\MSN Messenger
    2008-11-11 19:37 --------- d-----w c:\program files\McAfee.com
    2008-11-11 19:37 --------- d-----w c:\program files\Common Files\McAfee
    2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
    2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
    2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll
    2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
    2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll
    2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll
    2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll
    2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
    2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll
    2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll
    2008-10-16 19:06 268,648 ----a-w c:\windows\system32\mucltui.dll
    2008-10-16 19:06 208,744 ----a-w c:\windows\system32\muweb.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
    "MsnMsgr "= "c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
    "MSMSGS "= "c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "mcagent_exe "= "c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-03 582992]
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
    "SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2008-12-04 136600]
    "Sony Ericsson PC Suite "= "c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
    "RTHDCPL "= "RTHDCPL.EXE" [2006-04-17 c:\windows\RTHDCPL.exe]

    c:\documents and settings\User\Start Menu\Programs\Startup\
    LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2008-09-18 147456]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.ffds "= ffdshow.ax

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk
    backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2008-04-13 19:12 15360 c:\windows\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
    --a------ 2005-08-05 12:56 64512 c:\windows\ehome\ehtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
    --a------ 2006-03-15 07:00 208952 c:\windows\ime\imjp8_1\imjpmig.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
    --a------ 2006-03-15 07:00 59392 c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    --a------ 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
    --a------ 2006-03-15 07:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
    --a------ 2006-03-15 07:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2005-11-10 12:03 36975 c:\program files\Java\jre1.5.0_06\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
    --a------ 2005-05-03 17:43 69632 c:\windows\Alcmtr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify "=dword:00000001
    "UpdatesDisableNotify "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "c:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\MSN Messenger\\livecall.exe "=
    "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=
    "c:\\Program Files\\LimeWire\\LimeWire.exe "=
    "c:\\Program Files\\Messenger\\msmsgs.exe "=

    R4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-11-12 206096]
    S3 SE2Fbus;Sony Ericsson Device 047 Driver driver (WDM);c:\windows\system32\drivers\SE2Fbus.sys [2008-12-26 61600]
    S3 SE2Fmdfl;Sony Ericsson Device 047 USB WMC Modem Filter;c:\windows\system32\drivers\SE2Fmdfl.sys [2008-12-26 9360]
    S3 SE2Fmdm;Sony Ericsson Device 047 USB WMC Modem Driver;c:\windows\system32\drivers\SE2Fmdm.sys [2008-12-26 97184]
    S3 SE2Fmgmt;Sony Ericsson Device 047 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\SE2Fmgmt.sys [2008-12-26 88688]
    S3 se2Fnd5;Sony Ericsson Device 047 USB Ethernet Emulation SEMC47 (NDIS);c:\windows\system32\drivers\se2Fnd5.sys [2008-12-26 18704]
    S3 SE2Fobex;Sony Ericsson Device 047 USB WMC OBEX Interface;c:\windows\system32\drivers\SE2Fobex.sys [2008-12-26 86560]
    S3 se2Funic;Sony Ericsson Device 047 USB Ethernet Emulation SEMC47 (WDM);c:\windows\system32\drivers\se2Funic.sys [2008-12-26 90800]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-01-03 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

    2009-01-05 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
    - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2006-09-27 17:39]

    2008-11-11 c:\windows\Tasks\McDefragTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

    2008-11-11 c:\windows\Tasks\McQcTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.ca/
    uInternet Settings,ProxyOverride = *.local;<local>
    IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\l5beo6kl.default\
    FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
    FF - plugin: c:\program files\Google\Google Updater\2.4.1399.3742\npCIDetect13.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-01-05 18:22:13
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(548)
    c:\windows\system32\Ati2evxx.dll

    - - - - - - - > 'explorer.exe'(3520)
    c:\program files\McAfee\SiteAdvisor\saHook.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\ati2evxx.exe
    c:\program files\Lavasoft\Ad-Aware\aawservice.exe
    c:\windows\system32\ati2evxx.exe
    c:\program files\Common Files\Teleca Shared\CapabilityManager.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\ehome\ehrecvr.exe
    c:\windows\ehome\ehSched.exe
    c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Common Files\LightScribe\LSSrvc.exe
    c:\progra~1\McAfee\MSC\mcmscsvc.exe
    c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
    c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
    c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
    c:\program files\McAfee\MPF\MpfSrv.exe
    c:\program files\Common Files\Teleca Shared\Generic.exe
    c:\windows\ehome\mcrdsvc.exe
    c:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\windows\system32\dllhost.exe
    c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
    c:\progra~1\McAfee\MSC\mcuimgr.exe
    .
    **************************************************************************
    .
    Completion time: 2009-01-05 18:25:51 - machine was rebooted [User]
    ComboFix-quarantined-files.txt 2009-01-05 23:25:42

    Pre-Run: 236,635,078,656 bytes free
    Post-Run: 236,670,464,000 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Windows XP Media Center Edition" /noexecute=optin /fastdetect

    269 --- E O F --- 2008-12-19 00:50:56
     
    erika,
    #8
  10. 2009/01/05
    erika

    erika Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    56
    Likes Received:
    0
    and here's the rsit log:

    ***************************************************

    Logfile of random's system information tool 1.05 (written by random/random)
    Run by User at 2009-01-05 18:35:24
    Microsoft Windows XP Professional Service Pack 3
    System drive C: has 226 GB (95%) free of 238 GB
    Total RAM: 446 MB (8% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:35:37 PM, on 1/5/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\LimeWire\LimeWire.exe
    C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\Common Files\Teleca Shared\Generic.exe
    C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    c:\PROGRA~1\mcafee\msc\mcuimgr.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\User\Desktop\RSIT.exe
    C:\Program Files\trend micro\User.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
    O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155746453015
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

    --
    End of file - 8143 bytes

    ======Scheduled tasks folder======

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job
    C:\WINDOWS\tasks\McDefragTask.job
    C:\WINDOWS\tasks\McQcTask.job

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-04 320920]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
    scriptproxy - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll [2007-07-24 66880]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 322368]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
    Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll [2008-11-28 657904]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
    McAfee SiteAdvisor BHO - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll [2008-11-14 150032]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
    Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2006-09-27 544032]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
    Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-04 34816]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
    JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-04 73728]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2006-09-27 544032]
    {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll [2008-11-14 150032]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "RTHDCPL "=C:\WINDOWS\RTHDCPL.EXE [2006-04-17 16143872]
    "mcagent_exe "=C:\Program Files\McAfee.com\Agent\mcagent.exe [2007-08-03 582992]
    "QuickTime Task "=C:\Program Files\QuickTime\QTTask.exe [2008-11-04 413696]
    "iTunesHelper "=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]
    "SunJavaUpdateSched "=C:\Program Files\Java\jre6\bin\jusched.exe [2008-12-04 136600]
    "Sony Ericsson PC Suite "=C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2005-10-26 159744]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
    "MsnMsgr "=C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]
    "MSMSGS "=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
    C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
    C:\WINDOWS\ehome\ehtray.exe [2005-08-05 64512]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
    C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2006-03-15 208952]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
    C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2006-03-15 59392]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
    C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2006-03-15 455168]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
    C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2006-03-15 455168]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe [2005-11-10 36975]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2004-12-14 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
    C:\PROGRA~1\INTERV~1\Common\Bin\WINCIN~1.EXE [2002-08-04 98304]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    C:\PROGRA~1\MICROS~4\Office10\OSA.EXE [2001-02-13 83360]

