1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved iexplore.exe always running/random popups

Discussion in 'Malware and Virus Removal Archive' started by Kajenx, 2008/12/16.

  1. 2008/12/16
    Kajenx

    Kajenx Inactive Thread Starter

    Joined:
    2008/12/16
    Messages:
    6
    Likes Received:
    0
    [Resolved] iexplore.exe always running/random popups

    I've been having some problems with an adware that keeps iexplore.exe running all the time (even if I kill it in the task manager). Sometimes it'll spike up to 100,000k memory usage and I can hear clicking. I've ran a few different spyware removers and it's still there. I've experienced a general slowdown while I've had this thing, so I'm wondering if it may have dowload other problems, so please let me know of anything you guys can find!

    Thanks so much!!

    Here's the RSIT thing
    _____________________________________

    Logfile of random's system information tool 1.04 (written by random/random)
    Run by Owner at 2008-12-16 17:10:58
    Microsoft Windows XP Professional Service Pack 3
    System drive C: has 46 GB (48%) free of 95 GB
    Total RAM: 1015 MB (20% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:11:06 PM, on 12/16/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\KeyboardSurrogate.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\Program Files\TOSHIBA\TOSHIBA RAID\Service\kraidsvc.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\Symantec AntiVirus\SavRoam.exe
    c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\system32\Tablet.exe
    C:\WINDOWS\system32\ThpSrv.exe
    C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe
    C:\WINDOWS\system32\TODDSrv.exe
    C:\Program Files\TOSHIBA\TOSHIBA RAID\Service\krdevctl.exe
    C:\WINDOWS\SYSTEM32\WISPTIS.EXE
    C:\WINDOWS\System32\tabbtnu.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\TCServer.exe
    C:\Program Files\Common Files\Microsoft Shared\Ink\TabTip.exe
    C:\WINDOWS\system32\00THotkey.exe
    C:\Program Files\Toshiba\CrossMenu\CrossMenu.exe
    C:\Program Files\Apoint2K\Apoint.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\ltmoh\Ltmoh.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
    C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
    C:\WINDOWS\system32\thpsrv.exe
    C:\WINDOWS\system32\TFNF5.exe
    C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE
    C:\Program Files\TOSHIBA\TME3\TMETEMNU.EXE
    C:\WINDOWS\system32\TPSODDCtl.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Program Files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe
    C:\Program Files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe
    C:\WINDOWS\system32\TPSBattM.exe
    C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
    C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
    C:\Program Files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe
    C:\Program Files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\system32\TDxVGAUTIL.EXE
    C:\WINDOWS\system32\RunDll32.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Protector Suite QL\psqltray.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Pidgin\pidgin.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\WINDOWS\system32\WTablet\TabUserW.exe
    C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\WINDOWS\system32\RE5KQ2My.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Owner\Desktop\RSIT.exe
    C:\Program Files\Trend Micro\HijackThis\Owner.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O1 - Hosts: 70.85.74.178 d3vp0rt41.mofunzone.com
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
    O4 - HKLM\..\Run: [TabletWizard] C:\WINDOWS\help\SplshWrp.exe
    O4 - HKLM\..\Run: [TabletTip] "C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe" /resume
    O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe
    O4 - HKLM\..\Run: [CrossMenu] C:\Program Files\Toshiba\CrossMenu\CrossMenu.exe
    O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
    O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
    O4 - HKLM\..\Run: [ThpSrv] thpsrv /logon
    O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
    O4 - HKLM\..\Run: [TMESRV.EXE] C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE /Logon
    O4 - HKLM\..\Run: [TMERzCtl.EXE] C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE /Service
    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
    O4 - HKLM\..\Run: [TPSODDCtl] TPSODDCtl.exe
    O4 - HKLM\..\Run: [Kraidman] C:\Program Files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe
    O4 - HKLM\..\Run: [TRot.exe] c:\Program Files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe
    O4 - HKLM\..\Run: [PINGER] C:\TOSHIBA\IVP\ISM\pinger.exe /run
    O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe "
    O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
    O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
    O4 - HKLM\..\Run: [TAudEffect] C:\Program Files\TOSHIBA\TAudEffect\TAudEff.exe /run
    O4 - HKLM\..\Run: [TAcelMgr] C:\Program Files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe
    O4 - HKLM\..\Run: [TSkrMain] C:\Program Files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [TDxVGAUTIL] C:\WINDOWS\system32\TDxVGAUTIL.EXE
    O4 - HKLM\..\Run: [CmUsbSound] RunDll32 cmcnfgu.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe "
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe "
    O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-19\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [TabletWizard] %windir%\help\wizard.hta (User 'NETWORK SERVICE')
    O4 - Global Startup: Pidgin.lnk = C:\Program Files\Pidgin\pidgin.exe
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe
    O8 - Extra context menu item: &Save Flash In This Page by Flash Saver - C:\PROGRA~1\FLASHS~1\save.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Google AdSense Preview Tool - http://pagead2.googlesyndication.com/pagead/preview/en/preview.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - C:\PROGRA~1\FLASHS~1\save.htm
    O9 - Extra 'Tools' menuitem: Flash Saver - {09EA1F80-F40A-11D1-B792-444553540001} - C:\PROGRA~1\FLASHS~1\save.htm
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - http://www.addonchat.com/404.html
    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1173092865203
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O20 - Winlogon Notify: TSigNP - C:\WINDOWS\SYSTEM32\TSigNP.dll
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: TOSHIBA RAID Service (kraidsvc) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA RAID\Service\kraidsvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
    O23 - Service: TOSHIBA HDD Protection (Thpsrv) - TOSHIBA Corporation - C:\WINDOWS\system32\ThpSrv.exe
    O23 - Service: Tmesrv3 (Tmesrv) - TOSHIBA - C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe
    O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe
    O24 - Desktop Component 0: Ink Desktop - {80E95280-2D38-3CB8-A215-FB5F14C4343E}

    --
    End of file - 14765 bytes

    ======Scheduled tasks folder======

    C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    C:\WINDOWS\tasks\At1.job
    C:\WINDOWS\tasks\At10.job
    C:\WINDOWS\tasks\At11.job
    C:\WINDOWS\tasks\At12.job
    C:\WINDOWS\tasks\At13.job
    C:\WINDOWS\tasks\At14.job
    C:\WINDOWS\tasks\At15.job
    C:\WINDOWS\tasks\At16.job
    C:\WINDOWS\tasks\At17.job
    C:\WINDOWS\tasks\At18.job
    C:\WINDOWS\tasks\At19.job
    C:\WINDOWS\tasks\At2.job
    C:\WINDOWS\tasks\At20.job
    C:\WINDOWS\tasks\At21.job
    C:\WINDOWS\tasks\At22.job
    C:\WINDOWS\tasks\At23.job
    C:\WINDOWS\tasks\At24.job
    C:\WINDOWS\tasks\At3.job
    C:\WINDOWS\tasks\At4.job
    C:\WINDOWS\tasks\At5.job
    C:\WINDOWS\tasks\At6.job
    C:\WINDOWS\tasks\At7.job
    C:\WINDOWS\tasks\At8.job
    C:\WINDOWS\tasks\At9.job
    C:\WINDOWS\tasks\Registration reminder 3.job
    C:\WINDOWS\tasks\Uniblue SpeedUpMyPC Nag.job
    C:\WINDOWS\tasks\Uniblue SpeedUpMyPC.job