    C:\Documents and Settings\User\Start Menu\Programs\Startup
    LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
    C:\WINDOWS\system32\Ati2evxx.dll [2006-06-16 86016]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    C:\WINDOWS\system32\WgaLogon.dll [2006-06-19 702768]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MpfService]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername "=0
    "legalnoticecaption "=
    "legalnoticetext "=
    "shutdownwithoutlogon "=1
    "undockwithoutlogon "=1
    "InstallVisualStyle "=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
    "InstallTheme "=C:\WINDOWS\Resources\Themes\Royale.theme

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveTypeAutoRun "=323
    "NoDriveAutoRun "=67108863
    "NoDrives "=0

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveAutoRun "=
    "NoDriveTypeAutoRun "=
    "NoDrives "=

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\MSN Messenger\msnmsgr.exe "= "C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 "
    "C:\Program Files\MSN Messenger\livecall.exe "= "C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) "
    "C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe "= "C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent "
    "C:\Program Files\Bonjour\mDNSResponder.exe "= "C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour "
    "C:\Program Files\iTunes\iTunes.exe "= "C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes "
    "C:\Program Files\LimeWire\LimeWire.exe "= "C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire "
    "C:\Program Files\Messenger\msmsgs.exe "= "C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger "

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\MSN Messenger\msnmsgr.exe "= "C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 "
    "C:\Program Files\MSN Messenger\livecall.exe "= "C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) "

    ======List of files/folders created in the last 1 months======

    2009-01-05 18:26:04 ----A---- C:\ComboFix.txt
    2009-01-05 18:16:11 ----A---- C:\Boot.bak
    2009-01-05 18:16:06 ----RASHD---- C:\cmdcons
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\zip.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\VFIND.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\SWXCACLS.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\SWSC.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\SWREG.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\sed.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\NIRCMD.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\grep.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\fdsv.exe
    2009-01-05 18:11:51 ----D---- C:\WINDOWS\ERDNT
    2009-01-05 18:11:51 ----D---- C:\Qoobox
    2009-01-04 10:48:49 ----D---- C:\Program Files\trend micro
    2009-01-04 10:48:48 ----D---- C:\rsit
    2009-01-03 00:52:42 ----D---- C:\Documents and Settings\User\Application Data\Malwarebytes
    2009-01-03 00:52:31 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2009-01-03 00:52:30 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2009-01-02 23:25:14 ----D---- C:\Program Files\Lavasoft
    2009-01-02 23:25:12 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2009-01-02 23:22:20 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
    2008-12-26 21:04:49 ----D---- C:\WINDOWS\system32\appmgmt
    2008-12-26 20:37:02 ----A---- C:\WINDOWS\ModemLog_Sony Ericsson Device 047 USB WMC Modem.txt
    2008-12-26 20:37:00 ----A---- C:\WINDOWS\ModemLog_Sony Ericsson Device 047 USB WMC Data Modem.txt
    2008-12-26 20:18:29 ----D---- C:\Documents and Settings\User\Application Data\Teleca
    2008-12-26 20:18:02 ----D---- C:\Documents and Settings\User\Application Data\Sony Ericsson
    2008-12-26 20:09:34 ----D---- C:\Documents and Settings\All Users\Application Data\Sony Ericsson
    2008-12-26 20:09:14 ----D---- C:\Program Files\Common Files\Teleca Shared
    2008-12-26 20:09:12 ----D---- C:\Program Files\Sony Ericsson
    2008-12-26 20:09:12 ----D---- C:\Documents and Settings\All Users\Application Data\Teleca
    2008-12-26 20:07:45 ----D---- C:\WINDOWS\Downloaded Installations
    2008-12-26 19:23:41 ----D---- C:\Program Files\tintinyproxyy
    2008-12-19 18:52:52 ----D---- C:\WINDOWS\system32\Adobe
    2008-12-11 22:37:11 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
    2008-12-11 22:36:11 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
    2008-12-11 22:35:30 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
    2008-12-11 22:35:17 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$

    ======List of files/folders modified in the last 1 months======

    2009-01-05 18:35:31 ----D---- C:\WINDOWS\Temp
    2009-01-05 18:35:29 ----D---- C:\WINDOWS\Prefetch
    2009-01-05 18:28:15 ----D---- C:\Program Files\Mozilla Firefox
    2009-01-05 18:26:35 ----D---- C:\WINDOWS\system32
    2009-01-05 18:26:34 ----D---- C:\WINDOWS\system32\drivers
    2009-01-05 18:26:06 ----D---- C:\WINDOWS
    2009-01-05 18:23:24 ----A---- C:\WINDOWS\system.ini
    2009-01-05 18:22:29 ----D---- C:\WINDOWS\Registration
    2009-01-05 18:18:28 ----D---- C:\WINDOWS\system32\config
    2009-01-05 18:17:25 ----D---- C:\WINDOWS\AppPatch
    2009-01-05 18:17:25 ----D---- C:\Program Files\Common Files
    2009-01-05 18:16:11 ----RASH---- C:\boot.ini
    2009-01-05 18:15:09 ----A---- C:\WINDOWS\SchedLgU.Txt
    2009-01-05 17:46:42 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater
    2009-01-04 10:48:49 ----RD---- C:\Program Files
    2009-01-04 10:39:35 ----D---- C:\Program Files\LimeWire
    2009-01-03 08:30:33 ----D---- C:\Documents and Settings\User\Application Data\LimeWire
    2009-01-03 00:34:19 ----D---- C:\WINDOWS\network diagnostic
    2009-01-02 23:26:14 ----SHD---- C:\WINDOWS\Installer
    2008-12-31 23:06:00 ----SD---- C:\Documents and Settings\User\Application Data\Microsoft
    2008-12-26 22:42:47 ----D---- C:\Documents and Settings\User\Application Data\Apple Computer
    2008-12-26 20:15:53 ----HD---- C:\WINDOWS\inf
    2008-12-26 20:15:29 ----D---- C:\WINDOWS\system32\ReinstallBackups
    2008-12-26 20:14:40 ----DC---- C:\WINDOWS\system32\DRVSTORE
    2008-12-26 20:14:30 ----D---- C:\WINDOWS\system32\CatRoot2
    2008-12-26 20:07:40 ----D---- C:\Program Files\Common Files\InstallShield
    2008-12-19 19:02:13 ----D---- C:\Documents and Settings\User\Application Data\Adobe
    2008-12-19 14:55:52 ----D---- C:\Documents and Settings
    2008-12-19 10:40:57 ----D---- C:\Program Files\McAfee
    2008-12-18 19:50:51 ----RSHDC---- C:\WINDOWS\system32\dllcache
    2008-12-18 19:50:31 ----HD---- C:\WINDOWS\$hf_mig$
    2008-12-13 01:40:02 ----A---- C:\WINDOWS\system32\mshtml.dll
    2008-12-12 20:06:52 ----A---- C:\WINDOWS\imsins.BAK
    2008-12-11 22:36:52 ----D---- C:\Program Files\Internet Explorer

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
    R1 mfehidk;McAfee Inc. mfehidk; C:\WINDOWS\system32\drivers\mfehidk.sys [2007-11-22 201320]
    R1 MPFP;MPFP; C:\WINDOWS\System32\Drivers\Mpfp.sys [2007-07-13 113952]
    R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-06-16 1611776]
    R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
    R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
    R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
    R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-04-17 4262912]
    R3 mfeavfk;McAfee Inc. mfeavfk; C:\WINDOWS\system32\drivers\mfeavfk.sys [2007-11-22 79304]
    R3 mfebopk;McAfee Inc. mfebopk; C:\WINDOWS\system32\drivers\mfebopk.sys [2007-11-22 35240]
    R3 mfesmfk;McAfee Inc. mfesmfk; C:\WINDOWS\system32\drivers\mfesmfk.sys [2007-12-02 40488]
    R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-15 12160]
    R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-01-18 80512]
    R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
    R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
    R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
    S3 mferkdk;McAfee Inc. mferkdk; C:\WINDOWS\system32\drivers\mferkdk.sys [2007-11-22 33832]
    S3 MHNDRV;MHN driver; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
    S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
    S3 s116bus;Sony Ericsson Device 116 driver (WDM); C:\WINDOWS\system32\DRIVERS\s116bus.sys [2007-04-03 83336]
    S3 SE2Fbus;Sony Ericsson Device 047 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\SE2Fbus.sys [2006-11-10 61600]
    S3 SE2Fmdfl;Sony Ericsson Device 047 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\SE2Fmdfl.sys [2006-11-10 9360]
    S3 SE2Fmdm;Sony Ericsson Device 047 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\SE2Fmdm.sys [2006-11-10 97184]
    S3 SE2Fmgmt;Sony Ericsson Device 047 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\SE2Fmgmt.sys [2006-11-10 88688]
    S3 se2Fnd5;Sony Ericsson Device 047 USB Ethernet Emulation SEMC47 (NDIS); C:\WINDOWS\system32\DRIVERS\se2Fnd5.sys [2006-11-10 18704]
    S3 SE2Fobex;Sony Ericsson Device 047 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\SE2Fobex.sys [2006-11-10 86560]
    S3 se2Funic;Sony Ericsson Device 047 USB Ethernet Emulation SEMC47 (WDM); C:\WINDOWS\system32\DRIVERS\se2Funic.sys [2006-11-10 90800]
    S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
    S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-09-10 611664]
    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
    R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-06-16 389120]
    R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
    R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2006-06-29 237568]
    R2 ehSched;Media Center Scheduler Service; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 102912]
    R2 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-28 168432]
    R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-04 152984]
    R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2005-09-22 53248]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [2008-12-05 206096]
    R2 mcmscsvc;McAfee Services; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [2008-01-09 767976]
    R2 McNASvc;McAfee Network Agent; c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe [2008-01-25 2458128]
    R2 McProxy;McAfee Proxy Service; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2007-08-15 359248]
    R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
    R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2007-07-24 144704]
    R2 MpfService;McAfee Personal Firewall Service; C:\Program Files\McAfee\MPF\MPFSrv.exe [2007-07-18 856864]
    R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
    R3 McSysmon;McAfee SystemGuards; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [2007-07-25 695624]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-04-13 33632]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-04-13 68952]
    S3 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2007-11-07 378184]
    S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
    S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-08-03 38912]
    S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
    S3 WMConnectCDS;Windows Media Connect Service; C:\Program Files\Windows Media Connect 2\wmccds.exe [2005-10-06 855552]

    -----------------EOF-----------------
     
    erika,
    #9
  11. 2009/01/06
    Aaflac

    Aaflac Inactive

    Joined:
    2008/11/02
    Messages:
    294
    Likes Received:
    1
    Need to get rid of some leftovers...

    Please open Notepad (Start > Run > in the Open field type: notepad)
    Click: OK

    Copy/paste all the text inside the code box below to Notepad:

    Code:
    File::
c:\windows\fm123.dat

Folder::
c:\program files\tintinyproxyy
c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
    Registry::
    [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]


    Save as CFScript.txt <<< Important!!
    Change the Save as type to: All Files
    Save it to the Desktop

    [​IMG]

    Referring to the screenshot above, drag CFScript.txt >>> into >>> ComboFix.exe
    ComboFix runs a scan, and may reboot when it finishes. This is normal.

    CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.

    When finished, a log is produced: ComboFix.txt

    ~~~~
    Please provide the contents of the new ComboFix log in your reply.




    Also, let’s see if Kaspersky picks up any infected files. There is no option to clean/disinfect, however, we can analyze the information on the report and determine whether further action is needed.


    Please close all windows, and temporarily turn off the real time scanner of your antivirus program.
    Then, use Internet Explorer, and do an online scan with Kaspersky WebScanner
    Click: Scan Now
    Then click: Accept
    The program launches and downloads the latest definition files.
    • Once the files are downloaded, click on: Next
    • Under select a target to scan, select: My Computer
    When the scan is done, any infection is displayed.
    • Click on: View scan report
    To obtain the report:
    Click on: Save Report As

    Next, in the Save as prompt, Save in area, select: Desktop

    In the File name area, use KScan, or something similar

    In Save as type, click the drop arrow and select: Text file [*.txt]
    Then, click: Save

    ~~~~
    Please provide the contents of the Kaspersky Online Scanner report in your reply.
     
    Aaflac,
    #10
  12. 2009/01/06
    erika

    erika Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    56
    Likes Received:
    0
    here's 1 + i'm off to do the other:D :

    *************************************

    ComboFix 09-01-05.05 - User 2009-01-06 15:46:21.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.2.1033.18.446.43 [GMT -5:00]
    Running from: c:\documents and settings\User\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\User\Desktop\CFScript.txt
    AV: McAfee VirusScan *On-access scanning disabled* (Outdated)
    FW: McAfee Personal Firewall *enabled*
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\tintinyproxyy

    .
    ((((((((((((((((((((((((( Files Created from 2008-12-06 to 2009-01-06 )))))))))))))))))))))))))))))))
    .