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
    Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
    DriveLetterAccess - C:\WINDOWS\System32\DLA\DLASHX_W.DLL [2005-10-06 110652]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
    SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
    Google Toolbar Helper - c:\program files\google\googletoolbar3.dll [2007-01-19 2403392]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
    Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll [2008-09-22 737776]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar3.dll [2007-01-19 2403392]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "TabletWizard "=C:\WINDOWS\help\SplshWrp.exe [2008-04-13 16384]
    "TabletTip "=C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe [2008-04-13 271872]
    "00THotkey "=C:\WINDOWS\system32\00THotkey.exe [2006-01-17 258048]
    "CrossMenu "=C:\Program Files\Toshiba\CrossMenu\CrossMenu.exe [2005-09-20 798720]
    "000StTHK "=C:\WINDOWS\system32\000StTHK.exe [2001-06-23 24576]
    "Apoint "=C:\Program Files\Apoint2K\Apoint.exe [2004-03-23 196608]
    "LtMoh "=C:\Program Files\ltmoh\Ltmoh.exe [2004-08-17 184320]
    "AGRSMMSG "=C:\WINDOWS\AGRSMMSG.exe [2005-10-14 88203]
    "NDSTray.exe "=NDSTray.exe []
    "TFncKy "=TFncKy.exe []
    "ThpSrv "=thpsrv /logon []
    "TFNF5 "=C:\WINDOWS\system32\TFNF5.exe [2005-11-09 192512]
    "TMESRV.EXE "=C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE [2005-12-14 126976]
    "TMERzCtl.EXE "=C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE [2005-12-20 86016]
    "TPSMain "=C:\WINDOWS\system32\TPSMain.exe [2005-12-15 315392]
    "TPSODDCtl "=C:\WINDOWS\system32\TPSODDCtl.exe [2005-12-15 110592]
    "Kraidman "=C:\Program Files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe [2005-09-30 1126484]
    "TRot.exe "=c:\Program Files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe [2005-11-29 266240]
    "PINGER "=C:\TOSHIBA\IVP\ISM\pinger.exe [2005-03-17 151552]
    "TosHKCW.exe "=C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe [2005-05-17 49152]
    "SmoothView "=C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe [2005-05-23 122880]
    "TouchED "=C:\Program Files\TOSHIBA\TouchED\TouchED.Exe [2005-06-28 126976]
    "TAudEffect "=C:\Program Files\TOSHIBA\TAudEffect\TAudEff.exe [2005-10-05 344144]
    "TAcelMgr "=C:\Program Files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe [2004-12-16 90112]
    "TSkrMain "=C:\Program Files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe [2004-06-30 49152]
    "DLA "=C:\WINDOWS\System32\DLA\DLACTRLW.EXE [2005-10-06 122940]
    "IntelZeroConfig "=C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe [2005-12-05 667718]
    "IntelWireless "=C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe [2005-11-28 602182]
    "TDxVGAUTIL "=C:\WINDOWS\system32\TDxVGAUTIL.EXE [2005-12-19 65536]
    "CmUsbSound "=RunDll32 cmcnfgu.cpl []
    "ccApp "=C:\Program Files\Common Files\Symantec Shared\ccApp.exe [2006-03-24 53408]
    "vptray "=C:\PROGRA~1\SYMANT~1\VPTray.exe [2006-06-15 124656]
    "QuickTime Task "=C:\Program Files\QuickTime\QTTask.exe [2008-03-28 413696]
    "ISUSPM Startup "=C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe -startup []
    "ISUSScheduler "=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2005-08-11 81920]
    "igfxtray "=C:\WINDOWS\system32\igfxtray.exe [2005-11-27 98304]
    "igfxhkcmd "=C:\WINDOWS\system32\hkcmd.exe [2005-11-27 77824]
    "igfxpers "=C:\WINDOWS\system32\igfxpers.exe [2005-11-27 118784]
    "PSQLLauncher "=C:\Program Files\Protector Suite QL\launcher.exe [2007-11-14 49416]
    "SunJavaUpdateSched "=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
    "AdobeCS4ServiceManager "=C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
    "swg "=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2007-07-16 68856]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup
    Pidgin.lnk - C:\Program Files\Pidgin\pidgin.exe
    RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe
    TabUserW.exe.lnk - C:\WINDOWS\system32\WTablet\TabUserW.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
    C:\WINDOWS\system32\igfxdev.dll [2005-11-27 135168]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\loginkey]
    C:\Program Files\Common Files\Microsoft Shared\Ink\loginkey.dll [2008-04-13 47104]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
    C:\WINDOWS\system32\NavLogon.dll [2006-06-15 43760]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\psfus]
    C:\WINDOWS\system32\psqlpwd.dll [2007-11-14 96008]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\TabBtnWL]
    C:\WINDOWS\system32\TabBtnWL.dll [2002-08-29 11776]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\tpgwlnotify]
    C:\WINDOWS\system32\tpgwlnot.dll [2008-04-13 32256]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\TSigNP]
    C:\WINDOWS\system32\TSigNP.dll [2005-12-28 53248]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
    C:\WINDOWS\system32\WgaLogon.dll [2007-02-15 236928]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
    "notification packages "=scecli
    psqlpwd

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername "=0
    "legalnoticecaption "=
    "legalnoticetext "=
    "shutdownwithoutlogon "=1
    "undockwithoutlogon "=1

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveTypeAutoRun "=145

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "C:\TOSHIBA\ivp\NetInt\Netint.exe "= "C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrades Engine "
    "C:\TOSHIBA\Ivp\ISM\pinger.exe "= "C:\TOSHIBA\Ivp\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger "
    "C:\WINDOWS\system32\sessmgr.exe "= "C:\WINDOWS\system32\sessmgr.exe:*:Disabled:mad:xpsp2res.dll,-22019 "
    "C:\Program Files\Descent 3\main.exe "= "C:\Program Files\Descent 3\main.exe:*:Enabled:main "
    "C:\Program Files\Warcraft III\Warcraft III.exe "= "C:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III "
    "C:\Program Files\WS_FTP\WS_FTP95.exe "= "C:\Program Files\WS_FTP\WS_FTP95.exe:*:Enabled:WS_FTP 95 "
    "C:\Program Files\Google\Google Talk\googletalk.exe "= "C:\Program Files\Google\Google Talk\googletalk.exe:*:Enabled:Google Talk "
    "C:\Program Files\LimeWire\LimeWire.exe "= "C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\Macromedia\Fireworks MX\Fireworks.exe "= "C:\Program Files\Macromedia\Fireworks MX\Fireworks.exe:*:Enabled:Fireworks MX "
    "C:\WINDOWS\system32\ElectricSheep.scr "= "C:\WINDOWS\system32\ElectricSheep.scr:*:Enabled:ElectricSheep "
    "C:\Program Files\Bonjour\mDNSResponder.exe "= "C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour "
    "C:\Program Files\Pidgin\pidgin.exe "= "C:\Program Files\Pidgin\pidgin.exe:*:Enabled:pidgin "
    "C:\Program Files\Swift 3D\Program\Swift3D.exe "= "C:\Program Files\Swift 3D\Program\Swift3D.exe:*:Enabled:Swift 3D "
    "C:\Program Files\Maya Learning Edition\bin\maya.exe "= "C:\Program Files\Maya Learning Edition\bin\maya.exe:*:Enabled:Maya "
    "C:\Program Files\uTorrent\uTorrent.exe "= "C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent "
    "C:\Program Files\Adobe\Adobe Flash CS3\Flash.exe "= "C:\Program Files\Adobe\Adobe Flash CS3\Flash.exe:*:Enabled:Adobe Flash CS3 "
    "C:\Program Files\Internet Explorer\iexplore.exe "= "C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:Internet Explorer "
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "C:\Program Files\MSN Messenger\msnmsgr.exe "= "C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5 "
    "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe "= "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4 "

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe "= "%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\Network Diagnostic\xpnetdiag.exe "= "%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\Program Files\MSN Messenger\msnmsgr.exe "= "C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:MSN Messenger 7.5 "

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6549c929-fa2e-11da-9457-806d6172696f}]
    shell\AutoRun\command - D:\autoplay.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94b628c3-9783-11db-959e-0013025eb404}]
    shell\AutoRun\command - E:\LaunchU3.exe -a


    ======List of files/folders created in the last 3 months======

    2008-12-16 17:10:58 ----D---- C:\rsit
    2008-12-16 17:01:28 ----D---- C:\Program Files\Trend Micro
    2008-12-10 19:05:26 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
    2008-12-10 19:02:08 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
    2008-12-10 19:00:16 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
    2008-12-10 18:59:58 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
    2008-11-12 17:42:21 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
    2008-11-12 17:41:30 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
    2008-11-12 17:40:41 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
    2008-10-31 21:22:26 ----D---- C:\Program Files\Common Files\Adobe AIR
    2008-10-31 18:03:08 ----D---- C:\Documents and Settings\Owner\Application Data\Download Manager
    2008-10-23 23:13:34 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
    2008-10-15 23:59:51 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
    2008-10-15 23:59:41 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
    2008-10-15 23:59:30 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
    2008-10-15 23:56:54 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
    2008-10-15 23:56:32 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
    2008-10-15 00:46:08 ----D---- C:\Documents and Settings\Owner\Application Data\Malwarebytes
    2008-10-15 00:46:04 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-10-15 00:46:03 ----D---- C:\Program Files\Malwarebytes
    2008-10-14 22:53:15 ----A---- C:\WINDOWS\system32\RE5KQ2My.exe
    2008-09-30 16:43:34 ----A---- C:\WINDOWS\system32\msxml4.dll