    2009-01-06 15:34 . 2009-01-06 15:34 389,120 --a------ c:\windows\system32\CF25551.exe
    2009-01-04 10:48 . 2009-01-04 10:49 <DIR> d-------- C:\rsit
    2009-01-04 10:48 . 2009-01-05 18:35 <DIR> d-------- c:\program files\trend micro
    2009-01-03 00:52 . 2009-01-03 00:52 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
    2009-01-03 00:52 . 2009-01-03 00:52 <DIR> d-------- c:\documents and settings\User\Application Data\Malwarebytes
    2009-01-03 00:52 . 2009-01-03 00:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-01-03 00:52 . 2008-12-03 19:59 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
    2009-01-03 00:52 . 2008-12-03 19:59 15,504 --a------ c:\windows\system32\drivers\mbam.sys
    2009-01-02 23:25 . 2009-01-02 23:25 <DIR> d-------- c:\program files\Lavasoft
    2009-01-02 23:25 . 2009-01-02 23:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
    2009-01-02 23:22 . 2009-01-02 23:22 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
    2008-12-26 20:50 . 2008-12-26 20:50 54,156 --ah----- c:\windows\QTFont.qfn
    2008-12-26 20:50 . 2008-12-26 20:50 1,409 --a------ c:\windows\QTFont.for
    2008-12-26 20:18 . 2008-12-26 20:19 <DIR> d-------- c:\documents and settings\User\Application Data\Teleca
    2008-12-26 20:18 . 2008-12-26 20:18 <DIR> d-------- c:\documents and settings\User\Application Data\Sony Ericsson
    2008-12-26 20:16 . 2006-11-10 09:55 90,800 -ra------ c:\windows\system32\drivers\se2Funic.sys
    2008-12-26 20:16 . 2006-11-10 09:55 88,688 -ra------ c:\windows\system32\drivers\SE2Fmgmt.sys
    2008-12-26 20:16 . 2006-11-10 09:55 86,560 -ra------ c:\windows\system32\drivers\SE2Fobex.sys
    2008-12-26 20:16 . 2006-11-10 09:55 18,704 -ra------ c:\windows\system32\drivers\se2Fnd5.sys
    2008-12-26 20:16 . 2006-11-10 09:55 4,128 -ra------ c:\windows\system32\drivers\se2Fcr.sys
    2008-12-26 20:15 . 2006-11-10 09:55 97,184 -ra------ c:\windows\system32\drivers\SE2Fmdm.sys
    2008-12-26 20:15 . 2006-11-10 09:55 61,600 -ra------ c:\windows\system32\drivers\SE2Fbus.sys
    2008-12-26 20:15 . 2006-11-10 09:55 9,360 -ra------ c:\windows\system32\drivers\SE2Fmdfl.sys
    2008-12-26 20:15 . 2006-11-10 09:55 6,240 -ra------ c:\windows\system32\drivers\SE2Fcmnt.sys
    2008-12-26 20:15 . 2006-11-10 09:55 6,240 -ra------ c:\windows\system32\drivers\SE2Fcm.sys
    2008-12-26 20:15 . 2006-11-10 09:55 5,872 -ra------ c:\windows\system32\drivers\SE2Fwhnt.sys
    2008-12-26 20:15 . 2006-11-10 09:55 5,872 -ra------ c:\windows\system32\drivers\se2Fwh.sys
    2008-12-26 20:09 . 2008-12-26 20:09 <DIR> d-------- c:\program files\Sony Ericsson
    2008-12-26 20:09 . 2008-12-26 20:11 <DIR> d-------- c:\program files\Common Files\Teleca Shared
    2008-12-26 20:09 . 2008-12-26 20:10 <DIR> d-------- c:\documents and settings\All Users\Application Data\Teleca
    2008-12-26 20:09 . 2008-12-26 20:11 <DIR> d-------- c:\documents and settings\All Users\Application Data\Sony Ericsson
    2008-12-26 20:07 . 2008-12-26 20:08 <DIR> d-------- c:\windows\Downloaded Installations
    2008-12-19 18:52 . 2008-12-19 20:56 <DIR> d-------- c:\windows\system32\Adobe
    2008-12-19 15:00 . 2008-12-19 15:00 268 --ah----- C:\sqmdata02.sqm
    2008-12-19 15:00 . 2008-12-19 15:00 244 --ah----- C:\sqmnoopt02.sqm
    2008-12-19 14:55 . 2008-12-19 14:55 <DIR> d-------- c:\documents and settings\Guest
    2008-12-19 14:15 . 2008-12-19 14:15 268 --ah----- C:\sqmdata01.sqm
    2008-12-19 14:15 . 2008-12-19 14:15 244 --ah----- C:\sqmnoopt01.sqm
    2008-12-19 12:11 . 2008-12-19 12:11 268 --ah----- C:\sqmdata00.sqm
    2008-12-19 12:11 . 2008-12-19 12:11 244 --ah----- C:\sqmnoopt00.sqm
    2008-12-12 19:57 . 2008-12-12 19:57 1 ---h----- c:\windows\fm123.dat

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-01-06 01:28 --------- d-----w c:\program files\LimeWire
    2009-01-06 01:21 --------- d-----w c:\documents and settings\User\Application Data\LimeWire
    2009-01-05 22:46 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
    2008-12-27 03:42 --------- d-----w c:\documents and settings\User\Application Data\Apple Computer
    2008-12-27 01:07 --------- d-----w c:\program files\Common Files\InstallShield
    2008-12-19 15:40 --------- d-----w c:\program files\McAfee
    2008-12-05 13:54 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore
    2008-12-04 23:22 410,984 ----a-w c:\windows\system32\deploytk.dll
    2008-12-04 23:22 --------- d-----w c:\program files\Java
    2008-11-29 00:57 --------- d-----w c:\program files\Google
    2008-11-23 18:35 --------- d-----w c:\program files\iTunes
    2008-11-23 18:35 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
    2008-11-23 18:34 --------- d-----w c:\program files\iPod
    2008-11-23 18:34 --------- d-----w c:\program files\Common Files\Apple
    2008-11-23 18:34 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
    2008-11-23 18:33 --------- d-----w c:\program files\Bonjour
    2008-11-23 18:32 --------- d-----w c:\program files\QuickTime
    2008-11-23 18:30 --------- d-----w c:\program files\Apple Software Update
    2008-11-23 18:28 --------- d-----w c:\documents and settings\All Users\Application Data\Apple
    2008-11-22 21:45 --------- d-----w c:\program files\PopCap Games
    2008-11-22 21:45 --------- d-----w c:\documents and settings\All Users\Application Data\PopCap Games
    2008-11-19 18:54 --------- d-----w c:\documents and settings\User\Application Data\Costco Photo Viewer CA-EN
    2008-11-19 18:32 --------- d-----w c:\documents and settings\User\Application Data\Costco Photo Organizer
    2008-11-19 18:31 --------- d-----w c:\program files\Costco
    2008-11-19 18:31 --------- d-----w c:\program files\Common Files\HP
    2008-11-18 04:25 784 ----a-w c:\documents and settings\User\Application Data\wklnhst.dat
    2008-11-14 18:59 80,960 ----a-w c:\documents and settings\User\Application Data\GDIPFONTCACHEV1.DAT
    2008-11-14 00:47 --------- d-----w c:\documents and settings\All Users\Application Data\PopCap
    2008-11-12 23:28 --------- d-----w c:\documents and settings\All Users\Application Data\SiteAdvisor
    2008-11-12 23:27 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee
    2008-11-12 02:27 --------- d-----w c:\program files\MSXML 4.0
    2008-11-12 02:27 --------- d-----w c:\program files\Microsoft Works
    2008-11-11 21:14 --------- d-----w c:\program files\Windows Live Toolbar
    2008-11-11 21:14 --------- d-----w c:\program files\Windows Live Favorites
    2008-11-11 21:14 --------- d-----w c:\documents and settings\All Users\Application Data\Windows Live Toolbar
    2008-11-11 21:12 --------- d-----w c:\program files\MSN Messenger
    2008-11-11 19:37 --------- d-----w c:\program files\McAfee.com
    2008-11-11 19:37 --------- d-----w c:\program files\Common Files\McAfee
    2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
    2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
    2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll
    2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
    2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll
    2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll
    2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll
    2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
    2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll
    2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll
    2008-10-16 19:06 268,648 ----a-w c:\windows\system32\mucltui.dll
    2008-10-16 19:06 208,744 ----a-w c:\windows\system32\muweb.dll
    .

    ((((((((((((((((((((((((((((( snapshot@2009-01-05_18.24.43.23 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2009-01-05 22:52:16 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
    + 2009-01-06 20:16:04 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
    - 2009-01-05 22:52:16 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2009-01-06 20:16:04 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
    "MsnMsgr "= "c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
    "MSMSGS "= "c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "mcagent_exe "= "c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-03 582992]
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
    "SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2008-12-04 136600]
    "Sony Ericsson PC Suite "= "c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
    "RTHDCPL "= "RTHDCPL.EXE" [2006-04-17 c:\windows\RTHDCPL.exe]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.ffds "= ffdshow.ax

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk *\0lsdelete

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\InterVideo WinCinema Manager.lnk
    backup=c:\windows\pss\InterVideo WinCinema Manager.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2008-04-13 19:12 15360 c:\windows\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
    --a------ 2005-08-05 12:56 64512 c:\windows\ehome\ehtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
    --a------ 2006-03-15 07:00 208952 c:\windows\ime\imjp8_1\imjpmig.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
    --a------ 2006-03-15 07:00 59392 c:\windows\system32\IME\PINTLGNT\IMSCINST.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    --a------ 2001-07-09 10:50 155648 c:\windows\system32\NeroCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
    --a------ 2006-03-15 07:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
    --a------ 2006-03-15 07:00 455168 c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2005-11-10 12:03 36975 c:\program files\Java\jre1.5.0_06\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
    --a------ 2005-05-03 17:43 69632 c:\windows\Alcmtr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify "=dword:00000001
    "UpdatesDisableNotify "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "c:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\MSN Messenger\\livecall.exe "=
    "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=
    "c:\\Program Files\\LimeWire\\LimeWire.exe "=
    "c:\\Program Files\\Messenger\\msmsgs.exe "=

    R4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-11-12 206096]
    S3 SE2Fbus;Sony Ericsson Device 047 Driver driver (WDM);c:\windows\system32\drivers\SE2Fbus.sys [2008-12-26 61600]
    S3 SE2Fmdfl;Sony Ericsson Device 047 USB WMC Modem Filter;c:\windows\system32\drivers\SE2Fmdfl.sys [2008-12-26 9360]
    S3 SE2Fmdm;Sony Ericsson Device 047 USB WMC Modem Driver;c:\windows\system32\drivers\SE2Fmdm.sys [2008-12-26 97184]
    S3 SE2Fmgmt;Sony Ericsson Device 047 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\SE2Fmgmt.sys [2008-12-26 88688]
    S3 se2Fnd5;Sony Ericsson Device 047 USB Ethernet Emulation SEMC47 (NDIS);c:\windows\system32\drivers\se2Fnd5.sys [2008-12-26 18704]
    S3 SE2Fobex;Sony Ericsson Device 047 USB WMC OBEX Interface;c:\windows\system32\drivers\SE2Fobex.sys [2008-12-26 86560]
    S3 se2Funic;Sony Ericsson Device 047 USB Ethernet Emulation SEMC47 (WDM);c:\windows\system32\drivers\se2Funic.sys [2008-12-26 90800]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-01-03 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

    2009-01-06 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
    - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2006-09-27 17:39]

    2008-11-11 c:\windows\Tasks\McDefragTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

    2008-11-11 c:\windows\Tasks\McQcTask.job
    - c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.ca/
    uInternet Settings,ProxyOverride = *.local;<local>
    IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
    IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\l5beo6kl.default\
    FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
    FF - plugin: c:\program files\Google\Google Updater\2.4.1399.3742\npCIDetect13.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\nppopcaploader.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-01-06 15:48:31
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(548)
    c:\windows\system32\Ati2evxx.dll
    .
    Completion time: 2009-01-06 15:50:22
    ComboFix-quarantined-files.txt 2009-01-06 20:50:18
    ComboFix2.txt 2009-01-05 23:26:04

    Pre-Run: 236,700,528,640 bytes free
    Post-Run: 236,687,974,400 bytes free

    232 --- E O F --- 2008-12-19 00:50:56
     
    erika,
    #11
  13. 2009/01/06
    erika

    erika Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    56
    Likes Received:
    0
    ...and here's the 2nd one....it seems like this all has to do with the limewire that my cousin installed

    i actually uninstalled it yesterday because by reading another post here and reading somethings online, i realized it wasn't a very secure thing



    --------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER 7 REPORT
    Tuesday, January 6, 2009
    Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Tuesday, January 06, 2009 20:18:46
    Records in database: 1572953
    --------------------------------------------------------------------------------

    Scan settings:
    Scan using the following database: extended
    Scan archives: yes
    Scan mail databases: yes

    Scan area - My Computer:
    C:\
    D:\

    Scan statistics:
    Files scanned: 48613
    Threat name: 2
    Infected objects: 3
    Suspicious objects: 0
    Duration of the scan: 01:49:55


    File name / Threat name / Threats count
    C:\Documents and Settings\User\My Documents\LimeWire\Incomplete\T-5745425-cassidy gunshot[unreleased rare track].mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1
    C:\Documents and Settings\User\My Documents\LimeWire\Saved\boyz is back cassidy feat.mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1
    C:\Qoobox\Quarantine\C\Program Files\tintinyproxyy\tinyproxy.exe.vir Infected: Trojan.Win32.Agent.azgv 1

    The selected area was scanned.
     
    erika,
    #12
  14. 2009/01/06
    Aaflac

    Aaflac Inactive

    Joined:
    2008/11/02
    Messages:
    294
    Likes Received:
    1
    Geeeshhh!!

    Tha CFScript text should have read like:

    Code:
    File::
c:\windows\fm123.dat

Folder::
c:\program files\tintinyproxyy
c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

Registry::
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
    However, it looks as if it is gone…

    On your request by PM, when it comes to recommending Peer-to-Peer software such as LimeWire, and whatever else is out there, I am not much help.

    File-sharing as a concept may be fine. However, engaging in this activity and having this kind of software installed on your machine will always make you susceptible to malware infections, and may be contributing to your current situation.

    Even if you use what is called a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. In fact, the bad guys use P2P file-sharing as a major conduit to spread their malware.



    Let's press on...

    Please download OTMoveIt3 to the Desktop.

    Double-click on OTMoveIt3.exe to run it.

    Copy and paste all of the following inside the code box below into the Paste List Of File/Folders To Move area of OTMoveIt3

    Code:
    :files 
C:\sqmdata02.sqm
C:\sqmnoopt02.sqm
C:\sqmdata01.sqm
C:\sqmnoopt01.sqm
C:\sqmdata00.sqm
C:\sqmnoopt00.sqm
c:\windows\fm123.dat
C:\Documents and Settings\User\My Documents\LimeWire\Incomplete\T-5745425-cassidy gunshot[unreleased rare track].mp3 
C:\Documents and Settings\User\My Documents\LimeWire\Saved\boyz is back cassidy feat.mp3 
:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
:commands 
[emptytemp]
    Click the red Moveit! button

    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the moving process. If you are asked to reboot the machine choose Yes.

    Copy/Paste the contents under Results in your reply.