    ======List of files/folders modified in the last 3 months======

    2008-12-16 17:10:41 ----D---- C:\WINDOWS\Temp
    2008-12-16 17:01:28 ----D---- C:\Program Files
    2008-12-16 16:34:32 ----D---- C:\Program Files\Mozilla Firefox
    2008-12-16 16:28:25 ----D---- C:\Documents and Settings\Owner\Application Data\.purple
    2008-12-16 09:24:00 ----D---- C:\WINDOWS
    2008-12-16 07:03:50 ----D---- C:\WINDOWS\system32
    2008-12-16 07:03:50 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
    2008-12-16 07:00:07 ----D---- C:\Program Files\Symantec AntiVirus
    2008-12-16 06:59:37 ----A---- C:\WINDOWS\ModemLog_TOSHIBA Software Modem.txt
    2008-12-16 06:59:28 ----D---- C:\WINDOWS\system32\DLA
    2008-12-15 19:08:57 ----A---- C:\WINDOWS\SchedLgU.Txt
    2008-12-13 14:30:33 ----D---- C:\Documents and Settings\Owner\Application Data\gtk-2.0
    2008-12-13 08:21:13 ----D---- C:\WINDOWS\system32\CatRoot2
    2008-12-11 23:41:36 ----HD---- C:\WINDOWS\inf
    2008-12-11 08:57:33 ----D---- C:\WINDOWS\system32\wbem
    2008-12-11 08:53:36 ----D---- C:\Program Files\Internet Explorer
    2008-12-10 19:05:20 ----SHD---- C:\WINDOWS\Installer
    2008-12-10 19:05:01 ----A---- C:\WINDOWS\win.ini
    2008-12-10 19:03:33 ----A---- C:\WINDOWS\imsins.BAK
    2008-12-10 19:03:24 ----RSHDC---- C:\WINDOWS\system32\dllcache
    2008-12-10 19:02:58 ----HD---- C:\WINDOWS\$hf_mig$
    2008-12-10 19:01:10 ----D---- C:\WINDOWS\Prefetch
    2008-12-09 17:24:37 ----A---- C:\WINDOWS\system32\MRT.exe
    2008-12-05 02:30:23 ----D---- C:\Documents and Settings\Owner\Application Data\Mozilla
    2008-11-29 20:24:58 ----D---- C:\WINDOWS\Help
    2008-11-12 17:42:23 ----D---- C:\WINDOWS\system32\drivers
    2008-11-12 17:39:53 ----D---- C:\WINDOWS\WinSxS
    2008-11-01 16:21:58 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
    2008-11-01 16:21:50 ----D---- C:\Documents and Settings\All Users\Application Data\FLEXnet
    2008-11-01 15:51:13 ----D---- C:\Documents and Settings\Owner\Application Data\Adobe
    2008-10-31 21:30:19 ----D---- C:\Program Files\Adobe
    2008-10-31 21:28:30 ----D---- C:\Program Files\Common Files\Adobe
    2008-10-31 21:22:26 ----D---- C:\Program Files\Common Files
    2008-10-23 06:36:14 ----A---- C:\WINDOWS\system32\gdi32.dll
    2008-10-23 04:06:59 ----N---- C:\WINDOWS\system32\tzchange.exe
    2008-10-22 14:10:26 ----D---- C:\Program Files\Microsoft Silverlight
    2008-10-17 02:08:40 ----A---- C:\WINDOWS\system32\mshtml.dll
    2008-10-16 14:38:40 ----A---- C:\WINDOWS\system32\wininet.dll
    2008-10-16 14:38:39 ----A---- C:\WINDOWS\system32\webcheck.dll
    2008-10-16 14:38:39 ----A---- C:\WINDOWS\system32\urlmon.dll
    2008-10-16 14:38:39 ----A---- C:\WINDOWS\system32\url.dll
    2008-10-16 14:38:39 ----A---- C:\WINDOWS\system32\pngfilt.dll
    2008-10-16 14:38:39 ----A---- C:\WINDOWS\system32\occache.dll
    2008-10-16 14:38:39 ----A---- C:\WINDOWS\system32\mstime.dll
    2008-10-16 14:38:38 ----A---- C:\WINDOWS\system32\msrating.dll
    2008-10-16 14:38:38 ----A---- C:\WINDOWS\system32\mshtmled.dll
    2008-10-16 14:38:37 ----A---- C:\WINDOWS\system32\msfeedsbs.dll
    2008-10-16 14:38:37 ----A---- C:\WINDOWS\system32\msfeeds.dll
    2008-10-16 14:38:37 ----A---- C:\WINDOWS\system32\jsproxy.dll
    2008-10-16 14:38:37 ----A---- C:\WINDOWS\system32\iertutil.dll
    2008-10-16 14:38:37 ----A---- C:\WINDOWS\system32\iernonce.dll
    2008-10-16 14:38:37 ----A---- C:\WINDOWS\system32\ieframe.dll
    2008-10-16 14:38:35 ----A---- C:\WINDOWS\system32\iedkcs32.dll
    2008-10-16 14:38:35 ----A---- C:\WINDOWS\system32\ieapfltr.dll
    2008-10-16 14:38:35 ----A---- C:\WINDOWS\system32\ieaksie.dll
    2008-10-16 14:38:35 ----A---- C:\WINDOWS\system32\ieakeng.dll
    2008-10-16 14:38:35 ----A---- C:\WINDOWS\system32\icardie.dll
    2008-10-16 14:38:35 ----A---- C:\WINDOWS\system32\extmgr.dll
    2008-10-16 14:38:34 ----A---- C:\WINDOWS\system32\dxtrans.dll
    2008-10-16 14:38:34 ----A---- C:\WINDOWS\system32\dxtmsft.dll
    2008-10-16 14:38:34 ----A---- C:\WINDOWS\system32\advpack.dll
    2008-10-16 14:13:40 ----A---- C:\WINDOWS\system32\wuweb.dll
    2008-10-16 14:13:40 ----A---- C:\WINDOWS\system32\wuaueng.dll
    2008-10-16 14:12:22 ----A---- C:\WINDOWS\system32\wucltui.dll
    2008-10-16 14:12:20 ----A---- C:\WINDOWS\system32\wuapi.dll
    2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\wups2.dll
    2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\wuauclt.exe
    2008-10-16 14:09:44 ----A---- C:\WINDOWS\system32\cdm.dll
    2008-10-16 14:09:40 ----A---- C:\WINDOWS\system32\wucltui.dll.mui
    2008-10-16 14:08:58 ----A---- C:\WINDOWS\system32\wups.dll
    2008-10-16 14:07:44 ----A---- C:\WINDOWS\system32\wuapi.dll.mui
    2008-10-16 14:07:14 ----A---- C:\WINDOWS\system32\wuaueng.dll.mui
    2008-10-16 14:06:48 ----A---- C:\WINDOWS\system32\muweb.dll
    2008-10-16 14:06:48 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
    2008-10-16 14:06:48 ----A---- C:\WINDOWS\system32\mucltui.dll
    2008-10-16 07:11:09 ----A---- C:\WINDOWS\system32\ieudinit.exe
    2008-10-16 07:11:09 ----A---- C:\WINDOWS\system32\ie4uinit.exe
    2008-10-15 10:34:24 ----A---- C:\WINDOWS\system32\netapi32.dll
    2008-10-15 01:04:53 ----A---- C:\WINDOWS\system32\ieakui.dll
    2008-10-14 22:53:16 ----SD---- C:\WINDOWS\Tasks
    2008-10-03 04:02:42 ----A---- C:\WINDOWS\system32\strmdll.dll
    2008-09-27 23:24:21 ----RSD---- C:\WINDOWS\Fonts
    2008-09-26 15:43:46 ----SD---- C:\WINDOWS\Downloaded Program Files
    2008-09-26 15:43:44 ----D---- C:\WINDOWS\system32\Macromed