    If the machine rebooted, and you are unable to copy/paste from the Results window, do the following:
    Open Notepad (Start > All Programs > Accessories > Notepad)
    Click: File > Open
    In the File Name box enter *.log and press the Enter key
    Navigate to the C:\_OTMoveIt\MovedFiles folder
    Open the newest .log file present

    Otherwise, Copy/Paste the contents under Results

    Close OTMoveIt3

    ~~~~
    Run RSIT once again.


    Please provide the OTMoveIt3 log contents, and the new RSIT log.txt in your reply.
     
    Aaflac,
    #13
  15. 2009/01/07
    erika

    erika Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    56
    Likes Received:
    0
    ========== FILES ==========
    C:\sqmdata02.sqm moved successfully.
    C:\sqmnoopt02.sqm moved successfully.
    C:\sqmdata01.sqm moved successfully.
    C:\sqmnoopt01.sqm moved successfully.
    C:\sqmdata00.sqm moved successfully.
    C:\sqmnoopt00.sqm moved successfully.
    c:\windows\fm123.dat moved successfully.
    C:\Documents and Settings\User\My Documents\LimeWire\Incomplete\T-5745425-cassidy gunshot[unreleased rare track].mp3 moved successfully.
    C:\Documents and Settings\User\My Documents\LimeWire\Saved\boyz is back cassidy feat.mp3 moved successfully.
    ========== REGISTRY ==========
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Brows er Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}\\ not found.
    ========== COMMANDS ==========
    File delete failed. C:\DOCUME~1\User\LOCALS~1\Temp\hsperfdata_User\1240 scheduled to be deleted on reboot.
    File delete failed. C:\DOCUME~1\User\LOCALS~1\Temp\etilqs_6Xg2P4T5GqjDL4Ajrwsv scheduled to be deleted on reboot.
    User's Temp folder emptied.
    User's Temporary Internet Files folder emptied.
    User's Internet Explorer cache folder emptied.
    Local Service Temp folder emptied.
    File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
    Local Service Temporary Internet Files folder emptied.
    File delete failed. C:\WINDOWS\temp\mcafee_3EhQkI4R2cfwDIq scheduled to be deleted on reboot.
    File delete failed. C:\WINDOWS\temp\mcafee_dPQuO9LhHjYZGhq scheduled to be deleted on reboot.
    File delete failed. C:\WINDOWS\temp\mcmsc_141uMpIHkrNVQ9U scheduled to be deleted on reboot.
    File delete failed. C:\WINDOWS\temp\mcmsc_iQdxj1AVFvaLtsg scheduled to be deleted on reboot.
    File delete failed. C:\WINDOWS\temp\mcmsc_Lh2YJ37GjcYSxVa scheduled to be deleted on reboot.
    File delete failed. C:\WINDOWS\temp\mcmsc_m3VOowBLtZt5VS8 scheduled to be deleted on reboot.
    File delete failed. C:\WINDOWS\temp\mcmsc_rmteS18GU6De4jh scheduled to be deleted on reboot.
    File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_118.dat scheduled to be deleted on reboot.
    File delete failed. C:\WINDOWS\temp\sqlite_dHtY3hgBwC3CAhV scheduled to be deleted on reboot.
    File delete failed. C:\WINDOWS\temp\sqlite_exOBH9Nhz9r9w2O scheduled to be deleted on reboot.
    File delete failed. C:\WINDOWS\temp\sqlite_ojOFUuz1BbcyhO9 scheduled to be deleted on reboot.
    File delete failed. C:\WINDOWS\temp\WFV1.tmp scheduled to be deleted on reboot.
    Windows Temp folder emptied.
    Java cache emptied.
    File delete failed. C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\l5beo6kl.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
    File delete failed. C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\l5beo6kl.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
    File delete failed. C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\l5beo6kl.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
    File delete failed. C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\l5beo6kl.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
    File delete failed. C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\l5beo6kl.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
    File delete failed. C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\l5beo6kl.default\XUL.mfl scheduled to be deleted on reboot.
    FireFox cache emptied.
    Temp folders emptied.

    OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01072009_160713

    Files moved on Reboot...
    File C:\DOCUME~1\User\LOCALS~1\Temp\hsperfdata_User\1240 not found!
    File C:\DOCUME~1\User\LOCALS~1\Temp\etilqs_6Xg2P4T5GqjDL4Ajrwsv not found!
    File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
    File C:\WINDOWS\temp\mcafee_3EhQkI4R2cfwDIq not found!
    File C:\WINDOWS\temp\mcafee_dPQuO9LhHjYZGhq not found!
    File C:\WINDOWS\temp\mcmsc_141uMpIHkrNVQ9U not found!
    File C:\WINDOWS\temp\mcmsc_iQdxj1AVFvaLtsg not found!
    File C:\WINDOWS\temp\mcmsc_Lh2YJ37GjcYSxVa not found!
    File C:\WINDOWS\temp\mcmsc_m3VOowBLtZt5VS8 not found!
    C:\WINDOWS\temp\mcmsc_rmteS18GU6De4jh moved successfully.
    File C:\WINDOWS\temp\Perflib_Perfdata_118.dat not found!
    C:\WINDOWS\temp\sqlite_dHtY3hgBwC3CAhV moved successfully.
    C:\WINDOWS\temp\sqlite_exOBH9Nhz9r9w2O moved successfully.
    C:\WINDOWS\temp\sqlite_ojOFUuz1BbcyhO9 moved successfully.
    File move failed. C:\WINDOWS\temp\WFV1.tmp scheduled to be moved on reboot.
    C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\l5beo6kl.default\Cache\_CACHE_001_ moved successfully.
    C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\l5beo6kl.default\Cache\_CACHE_002_ moved successfully.
    C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\l5beo6kl.default\Cache\_CACHE_003_ moved successfully.
    C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\l5beo6kl.default\Cache\_CACHE_MAP_ moved successfully.
    C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\l5beo6kl.default\urlclassifier3.sqlite moved successfully.
    C:\Documents and Settings\User\Local Settings\Application Data\Mozilla\Firefox\Profiles\l5beo6kl.default\XUL.mfl moved successfully.
     
    erika,
    #14
  16. 2009/01/07
    erika

    erika Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    56
    Likes Received:
    0
    Logfile of random's system information tool 1.05 (written by random/random)
    Run by User at 2009-01-07 16:19:20
    Microsoft Windows XP Professional Service Pack 3
    System drive C: has 226 GB (95%) free of 238 GB
    Total RAM: 446 MB (14% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:19:30 PM, on 1/7/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    c:\PROGRA~1\mcafee.com\agent\mcagent.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Common Files\Teleca Shared\Generic.exe
    C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    c:\PROGRA~1\mcafee\msc\mcuimgr.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\User\Desktop\RSIT.exe
    C:\Program Files\trend micro\User.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
    O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155746453015
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

    --
    End of file - 7985 bytes

    ======Scheduled tasks folder======

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job
    C:\WINDOWS\tasks\McDefragTask.job
    C:\WINDOWS\tasks\McQcTask.job

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-04 320920]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7DB2D5A0-7241-4E79-B68D-6309F01C5231}]
    scriptproxy - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll [2007-07-24 66880]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
    Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 322368]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
    Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll [2008-11-28 657904]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
    McAfee SiteAdvisor BHO - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll [2008-11-14 150032]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
    Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2006-09-27 544032]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
    Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-04 34816]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
    JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-04 73728]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2006-09-27 544032]
    {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - McAfee SiteAdvisor Toolbar - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll [2008-11-14 150032]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "RTHDCPL "=C:\WINDOWS\RTHDCPL.EXE [2006-04-17 16143872]
    "mcagent_exe "=C:\Program Files\McAfee.com\Agent\mcagent.exe [2007-08-03 582992]
    "QuickTime Task "=C:\Program Files\QuickTime\QTTask.exe [2008-11-04 413696]
    "iTunesHelper "=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]
    "SunJavaUpdateSched "=C:\Program Files\Java\jre6\bin\jusched.exe [2008-12-04 136600]
    "Sony Ericsson PC Suite "=C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2005-10-26 159744]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
    "MsnMsgr "=C:\Program Files\MSN Messenger\MsnMsgr.Exe [2007-01-19 5674352]
    "MSMSGS "=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
    C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
    C:\WINDOWS\ehome\ehtray.exe [2005-08-05 64512]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
    C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2006-03-15 208952]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
    C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2006-03-15 59392]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
    C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2006-03-15 455168]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
    C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2006-03-15 455168]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe [2005-11-10 36975]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2004-12-14 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^InterVideo WinCinema Manager.lnk]
    C:\PROGRA~1\INTERV~1\Common\Bin\WINCIN~1.EXE [2002-08-04 98304]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    C:\PROGRA~1\MICROS~4\Office10\OSA.EXE [2001-02-13 83360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
    C:\WINDOWS\system32\Ati2evxx.dll [2006-06-16 86016]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    C:\WINDOWS\system32\WgaLogon.dll [2006-06-19 702768]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\mcmscsvc]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MCODS]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\MpfService]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername "=0
    "legalnoticecaption "=
    "legalnoticetext "=
    "shutdownwithoutlogon "=1
    "undockwithoutlogon "=1
    "InstallVisualStyle "=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
    "InstallTheme "=C:\WINDOWS\Resources\Themes\Royale.theme

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveTypeAutoRun "=323
    "NoDriveAutoRun "=67108863
    "NoDrives "=0

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveAutoRun "=
    "NoDriveTypeAutoRun "=
    "NoDrives "=

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\MSN Messenger\msnmsgr.exe "= "C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 "
    "C:\Program Files\MSN Messenger\livecall.exe "= "C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) "
    "C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe "= "C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent "
    "C:\Program Files\Bonjour\mDNSResponder.exe "= "C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour "
    "C:\Program Files\iTunes\iTunes.exe "= "C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes "
    "C:\Program Files\LimeWire\LimeWire.exe "= "C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire "
    "C:\Program Files\Messenger\msmsgs.exe "= "C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger "
    "C:\Program Files\Java\jre6\bin\java.exe "= "C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary "

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\MSN Messenger\msnmsgr.exe "= "C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1 "
    "C:\Program Files\MSN Messenger\livecall.exe "= "C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone) "

    ======List of files/folders created in the last 1 months======

    2009-01-07 16:07:34 ----SHD---- C:\RECYCLER
    2009-01-07 16:07:13 ----D---- C:\_OTMoveIt
    2009-01-06 15:50:25 ----A---- C:\ComboFix.txt
    2009-01-06 15:34:18 ----A---- C:\WINDOWS\system32\CF25551.exe
    2009-01-05 18:16:11 ----A---- C:\Boot.bak
    2009-01-05 18:16:06 ----RASHD---- C:\cmdcons
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\zip.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\VFIND.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\SWXCACLS.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\SWSC.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\SWREG.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\sed.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\NIRCMD.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\grep.exe
    2009-01-05 18:14:35 ----A---- C:\WINDOWS\fdsv.exe
    2009-01-05 18:11:51 ----D---- C:\WINDOWS\ERDNT
    2009-01-05 18:11:51 ----D---- C:\Qoobox
    2009-01-04 10:48:49 ----D---- C:\Program Files\trend micro
    2009-01-04 10:48:48 ----D---- C:\rsit
    2009-01-03 00:52:42 ----D---- C:\Documents and Settings\User\Application Data\Malwarebytes
    2009-01-03 00:52:31 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2009-01-03 00:52:30 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2009-01-02 23:25:14 ----D---- C:\Program Files\Lavasoft
    2009-01-02 23:25:12 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2009-01-02 23:22:20 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
    2008-12-26 21:04:49 ----D---- C:\WINDOWS\system32\appmgmt
    2008-12-26 20:37:02 ----A---- C:\WINDOWS\ModemLog_Sony Ericsson Device 047 USB WMC Modem.txt
    2008-12-26 20:37:00 ----A---- C:\WINDOWS\ModemLog_Sony Ericsson Device 047 USB WMC Data Modem.txt
    2008-12-26 20:18:29 ----D---- C:\Documents and Settings\User\Application Data\Teleca
    2008-12-26 20:18:02 ----D---- C:\Documents and Settings\User\Application Data\Sony Ericsson
    2008-12-26 20:09:34 ----D---- C:\Documents and Settings\All Users\Application Data\Sony Ericsson
    2008-12-26 20:09:14 ----D---- C:\Program Files\Common Files\Teleca Shared
    2008-12-26 20:09:12 ----D---- C:\Program Files\Sony Ericsson
    2008-12-26 20:09:12 ----D---- C:\Documents and Settings\All Users\Application Data\Teleca
    2008-12-26 20:07:45 ----D---- C:\WINDOWS\Downloaded Installations
    2008-12-19 18:52:52 ----D---- C:\WINDOWS\system32\Adobe
    2008-12-11 22:37:11 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
    2008-12-11 22:36:11 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
    2008-12-11 22:35:30 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
    2008-12-11 22:35:17 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$

    ======List of files/folders modified in the last 1 months======

    2009-01-07 16:19:25 ----D---- C:\WINDOWS\Temp
    2009-01-07 16:15:13 ----D---- C:\Program Files\Mozilla Firefox
    2009-01-07 16:13:05 ----D---- C:\WINDOWS\Prefetch
    2009-01-07 16:11:42 ----D---- C:\WINDOWS\Registration
    2009-01-07 16:11:05 ----D---- C:\WINDOWS
    2009-01-07 16:10:02 ----A---- C:\WINDOWS\SchedLgU.Txt
    2009-01-06 18:46:48 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater
    2009-01-06 15:50:57 ----D---- C:\WINDOWS\system32
    2009-01-06 15:48:44 ----A---- C:\WINDOWS\system.ini
    2009-01-06 15:47:43 ----D---- C:\WINDOWS\system32\drivers
    2009-01-06 15:47:43 ----D---- C:\WINDOWS\AppPatch
    2009-01-06 15:47:43 ----D---- C:\Program Files\Common Files
    2009-01-06 15:46:38 ----RD---- C:\Program Files
    2009-01-05 20:28:30 ----D---- C:\Program Files\LimeWire
    2009-01-05 20:21:12 ----D---- C:\Documents and Settings\User\Application Data\LimeWire
    2009-01-05 18:18:28 ----D---- C:\WINDOWS\system32\config
    2009-01-05 18:16:11 ----RASH---- C:\boot.ini
    2009-01-03 00:34:19 ----D---- C:\WINDOWS\network diagnostic
    2009-01-02 23:26:14 ----SHD---- C:\WINDOWS\Installer
    2008-12-31 23:06:00 ----SD---- C:\Documents and Settings\User\Application Data\Microsoft
    2008-12-26 22:42:47 ----D---- C:\Documents and Settings\User\Application Data\Apple Computer
    2008-12-26 20:15:53 ----HD---- C:\WINDOWS\inf
    2008-12-26 20:15:29 ----D---- C:\WINDOWS\system32\ReinstallBackups
    2008-12-26 20:14:40 ----DC---- C:\WINDOWS\system32\DRVSTORE
    2008-12-26 20:14:30 ----D---- C:\WINDOWS\system32\CatRoot2
    2008-12-26 20:07:40 ----D---- C:\Program Files\Common Files\InstallShield
    2008-12-19 19:02:13 ----D---- C:\Documents and Settings\User\Application Data\Adobe
    2008-12-19 14:55:52 ----D---- C:\Documents and Settings
    2008-12-19 10:40:57 ----D---- C:\Program Files\McAfee
    2008-12-18 19:50:51 ----RSHDC---- C:\WINDOWS\system32\dllcache
    2008-12-18 19:50:31 ----HD---- C:\WINDOWS\$hf_mig$
    2008-12-13 01:40:02 ----A---- C:\WINDOWS\system32\mshtml.dll
    2008-12-12 20:06:52 ----A---- C:\WINDOWS\imsins.BAK
    2008-12-11 22:36:52 ----D---- C:\Program Files\Internet Explorer