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 DLACDBHM;DLACDBHM; C:\WINDOWS\System32\Drivers\DLACDBHM.SYS [2005-08-25 5628]
    R1 DLARTL_N;DLARTL_N; C:\WINDOWS\System32\Drivers\DLARTL_N.SYS [2005-08-25 22684]
    R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys []
    R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
    R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14592]
    R1 meiudf;meiudf; C:\WINDOWS\System32\Drivers\meiudf.sys [2005-06-02 102384]
    R1 SAVRT;SAVRT; \??\C:\Program Files\Symantec AntiVirus\savrt.sys []
    R1 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Symantec AntiVirus\Savrtpel.sys []
    R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys []
    R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2006-01-24 195776]
    R1 TMEI3E;TMEI3E; C:\WINDOWS\System32\Drivers\TMEI3E.SYS [2004-06-16 5888]
    R2 adfs;adfs; C:\WINDOWS\system32\drivers\adfs.sys [2008-08-14 74720]
    R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.9.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2006-06-12 21275]
    R2 CVPNDRVA;Cisco Systems IPsec Driver; \??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys []
    R2 DLABOIOM;DLABOIOM; C:\WINDOWS\System32\DLA\DLABOIOM.SYS [2005-10-06 25628]
    R2 DLADResN;DLADResN; C:\WINDOWS\System32\DLA\DLADResN.SYS [2005-10-06 2496]
    R2 DLAIFS_M;DLAIFS_M; C:\WINDOWS\System32\DLA\DLAIFS_M.SYS [2005-10-06 86524]
    R2 DLAOPIOM;DLAOPIOM; C:\WINDOWS\System32\DLA\DLAOPIOM.SYS [2005-10-06 14684]
    R2 DLAPoolM;DLAPoolM; C:\WINDOWS\System32\DLA\DLAPoolM.SYS [2005-10-06 6364]
    R2 DLAUDF_M;DLAUDF_M; C:\WINDOWS\System32\DLA\DLAUDF_M.SYS [2005-10-06 87036]
    R2 DLAUDFAM;DLAUDFAM; C:\WINDOWS\System32\DLA\DLAUDFAM.SYS [2005-10-06 94332]
    R2 DRVNDDM;DRVNDDM; C:\WINDOWS\System32\Drivers\DRVNDDM.SYS [2005-08-12 40544]
    R2 Netdevio;TOSHIBA Network Device Usermode I/O Protocol; C:\WINDOWS\system32\DRIVERS\netdevio.sys [2003-01-29 12032]
    R2 s24trans;WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2005-11-28 13568]
    R3 AgereSoftModem;TOSHIBA V92 Software Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2005-11-14 1122656]
    R3 ApfiltrService;Alps Pointing-device Filter Driver; C:\WINDOWS\system32\DRIVERS\Apfiltr.sys [2004-05-08 101833]
    R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
    R3 DNE;Deterministic Network Enhancer Miniport; C:\WINDOWS\system32\DRIVERS\dne2000.sys [2005-06-29 110080]
    R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1e5132.sys [2005-09-14 179200]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
    R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
    R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
    R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\ialmnt5.sys [2005-11-28 1353820]
    R3 IFXTPM;IFXTPM; C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2005-06-09 35968]
    R3 Iviaspi;IVI ASPI Shell; C:\WINDOWS\system32\drivers\iviaspi.sys [2003-09-11 21060]
    R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-17 12160]
    R3 NAVENG;NAVENG; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080718.007\naveng.sys []
    R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20080718.007\navex15.sys []
    R3 Pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-09-19 10368]
    R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2008-04-13 79232]
    R3 STHDA;SigmaTel High Definition Audio CODEC; C:\WINDOWS\system32\drivers\sthda.sys [2005-12-12 1083576]
    R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []
    R3 tbiosdrv;Toshiba Logical Tbios Device; C:\WINDOWS\system32\DRIVERS\tbiosdrv.sys [2005-08-24 9472]
    R3 TBtnKey;TOSHIBA Tablet PC Buttons Type N HID Driver; C:\WINDOWS\system32\DRIVERS\TBtnKey.sys [2002-09-13 8832]
    R3 TcUsb;TC USB Kernel Driver; C:\WINDOWS\System32\Drivers\tcusb.sys [2007-11-14 47120]
    R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver; C:\WINDOWS\system32\DRIVERS\tdcmdpst.sys [2006-01-15 14976]
    R3 TdxMrMINI;TdxMrMINI; C:\WINDOWS\system32\DRIVERS\TdxMrMini.sys [2005-06-23 233984]
    R3 TdxVGAMINI;TdxVGAMINI; C:\WINDOWS\system32\DRIVERS\TdxVgaMini.sys [2005-06-23 234496]
    R3 tifm21;tifm21; C:\WINDOWS\system32\drivers\tifm21.sys [2005-06-22 162176]
    R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
    R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
    R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
    R3 w39n51;Intel(R) PRO/Wireless 3945ABG Adapter Driver; C:\WINDOWS\system32\DRIVERS\w39n51.sys [2005-12-04 1428096]
    R3 WacomISDPen;Wacom Penabled HID MiniDriver; C:\WINDOWS\system32\DRIVERS\wacomisdpen.sys [2006-04-06 23040]
    S2 FdRedir;FdRedir; \??\C:\Program Files\Common Files\Protector Suite QL\Drivers\FdRedir.sys []
    S2 npkcrypt;npkcrypt; \??\C:\Program Files\Maple Story\npkcrypt.sys []
    S2 smihlp;SMI helper driver; \??\C:\Program Files\Protector Suite QL\smihlp.sys []
    S3 ADM851X;ADM851X USB To Fast Ethernet Adapter; C:\WINDOWS\system32\DRIVERS\ADM851X.SYS [2003-12-19 27135]
    S3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
    S3 cmudau;C-Media USB Sound Interface; C:\WINDOWS\system32\drivers\cmudaxu.sys [2005-07-20 1390656]
    S3 CVirtA;Cisco Systems VPN Adapter; C:\WINDOWS\system32\DRIVERS\CVirtA.sys [2005-05-17 5315]
    S3 dump_wmimmc;dump_wmimmc; \??\C:\Program Files\Maple Story\GameGuard\dump_wmimmc.sys []
    S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
    S3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
    S3 NPPTNT2;NPPTNT2; \??\C:\WINDOWS\system32\npptNT2.sys []
    S3 QV2KUX;Casio Digital Camera; C:\WINDOWS\system32\DRIVERS\qv2kux.sys [2001-08-17 3328]
    S3 sffdisk;SFF Storage Class Driver; C:\WINDOWS\system32\DRIVERS\sffdisk.sys [2008-04-13 11904]
    S3 sffp_sd;SFF Storage Protocol Driver for SDBus; C:\WINDOWS\system32\DRIVERS\sffp_sd.sys [2008-04-13 11008]
    S3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2006-01-24 24768]
    S3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB); C:\WINDOWS\system32\drivers\TdxVGAUSB.sys [2005-06-23 22528]
    S3 TEchoCan;Toshiba Audio Effect; C:\WINDOWS\system32\DRIVERS\TEchoCan.sys [2005-12-26 595072]
    S3 tosrfec;Bluetooth ACPI from TOSHIBA; C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2005-09-09 9344]
    S3 U2SP;OEM USB to Serial Converter Driver(Philips); C:\WINDOWS\system32\DRIVERS\u2s2kxp.sys [2004-09-01 23296]
    S3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
    S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
    S3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
    S3 vsdatant;vsdatant; \??\C:\WINDOWS\system32\vsdatant.sys []
    S3 WacomPen;Wacom Serial Pen HID Driver; C:\WINDOWS\system32\DRIVERS\wacompen.sys [2008-04-13 14208]
    S3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys [2003-01-10 33588]
    S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
    S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
    S3 YMIDUSB;Yamaha Corporation USB MIDI Driver; C:\WINDOWS\System32\Drivers\ymidusb.sys [2007-11-07 18048]
    S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
    R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe [2006-03-24 192160]
    R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe [2006-03-24 169632]
    R2 CFSvcs;ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2005-01-17 40960]
    R2 CVPND;Cisco Systems, Inc. VPN Service; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [2006-04-20 1520688]
    R2 DefWatch;Symantec AntiVirus Definition Watcher; C:\Program Files\Symantec AntiVirus\DefWatch.exe [2006-06-15 31472]
    R2 DVD-RAM_Service;DVD-RAM_Service; C:\WINDOWS\system32\DVDRAMSV.exe [2004-08-28 110592]
    R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2005-11-28 114753]
    R2 kraidsvc;TOSHIBA RAID Service; C:\Program Files\TOSHIBA\TOSHIBA RAID\Service\kraidsvc.exe [2005-10-07 229460]
    R2 ProtexisLicensing;ProtexisLicensing; C:\WINDOWS\system32\PSIService.exe [2006-11-02 174656]
    R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2005-11-28 217164]
    R2 S24EventMonitor;Intel(R) PROSet/Wireless Service; C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe [2005-11-28 540745]
    R2 SavRoam;SAVRoam; C:\Program Files\Symantec AntiVirus\SavRoam.exe [2006-06-15 115952]
    R2 SPBBCSvc;Symantec SPBBCSvc; C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe [2006-04-11 1160848]
    R2 Swupdtmr;Swupdtmr; c:\TOSHIBA\IVP\swupdate\swupdtmr.exe [2005-07-12 40960]
    R2 Symantec AntiVirus;Symantec AntiVirus; C:\Program Files\Symantec AntiVirus\Rtvscan.exe [2006-06-15 1805552]
    R2 TabletService;TabletService; C:\WINDOWS\system32\Tablet.exe [2006-04-06 753664]
    R2 Thpsrv;TOSHIBA HDD Protection; C:\WINDOWS\system32\ThpSrv.exe [2005-12-20 176128]
    R2 Tmesrv;Tmesrv3; C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe [2005-12-14 126976]
    R2 TODDSrv;TOSHIBA Optical Disc Drive Service; C:\WINDOWS\system32\TODDSrv.exe [2006-01-15 114688]
    S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-13 267776]
    S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
    S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-10-31 655624]
    S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-31 138168]
    S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
    S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-02-23 2045632]
    S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
    S3 SNDSrvc;Symantec Network Drivers Service; C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe [2006-01-24 214720]
    S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
    S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
    S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]

    -----------------EOF-----------------
     
    Kajenx,
    #1
  2. 2008/12/18
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Welcome to WindowsBBS Kajenx :)

    Download ComboFix by sUBs from here, saving the file to your desktop.


    Please disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

    • Close all open programs and windows
    • Double click ComboFix.exe and follow the prompts.
    • It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log in your next reply.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall

    **NOTE - I recommend you allow the Recovery Console to be downloaded and installed if or when prompted.
     
    noahdfear,
    #2


  3. to hide this advert.

  4. 2008/12/18
    Kajenx

    Kajenx Inactive Thread Starter

    Joined:
    2008/12/16
    Messages:
    6
    Likes Received:
    0
    Alright, here's the logfile. I don't see iexplore.exe running now either!



    ComboFix 08-12-17.01 - Owner 2008-12-18 9:30:03.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.372 [GMT -6:00]
    Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\mdm.exe

    .
    ((((((((((((((((((((((((( Files Created from 2008-11-18 to 2008-12-18 )))))))))))))))))))))))))))))))
    .

    2008-12-18 00:03 . 2008-12-18 00:03 <DIR> d-------- c:\documents and settings\Owner\Sun
    2008-12-16 17:10 . 2008-12-16 17:11 <DIR> d-------- C:\rsit
    2008-12-16 17:01 . 2008-12-16 17:01 <DIR> d-------- c:\program files\Trend Micro

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-12-18 15:35 --------- d-----w c:\program files\Symantec AntiVirus
    2008-12-18 15:20 --------- d-----w c:\documents and settings\Owner\Application Data\.purple
    2008-12-13 20:30 --------- d-----w c:\documents and settings\Owner\Application Data\gtk-2.0
    2008-11-02 05:39 --------- d-----w c:\program files\Malwarebytes
    2008-11-01 22:21 --------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
    2008-11-01 03:28 --------- d-----w c:\program files\Common Files\Adobe
    2008-11-01 03:22 --------- d-----w c:\program files\Common Files\Adobe AIR
    2008-11-01 02:55 --------- d-----w c:\documents and settings\Owner\Application Data\Download Manager
    2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
    2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
    2008-10-22 21:10 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
    2008-10-22 21:10 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
    2008-10-22 20:10 --------- d-----w c:\program files\Microsoft Silverlight
    2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
    2008-10-16 20:13 202,776 ----a-w c:\windows\system32\wuweb.dll
    2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
    2008-10-16 20:12 561,688 ----a-w c:\windows\system32\wuapi.dll
    2008-10-16 20:12 323,608 ----a-w c:\windows\system32\wucltui.dll
    2008-10-16 20:09 92,696 ----a-w c:\windows\system32\cdm.dll
    2008-10-16 20:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
    2008-10-16 20:09 43,544 ----a-w c:\windows\system32\wups2.dll
    2008-10-16 20:08 34,328 ----a-w c:\windows\system32\wups.dll
    2008-10-16 20:06 268,648 ----a-w c:\windows\system32\mucltui.dll
    2008-10-16 20:06 208,744 ----a-w c:\windows\system32\muweb.dll
    2008-10-15 04:52 37,890 ----a-w c:\windows\system32\RE5KQ2My.exe
    2008-10-03 10:02 247,326 ----a-w c:\windows\system32\strmdll.dll
    2008-09-30 22:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
    2007-04-25 04:25 614 -c--a-w c:\documents and settings\Owner\Application Data\wklnhst.dat
    2006-09-16 05:53 90 -c--a-w c:\program files\WS_FTP.LOG
    2008-08-05 03:48 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008080420080805\index.dat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
    @= "{F2F31467-B1AC-4df0-AE79-FD5FA085E22B} "
    [HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
    2007-11-14 11:22 3186440 --a------ c:\program files\Protector Suite QL\farchns.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
    @= "{A3E208F7-0E3A-4182-A7A6-B169D5D691AA} "
    [HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
    2007-11-14 11:22 3186440 --a------ c:\program files\Protector Suite QL\farchns.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
    "swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-16 68856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ThpSrv "= "thpsrv" [X]
    "TabletWizard "= "c:\windows\help\SplshWrp.exe" [2008-04-13 16384]
    "TabletTip "= "c:\program files\Common Files\microsoft shared\ink\tabtip.exe" [2008-04-13 271872]
    "00THotkey "= "c:\windows\system32\00THotkey.exe" [2006-01-17 03:00 258048]
    "CrossMenu "= "c:\program files\Toshiba\CrossMenu\CrossMenu.exe" [2005-09-20 798720]
    "Apoint "= "c:\program files\Apoint2K\Apoint.exe" [2004-03-23 196608]
    "LtMoh "= "c:\program files\ltmoh\Ltmoh.exe" [2004-08-17 184320]
    "TMESRV.EXE "= "c:\program files\TOSHIBA\TME3\TMESRV31.EXE" [2005-12-14 126976]
    "TMERzCtl.EXE "= "c:\program files\TOSHIBA\TME3\TMERzCtl.EXE" [2005-12-20 86016]
    "Kraidman "= "c:\program files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe" [2005-09-30 1126484]
    "TRot.exe "= "c:\program files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe" [2005-11-29 266240]
    "PINGER "= "c:\toshiba\IVP\ISM\pinger.exe" [2005-03-17 151552]
    "TosHKCW.exe "= "c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2005-05-17 49152]
    "SmoothView "= "c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-05-23 122880]
    "TouchED "= "c:\program files\TOSHIBA\TouchED\TouchED.Exe" [2005-06-28 126976]
    "TAudEffect "= "c:\program files\TOSHIBA\TAudEffect\TAudEff.exe" [2005-10-05 344144]
    "TAcelMgr "= "c:\program files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe" [2004-12-16 90112]
    "TSkrMain "= "c:\program files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe" [2004-06-30 49152]
    "DLA "= "c:\windows\System32\DLA\DLACTRLW.EXE" [2005-10-06 122940]
    "IntelZeroConfig "= "c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 667718]
    "IntelWireless "= "c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 602182]
    "TDxVGAUTIL "= "c:\windows\system32\TDxVGAUTIL.EXE" [2005-12-19 65536]
    "ccApp "= "c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-24 53408]
    "vptray "= "c:\progra~1\SYMANT~1\VPTray.exe" [2006-06-15 124656]
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696]
    "ISUSScheduler "= "c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
    "igfxtray "= "c:\windows\system32\igfxtray.exe" [2005-11-27 98304]
    "igfxhkcmd "= "c:\windows\system32\hkcmd.exe" [2005-11-27 77824]
    "igfxpers "= "c:\windows\system32\igfxpers.exe" [2005-11-27 118784]
    "PSQLLauncher "= "c:\program files\Protector Suite QL\launcher.exe" [2007-11-14 49416]
    "SunJavaUpdateSched "= "c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "AdobeCS4ServiceManager "= "c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
    "000StTHK "= "000StTHK.exe" [2001-06-23 22:28 24576 c:\windows\system32\000StTHK.exe]
    "AGRSMMSG "= "AGRSMMSG.exe" [2005-10-14 c:\windows\agrsmmsg.exe]
    "NDSTray.exe "= "NDSTray.exe" [BU]
    "TFncKy "= "TFncKy.exe" [BU]
    "TFNF5 "= "TFNF5.exe" [2005-11-09 c:\windows\system32\TFNF5.exe]
    "TPSMain "= "TPSMain.exe" [2005-12-15 c:\windows\system32\TPSMain.exe]
    "TPSODDCtl "= "TPSODDCtl.exe" [2005-12-15 c:\windows\system32\TPSODDCtl.exe]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Pidgin.lnk - c:\program files\Pidgin\pidgin.exe [2007-10-23 44655]
    RAMASST.lnk - c:\windows\system32\RAMASST.exe [2006-01-14 155648]
    TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2007-02-15 114688]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
    2008-04-13 18:11 47104 c:\program files\Common Files\Microsoft Shared\Ink\loginkey.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
    2007-11-14 11:07 96008 c:\windows\system32\psqlpwd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
    2002-08-29 05:41 11776 c:\windows\system32\tabbtnwl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
    2008-04-13 18:12 32256 c:\windows\system32\tpgwlnot.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TSigNP]
    2005-12-28 00:05 53248 c:\windows\system32\TSigNP.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "midi3 "= xgusb.cpl

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Notification Packages REG_MULTI_SZ scecli psqlpwd

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe "=
    "c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe "=
    "c:\\WINDOWS\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Descent 3\\main.exe "=
    "c:\\Program Files\\Warcraft III\\Warcraft III.exe "=
    "c:\\Program Files\\WS_FTP\\WS_FTP95.exe "=
    "c:\\Program Files\\LimeWire\\LimeWire.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "c:\\Program Files\\Macromedia\\Fireworks MX\\Fireworks.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\Pidgin\\pidgin.exe "=
    "c:\\Program Files\\Swift 3D\\Program\\Swift3D.exe "=
    "c:\\Program Files\\Adobe\\Adobe Flash CS3\\Flash.exe "=
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "500:UDP "= 500:UDP:Cisco VPN Client
    "5353:TCP "= 5353:TCP:Adobe CSI CS4

    R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [2004-12-28 16384]
    R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [2006-01-15 6144]
    R1 TMEI3E;TMEI3E;c:\windows\system32\Drivers\TMEI3E.SYS [2006-01-15 5888]
    R2 SavRoam;SAVRoam; "c:\program files\Symantec AntiVirus\SavRoam.exe" [2006-06-15 115952]
    R2 Tmesrv;Tmesrv3; "c:\program files\TOSHIBA\TME3\Tmesrv31.exe" /Service [2006-01-15 126976]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-05-31 109616]
    R3 IFXTPM;IFXTPM;c:\windows\system32\DRIVERS\IFXTPM.SYS [2006-01-14 35968]
    R3 TBtnKey;TOSHIBA Tablet PC Buttons Type N HID Driver;c:\windows\system32\DRIVERS\TBtnKey.sys [2006-01-15 8832]
    R3 TdxMrMINI;TdxMrMINI;c:\windows\system32\DRIVERS\TdxMrMini.sys [2006-09-04 233984]
    R3 TdxVGAMINI;TdxVGAMINI;c:\windows\system32\DRIVERS\TdxVgaMini.sys [2006-09-04 234496]
    R3 WacomISDPen;Wacom Penabled HID MiniDriver;c:\windows\system32\DRIVERS\wacomisdpen.sys [2006-04-06 23040]
    S2 FdRedir;FdRedir;\??\c:\program files\Common Files\Protector Suite QL\Drivers\FdRedir.sys []
    S2 smihlp;SMI helper driver;\??\c:\program files\Protector Suite QL\smihlp.sys []
    S3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\DRIVERS\ADM851X.SYS [2006-09-04 27135]
    S3 dump_wmimmc;dump_wmimmc;\??\c:\program files\Maple Story\GameGuard\dump_wmimmc.sys []
    S3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB);c:\windows\system32\drivers\TdxVGAUSB.sys [2006-09-04 22528]
    S3 TEchoCan;Toshiba Audio Effect;c:\windows\system32\DRIVERS\TEchoCan.sys [2006-01-15 595072]
    S3 WacomPen;Wacom Serial Pen HID Driver;c:\windows\system32\DRIVERS\wacompen.sys [2006-01-14 14208]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94b628c3-9783-11db-959e-0013025eb404}]
    \Shell\AutoRun\command - E:\LaunchU3.exe -a
    .
    Contents of the 'Scheduled Tasks' folder