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
    R1 mfehidk;McAfee Inc. mfehidk; C:\WINDOWS\system32\drivers\mfehidk.sys [2007-11-22 201320]
    R1 MPFP;MPFP; C:\WINDOWS\System32\Drivers\Mpfp.sys [2007-07-13 113952]
    R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2006-06-16 1611776]
    R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2008-04-17 15464]
    R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
    R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
    R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-04-17 4262912]
    R3 mfeavfk;McAfee Inc. mfeavfk; C:\WINDOWS\system32\drivers\mfeavfk.sys [2007-11-22 79304]
    R3 mfebopk;McAfee Inc. mfebopk; C:\WINDOWS\system32\drivers\mfebopk.sys [2007-11-22 35240]
    R3 mfesmfk;McAfee Inc. mfesmfk; C:\WINDOWS\system32\drivers\mfesmfk.sys [2007-12-02 40488]
    R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-15 12160]
    R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-01-18 80512]
    R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
    R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
    R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
    S3 mferkdk;McAfee Inc. mferkdk; C:\WINDOWS\system32\drivers\mferkdk.sys [2007-11-22 33832]
    S3 MHNDRV;MHN driver; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
    S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
    S3 s116bus;Sony Ericsson Device 116 driver (WDM); C:\WINDOWS\system32\DRIVERS\s116bus.sys [2007-04-03 83336]
    S3 SE2Fbus;Sony Ericsson Device 047 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\SE2Fbus.sys [2006-11-10 61600]
    S3 SE2Fmdfl;Sony Ericsson Device 047 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\SE2Fmdfl.sys [2006-11-10 9360]
    S3 SE2Fmdm;Sony Ericsson Device 047 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\SE2Fmdm.sys [2006-11-10 97184]
    S3 SE2Fmgmt;Sony Ericsson Device 047 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\SE2Fmgmt.sys [2006-11-10 88688]
    S3 se2Fnd5;Sony Ericsson Device 047 USB Ethernet Emulation SEMC47 (NDIS); C:\WINDOWS\system32\DRIVERS\se2Fnd5.sys [2006-11-10 18704]
    S3 SE2Fobex;Sony Ericsson Device 047 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\SE2Fobex.sys [2006-11-10 86560]
    S3 se2Funic;Sony Ericsson Device 047 USB Ethernet Emulation SEMC47 (WDM); C:\WINDOWS\system32\DRIVERS\se2Funic.sys [2006-11-10 90800]
    S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
    S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-09-10 611664]
    R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
    R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2006-06-16 389120]
    R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
    R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2006-06-29 237568]
    R2 ehSched;Media Center Scheduler Service; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 102912]
    R2 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-28 168432]
    R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-04 152984]
    R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2005-09-22 53248]
    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service; C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [2008-12-05 206096]
    R2 mcmscsvc;McAfee Services; C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe [2008-01-09 767976]
    R2 McNASvc;McAfee Network Agent; c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe [2008-01-25 2458128]
    R2 McProxy;McAfee Proxy Service; c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe [2007-08-15 359248]
    R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
    R2 McShield;McAfee Real-time Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe [2007-07-24 144704]
    R2 MpfService;McAfee Personal Firewall Service; C:\Program Files\McAfee\MPF\MPFSrv.exe [2007-07-18 856864]
    R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
    R3 McSysmon;McAfee SystemGuards; C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe [2007-07-25 695624]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-04-13 33632]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-04-13 68952]
    S3 McODS;McAfee Scanner; C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe [2007-11-07 378184]
    S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
    S3 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-08-03 38912]
    S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
    S3 WMConnectCDS;Windows Media Connect Service; C:\Program Files\Windows Media Connect 2\wmccds.exe [2005-10-06 855552]

    -----------------EOF-----------------
     
    erika,
    #15
  17. 2009/01/07
    Aaflac

    Aaflac Inactive

    Joined:
    2008/11/02
    Messages:
    294
    Likes Received:
    1
    Please run HijackThis, Scan
    Check box for:

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

    Select: Fix checked



    How is it going? Are you still having malware problems?

    Edit: duplicate entry!
     
    Last edited: 2009/01/09
    Aaflac,
    #16
  18. 2009/01/08
    erika

    erika Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    56
    Likes Received:
    0
    hey!!

    everything seems to be working fine when i do searches so the biggest thank u from the bottom of my heart!! (i know i sound corny :D)

    but i can't click on the hijack link in your last post to scan and i re-read our previous posts and i don't see where i've downloaded it b4

    help
     
    erika,
    #17
  19. 2009/01/08
    Aaflac

    Aaflac Inactive

    Joined:
    2008/11/02
    Messages:
    294
    Likes Received:
    1
    Oooopsss....that bold blue HijackThis title is not a link, and you are correct, you have not downloaded it before. The log.txt of RSIT includes a reading of HijackThis, but I do not believe you can run HJT from RSIT.

    Let's go this route...

    Please launch Notepad, (Start > Run, type in: notepad)
    Copy/paste all the text inside the code box below to Notepad:

    Code:
    REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
 "ProxyEnable" = 0
 "ProxyOverride "=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]
    In Notepad, go to File (upper menu bar), and select: Save as
    In the Save as prompt:
    Save in: Desktop
    File Name: fix.reg
    Save as Type: All files
    Click: Save
    Exit out of Notepad.

    Back on the Desktop, double-click on the fix.reg file
    Then, click on Yes when asked to merge the information into the Registry.


    How is it going now? Is the system still OK?
     
    Aaflac,
    #18
  20. 2009/01/08
    erika

    erika Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    56
    Likes Received:
    0
    thank u and yes the system is doing quite well

    so i've done your last steps, what do i do now? am i supposed to now re-run rsit?
     
    erika,
    #19
  21. 2009/01/08
    erika

    erika Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    56
    Likes Received:
    0
    or am i good now?
     
    erika,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...