    2008-12-11 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]

    2008-12-18 c:\windows\Tasks\At1.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-15 c:\windows\Tasks\At10.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-17 c:\windows\Tasks\At11.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-17 c:\windows\Tasks\At12.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-17 c:\windows\Tasks\At13.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-17 c:\windows\Tasks\At14.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-17 c:\windows\Tasks\At15.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-17 c:\windows\Tasks\At16.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-17 c:\windows\Tasks\At17.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-17 c:\windows\Tasks\At18.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-17 c:\windows\Tasks\At19.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-12 c:\windows\Tasks\At2.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-17 c:\windows\Tasks\At20.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-18 c:\windows\Tasks\At21.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-18 c:\windows\Tasks\At22.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-18 c:\windows\Tasks\At23.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-18 c:\windows\Tasks\At24.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-15 c:\windows\Tasks\At3.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-06 c:\windows\Tasks\At4.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-10 c:\windows\Tasks\At5.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-10 c:\windows\Tasks\At6.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-13 c:\windows\Tasks\At7.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-16 c:\windows\Tasks\At8.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2008-12-16 c:\windows\Tasks\At9.job
    - c:\windows\system32\RE5KQ2My.exe [2008-10-14 22:52]

    2006-06-12 c:\windows\Tasks\Registration reminder 3.job
    - c:\windows\system32\OOBE\oobebaln.exe [2008-04-13 18:12]

    2008-12-05 c:\windows\Tasks\Uniblue SpeedUpMyPC Nag.job
    - c:\program files\SpeedUpMyPC 3\SpeedUpMyPC.exe []

    2008-08-07 c:\windows\Tasks\Uniblue SpeedUpMyPC.job
    - c:\program files\SpeedUpMyPC 3\SpeedUpMyPC.exe []
    .
    - - - - ORPHANS REMOVED - - - -

    HKLM-Run-ISUSPM Startup - c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe
    HKLM-Run-CmUsbSound - cmcnfgu.cpl


    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uSearch Page = hxxp://www.google.com
    uWindow Title = Windows Internet Explorer provided by Comcast
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uSearch Bar = hxxp://www.google.com/ie
    mDefault_Page_URL = hxxp://www.comcast.net
    mStart Page = hxxp://www.comcast.net
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    mSearchAssistant = hxxp://www.google.com/ie
    IE: &Save Flash In This Page by Flash Saver - c:\progra~1\FLASHS~1\save.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    IE: Google AdSense Preview Tool - http://pagead2.googlesyndication.com/pagead/preview/en/preview.html
    FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\2hgw5j25.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
    FF - component: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\2hgw5j25.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
    FF - component: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\2hgw5j25.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll
    FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-18 09:35:59
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(1280)
    c:\windows\system32\psqlpwd.dll
    c:\program files\Protector Suite QL\homefus2.dll
    c:\program files\Protector Suite QL\infql2.dll
    c:\program files\Protector Suite QL\homepass.dll
    c:\program files\Protector Suite QL\bio.dll
    c:\program files\Protector Suite QL\qlbase.dll
    c:\windows\system32\TSigNP.dll
    c:\program files\Protector Suite QL\biokmd.dll
    c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
    c:\program files\Protector Suite QL\otp.dll
    c:\program files\Protector Suite QL\psqltray.dll

    - - - - - - - > 'lsass.exe'(1336)
    c:\windows\system32\psqlpwd.dll
    c:\program files\Protector Suite QL\homefus2.dll
    c:\program files\Protector Suite QL\infql2.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Intel\Wireless\Bin\EvtEng.exe
    c:\program files\Common Files\Microsoft Shared\Ink\keyboardsurrogate.exe
    c:\program files\Intel\Wireless\Bin\S24EvMon.exe
    c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
    c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
    c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Toshiba\ConfigFree\CFSvcs.exe
    c:\program files\Cisco Systems\VPN Client\cvpnd.exe
    c:\program files\Symantec AntiVirus\DefWatch.exe
    c:\windows\system32\DVDRAMSV.exe
    c:\program files\Toshiba\TOSHIBA RAID\Service\kraidsvc.exe
    c:\windows\system32\PSIService.exe
    c:\program files\Intel\Wireless\Bin\RegSrvc.exe
    c:\toshiba\IVP\swupdate\swupdtmr.exe
    c:\program files\Symantec AntiVirus\Rtvscan.exe
    c:\windows\system32\Tablet.exe
    c:\windows\system32\ThpSrv.exe
    c:\windows\system32\TODDSrv.exe
    c:\program files\Toshiba\TOSHIBA RAID\Service\krdevctl.exe
    c:\windows\system32\wisptis.exe
    c:\windows\system32\tabbtnu.exe
    c:\windows\system32\wscntfy.exe
    c:\program files\Common Files\Microsoft Shared\Ink\tcserver.exe
    c:\program files\Toshiba\ConfigFree\NDSTray.exe
    c:\program files\Toshiba\TOSHIBA Controls\TFncKy.exe
    c:\windows\system32\ThpSrv.exe
    c:\program files\Toshiba\TME3\TMETEMnu.exe
    c:\program files\Apoint2K\ApntEx.exe
    c:\windows\system32\TPSBattM.exe
    c:\windows\system32\rundll32.exe
    c:\program files\Protector Suite QL\psqltray.exe
    c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe
    .
    **************************************************************************
    .
    Completion time: 2008-12-18 9:42:19 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-12-18 15:42:15

    Pre-Run: 51,291,168,768 bytes free
    Post-Run: 52,640,694,272 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect /forceresetreg

    330 --- E O F --- 2008-12-12 08:30:05
     
    Kajenx,
    #3
  5. 2008/12/18
    Kajenx

    Kajenx Inactive Thread Starter

    Joined:
    2008/12/16
    Messages:
    6
    Likes Received:
    0
    Actually, I lied, I just checked and it's still there. iexplore.exe running on SYSTEM at 21,000k mem usage.

    EDIT: I was reading the protection thread stickied at the top of this forum, and I downloaded Avast (my current antivirus was out of date). I ran a scan and it found a virus. I haven't seen the iexplore.exe running on SYSTEM the last few times I checked, so the problem may be gone. The file Avast deleted was "C:\WINDOWS\system32\RE5KQ2My.exe ". I'll continue to watch for symptoms and post here if anything changes.
     
    Last edited: 2008/12/18
    Kajenx,
    #4
  6. 2008/12/18
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    I saw your edit RE: Avast after I had reviewed your log and prepared a fix for you, and had already added the file for removal. I left it in there just to make sure it is indeed removed.

    Once again, please disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Code:
    File::
c:\windows\system32\RE5KQ2My.exe
c:\windows\Tasks\At1.job
c:\windows\Tasks\At10.job
c:\windows\Tasks\At11.job
c:\windows\Tasks\At12.job
c:\windows\Tasks\At13.job
c:\windows\Tasks\At14.job
c:\windows\Tasks\At15.job
c:\windows\Tasks\At16.job
c:\windows\Tasks\At17.job
c:\windows\Tasks\At18.job
c:\windows\Tasks\At19.job
c:\windows\Tasks\At2.job
c:\windows\Tasks\At20.job
c:\windows\Tasks\At21.job
c:\windows\Tasks\At22.job
c:\windows\Tasks\At23.job
c:\windows\Tasks\At24.job
c:\windows\Tasks\At3.job
c:\windows\Tasks\At4.job
c:\windows\Tasks\At5.job
c:\windows\Tasks\At6.job
c:\windows\Tasks\At7.job
c:\windows\Tasks\At8.job
c:\windows\Tasks\At9.job
    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

    **NOTE - Allow ComboFix to update if prompted.
     
    noahdfear,
    #5
  7. 2008/12/18
    Kajenx

    Kajenx Inactive Thread Starter

    Joined:
    2008/12/16
    Messages:
    6
    Likes Received:
    0
    I'm so excited! I haven't had any popups since I removed the file, and I haven't seen IE running in the background all day! I've had this thing for weeks, and it seemed like I tried everything! This forum is so helpful, you guys are awesome.

    Ok, I ran the txt file through ComboFix like you said, let me know if you recommend anything else; here's the log:


    ComboFix 08-12-17.01 - Owner 2008-12-18 23:04:45.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.464 [GMT -6:00]
    Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
    * Created a new restore point

    FILE ::
    c:\windows\system32\RE5KQ2My.exe
    c:\windows\Tasks\At1.job
    c:\windows\Tasks\At10.job
    c:\windows\Tasks\At11.job
    c:\windows\Tasks\At12.job
    c:\windows\Tasks\At13.job
    c:\windows\Tasks\At14.job
    c:\windows\Tasks\At15.job
    c:\windows\Tasks\At16.job
    c:\windows\Tasks\At17.job
    c:\windows\Tasks\At18.job
    c:\windows\Tasks\At19.job
    c:\windows\Tasks\At2.job
    c:\windows\Tasks\At20.job
    c:\windows\Tasks\At21.job
    c:\windows\Tasks\At22.job
    c:\windows\Tasks\At23.job
    c:\windows\Tasks\At24.job
    c:\windows\Tasks\At3.job
    c:\windows\Tasks\At4.job
    c:\windows\Tasks\At5.job
    c:\windows\Tasks\At6.job
    c:\windows\Tasks\At7.job
    c:\windows\Tasks\At8.job
    c:\windows\Tasks\At9.job
    .

    ((((((((((((((((((((((((( Files Created from 2008-11-19 to 2008-12-19 )))))))))))))))))))))))))))))))
    .

    2008-12-18 15:00 . 2008-12-18 23:12 <DIR> d-------- c:\program files\Avast
    2008-12-18 15:00 . 2003-03-18 15:20 1,060,864 --a------ c:\windows\system32\MFC71.dll
    2008-12-18 11:42 . 2008-12-18 11:42 <DIR> d-------- c:\program files\Ad-Aware
    2008-12-18 11:42 . 2008-12-18 11:42 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
    2008-12-18 00:03 . 2008-12-18 00:03 <DIR> d-------- c:\documents and settings\Owner\Sun
    2008-12-16 17:10 . 2008-12-16 17:11 <DIR> d-------- C:\rsit
    2008-12-16 17:01 . 2008-12-16 17:01 <DIR> d-------- c:\program files\Trend Micro

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-12-19 05:05 --------- d-----w c:\documents and settings\Owner\Application Data\.purple
    2008-12-18 17:41 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
    2008-12-18 16:02 --------- d-----w c:\program files\Symantec AntiVirus
    2008-12-18 16:02 --------- d-----w c:\program files\Symantec
    2008-12-18 16:02 --------- d-----w c:\program files\Common Files\Symantec Shared
    2008-12-18 16:02 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
    2008-12-13 20:30 --------- d-----w c:\documents and settings\Owner\Application Data\gtk-2.0
    2008-11-02 05:39 --------- d-----w c:\program files\Malwarebytes
    2008-11-01 22:21 --------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet
    2008-11-01 03:28 --------- d-----w c:\program files\Common Files\Adobe
    2008-11-01 03:22 --------- d-----w c:\program files\Common Files\Adobe AIR
    2008-11-01 02:55 --------- d-----w c:\documents and settings\Owner\Application Data\Download Manager
    2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
    2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
    2008-10-22 21:10 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
    2008-10-22 21:10 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
    2008-10-22 20:10 --------- d-----w c:\program files\Microsoft Silverlight
    2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
    2008-10-16 20:13 202,776 ----a-w c:\windows\system32\wuweb.dll
    2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
    2008-10-16 20:12 561,688 ----a-w c:\windows\system32\wuapi.dll
    2008-10-16 20:12 323,608 ----a-w c:\windows\system32\wucltui.dll
    2008-10-16 20:09 92,696 ----a-w c:\windows\system32\cdm.dll
    2008-10-16 20:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
    2008-10-16 20:09 43,544 ----a-w c:\windows\system32\wups2.dll
    2008-10-16 20:08 34,328 ----a-w c:\windows\system32\wups.dll
    2008-10-16 20:06 268,648 ----a-w c:\windows\system32\mucltui.dll
    2008-10-16 20:06 208,744 ----a-w c:\windows\system32\muweb.dll
    2008-10-03 10:02 247,326 ----a-w c:\windows\system32\strmdll.dll
    2008-09-30 22:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
    2007-04-25 04:25 614 -c--a-w c:\documents and settings\Owner\Application Data\wklnhst.dat
    2006-09-16 05:53 90 -c--a-w c:\program files\WS_FTP.LOG
    2008-08-05 03:48 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008080420080805\index.dat
    .

    ((((((((((((((((((((((((((((( snapshot@2008-12-18_ 9.41.43.37 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-10-17 08:08:40 3,593,216 -c----w c:\windows\ie7updates\KB960714-IE7\mshtml.dll
    + 2007-03-06 01:22:39 213,216 -c----w c:\windows\ie7updates\KB960714-IE7\spuninst\spuninst.exe
    + 2007-03-06 01:23:47 371,424 -c----w c:\windows\ie7updates\KB960714-IE7\spuninst\updspapi.dll
    + 2008-11-26 17:21:30 1,236,208 ----a-w c:\windows\system32\aswBoot.exe
    + 2008-11-26 17:15:10 97,480 ----a-w c:\windows\system32\AvastSS.scr
    - 2008-08-05 03:48:34 16,384 -c--a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
    + 2008-12-19 02:29:09 16,384 -c--a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
    - 2008-08-05 03:48:34 32,768 -c--a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2008-12-19 02:29:09 32,768 -c--a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    - 2008-10-17 08:08:40 3,593,216 -c--a-w c:\windows\system32\dllcache\mshtml.dll
    + 2008-12-13 06:40:02 3,593,216 -c--a-w c:\windows\system32\dllcache\mshtml.dll
    + 2008-11-26 17:15:35 26,944 ----a-w c:\windows\system32\drivers\aavmker4.sys
    + 2008-11-26 17:17:25 20,560 ----a-w c:\windows\system32\drivers\aswFsBlk.sys
    + 2008-11-26 17:18:25 93,296 ----a-w c:\windows\system32\drivers\aswmon.sys
    + 2008-11-26 17:18:18 94,032 ----a-w c:\windows\system32\drivers\aswmon2.sys
    + 2008-11-26 17:16:29 23,152 ----a-w c:\windows\system32\drivers\aswRdr.sys
    + 2008-11-26 17:17:36 111,184 ----a-w c:\windows\system32\drivers\aswSP.sys
    + 2008-11-26 17:16:38 50,864 ----a-w c:\windows\system32\drivers\aswTdi.sys
    + 2008-04-29 16:19:50 12,960 ----a-w c:\windows\system32\drivers\Awrtpd.sys
    + 2008-04-29 16:19:54 15,648 ----a-w c:\windows\system32\drivers\Awrtrd.sys
    + 2008-04-29 16:20:00 15,648 ----a-w c:\windows\system32\drivers\NSDriver.sys
    + 2008-05-16 16:58:04 12,632 ----a-w c:\windows\system32\lsdelete.exe
    - 2008-10-17 08:08:40 3,593,216 ----a-w c:\windows\system32\mshtml.dll
    + 2008-12-13 06:40:02 3,593,216 ----a-w c:\windows\system32\mshtml.dll
    - 2008-12-18 15:08:05 65,446 ----a-w c:\windows\system32\perfc009.dat
    + 2008-12-18 22:20:40 65,446 ----a-w c:\windows\system32\perfc009.dat
    - 2008-12-18 15:08:05 411,142 ----a-w c:\windows\system32\perfh009.dat
    + 2008-12-18 22:20:40 411,142 ----a-w c:\windows\system32\perfh009.dat
    - 2008-12-18 15:35:23 12,651 ----a-w c:\windows\system32\tablet.dat
    + 2008-12-19 05:11:55 12,651 ----a-w c:\windows\system32\tablet.dat
    + 2008-12-19 05:11:36 16,384 ----atw c:\windows\temp\Perflib_Perfdata_38c.dat
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
    @= "{F2F31467-B1AC-4df0-AE79-FD5FA085E22B} "
    [HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
    2007-11-14 11:22 3186440 --a------ c:\program files\Protector Suite QL\farchns.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
    @= "{A3E208F7-0E3A-4182-A7A6-B169D5D691AA} "
    [HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
    2007-11-14 11:22 3186440 --a------ c:\program files\Protector Suite QL\farchns.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
    "swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-16 68856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ThpSrv "= "thpsrv" [X]
    "TabletWizard "= "c:\windows\help\SplshWrp.exe" [2008-04-13 16384]
    "TabletTip "= "c:\program files\Common Files\microsoft shared\ink\tabtip.exe" [2008-04-13 271872]
    "00THotkey "= "c:\windows\system32\00THotkey.exe" [2006-01-17 03:00 258048]
    "CrossMenu "= "c:\program files\Toshiba\CrossMenu\CrossMenu.exe" [2005-09-20 798720]
    "Apoint "= "c:\program files\Apoint2K\Apoint.exe" [2004-03-23 196608]
    "LtMoh "= "c:\program files\ltmoh\Ltmoh.exe" [2004-08-17 184320]
    "TMESRV.EXE "= "c:\program files\TOSHIBA\TME3\TMESRV31.EXE" [2005-12-14 126976]
    "TMERzCtl.EXE "= "c:\program files\TOSHIBA\TME3\TMERzCtl.EXE" [2005-12-20 86016]
    "Kraidman "= "c:\program files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe" [2005-09-30 1126484]
    "TRot.exe "= "c:\program files\TOSHIBA\TOSHIBA Rotation Utility\TRot.exe" [2005-11-29 266240]
    "PINGER "= "c:\toshiba\IVP\ISM\pinger.exe" [2005-03-17 151552]
    "TosHKCW.exe "= "c:\program files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2005-05-17 49152]
    "SmoothView "= "c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-05-23 122880]
    "TouchED "= "c:\program files\TOSHIBA\TouchED\TouchED.Exe" [2005-06-28 126976]
    "TAudEffect "= "c:\program files\TOSHIBA\TAudEffect\TAudEff.exe" [2005-10-05 344144]
    "TAcelMgr "= "c:\program files\TOSHIBA\Acceleration Utilities\TAcelMgr\TAcelMgr.exe" [2004-12-16 90112]
    "TSkrMain "= "c:\program files\TOSHIBA\Acceleration Utilities\Shaker\TSkrMain.exe" [2004-06-30 49152]
    "DLA "= "c:\windows\System32\DLA\DLACTRLW.EXE" [2005-10-06 122940]
    "IntelZeroConfig "= "c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 667718]
    "IntelWireless "= "c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 602182]
    "TDxVGAUTIL "= "c:\windows\system32\TDxVGAUTIL.EXE" [2005-12-19 65536]
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2008-03-28 413696]
    "ISUSScheduler "= "c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 81920]
    "igfxtray "= "c:\windows\system32\igfxtray.exe" [2005-11-27 98304]
    "igfxhkcmd "= "c:\windows\system32\hkcmd.exe" [2005-11-27 77824]
    "igfxpers "= "c:\windows\system32\igfxpers.exe" [2005-11-27 118784]
    "PSQLLauncher "= "c:\program files\Protector Suite QL\launcher.exe" [2007-11-14 49416]
    "SunJavaUpdateSched "= "c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "AdobeCS4ServiceManager "= "c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
    "avast! "= "c:\progra~1\Avast\ashDisp.exe" [2008-11-26 81000]
    "000StTHK "= "000StTHK.exe" [2001-06-23 22:28 24576 c:\windows\system32\000StTHK.exe]
    "AGRSMMSG "= "AGRSMMSG.exe" [2005-10-14 c:\windows\agrsmmsg.exe]
    "NDSTray.exe "= "NDSTray.exe" [BU]
    "TFncKy "= "TFncKy.exe" [BU]
    "TFNF5 "= "TFNF5.exe" [2005-11-09 c:\windows\system32\TFNF5.exe]
    "TPSMain "= "TPSMain.exe" [2005-12-15 c:\windows\system32\TPSMain.exe]
    "TPSODDCtl "= "TPSODDCtl.exe" [2005-12-15 c:\windows\system32\TPSODDCtl.exe]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Pidgin.lnk - c:\program files\Pidgin\pidgin.exe [2007-10-23 44655]
    RAMASST.lnk - c:\windows\system32\RAMASST.exe [2006-01-14 155648]
    TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2007-02-15 114688]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\loginkey]
    2008-04-13 18:11 47104 c:\program files\Common Files\Microsoft Shared\Ink\loginkey.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
    2007-11-14 11:07 96008 c:\windows\system32\psqlpwd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TabBtnWL]
    2002-08-29 05:41 11776 c:\windows\system32\tabbtnwl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpgwlnotify]
    2008-04-13 18:12 32256 c:\windows\system32\tpgwlnot.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TSigNP]
    2005-12-28 00:05 53248 c:\windows\system32\TSigNP.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "midi3 "= xgusb.cpl

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Notification Packages REG_MULTI_SZ scecli psqlpwd

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe "=
    "c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe "=
    "c:\\WINDOWS\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Descent 3\\main.exe "=
    "c:\\Program Files\\Warcraft III\\Warcraft III.exe "=
    "c:\\Program Files\\WS_FTP\\WS_FTP95.exe "=
    "c:\\Program Files\\LimeWire\\LimeWire.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "c:\\Program Files\\Macromedia\\Fireworks MX\\Fireworks.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\Pidgin\\pidgin.exe "=
    "c:\\Program Files\\Swift 3D\\Program\\Swift3D.exe "=
    "c:\\Program Files\\Adobe\\Adobe Flash CS3\\Flash.exe "=
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "500:UDP "= 500:UDP:Cisco VPN Client
    "5353:TCP "= 5353:TCP:Adobe CSI CS4

    R0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys [2004-12-28 16384]
    R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS [2006-01-15 6144]
    R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-18 111184]
    R1 TMEI3E;TMEI3E;c:\windows\system32\Drivers\TMEI3E.SYS [2006-01-15 5888]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-12-18 20560]
    R2 Tmesrv;Tmesrv3; "c:\program files\TOSHIBA\TME3\Tmesrv31.exe" /Service [2006-01-15 126976]
    R3 IFXTPM;IFXTPM;c:\windows\system32\DRIVERS\IFXTPM.SYS [2006-01-14 35968]
    R3 TBtnKey;TOSHIBA Tablet PC Buttons Type N HID Driver;c:\windows\system32\DRIVERS\TBtnKey.sys [2006-01-15 8832]
    R3 TdxMrMINI;TdxMrMINI;c:\windows\system32\DRIVERS\TdxMrMini.sys [2006-09-04 233984]
    R3 TdxVGAMINI;TdxVGAMINI;c:\windows\system32\DRIVERS\TdxVgaMini.sys [2006-09-04 234496]
    R3 WacomISDPen;Wacom Penabled HID MiniDriver;c:\windows\system32\DRIVERS\wacomisdpen.sys [2006-04-06 23040]
    S2 FdRedir;FdRedir;\??\c:\program files\Common Files\Protector Suite QL\Drivers\FdRedir.sys []
    S2 smihlp;SMI helper driver;\??\c:\program files\Protector Suite QL\smihlp.sys []
    S3 ADM851X;ADM851X USB To Fast Ethernet Adapter;c:\windows\system32\DRIVERS\ADM851X.SYS [2006-09-04 27135]
    S3 dump_wmimmc;dump_wmimmc;\??\c:\program files\Maple Story\GameGuard\dump_wmimmc.sys []
    S3 TdxVGAUSB;TARGUS USB2.0 VGA DOCK DEVICE(USB);c:\windows\system32\drivers\TdxVGAUSB.sys [2006-09-04 22528]
    S3 TEchoCan;Toshiba Audio Effect;c:\windows\system32\DRIVERS\TEchoCan.sys [2006-01-15 595072]
    S3 WacomPen;Wacom Serial Pen HID Driver;c:\windows\system32\DRIVERS\wacompen.sys [2006-01-14 14208]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94b628c3-9783-11db-959e-0013025eb404}]
    \Shell\AutoRun\command - E:\LaunchU3.exe -a
    .
    Contents of the 'Scheduled Tasks' folder

    2008-12-18 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]

    2006-06-12 c:\windows\Tasks\Registration reminder 3.job
    - c:\windows\system32\OOBE\oobebaln.exe [2008-04-13 18:12]

    2008-12-05 c:\windows\Tasks\Uniblue SpeedUpMyPC Nag.job
    - c:\program files\SpeedUpMyPC 3\SpeedUpMyPC.exe []

    2008-08-07 c:\windows\Tasks\Uniblue SpeedUpMyPC.job
    - c:\program files\SpeedUpMyPC 3\SpeedUpMyPC.exe []
    .
    - - - - ORPHANS REMOVED - - - -

    Notify-NavLogon - (no file)


    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uSearch Page = hxxp://www.google.com
    uWindow Title = Windows Internet Explorer provided by Comcast
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uSearch Bar = hxxp://www.google.com/ie
    mDefault_Page_URL = hxxp://www.comcast.net
    mStart Page = hxxp://www.comcast.net
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    mSearchAssistant = hxxp://www.google.com/ie
    IE: &Save Flash In This Page by Flash Saver - c:\progra~1\FLASHS~1\save.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    IE: Google AdSense Preview Tool - http://pagead2.googlesyndication.com/pagead/preview/en/preview.html
    FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\2hgw5j25.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
    FF - component: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\2hgw5j25.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
    FF - component: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\2hgw5j25.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\metricsloader.dll
    FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0\npctrl.dll

    ATTENTION: FIREFOX POLICES IS IN FORCE
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.rights.version ", 3);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.rights.3.shown ", false);
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-18 23:14:40
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(1272)
    c:\windows\system32\psqlpwd.dll
    c:\program files\Protector Suite QL\homefus2.dll
    c:\program files\Protector Suite QL\infql2.dll
    c:\program files\Protector Suite QL\homepass.dll
    c:\program files\Protector Suite QL\bio.dll
    c:\program files\Protector Suite QL\qlbase.dll
    c:\windows\system32\TSigNP.dll
    c:\program files\Protector Suite QL\biokmd.dll
    c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
    c:\program files\Protector Suite QL\otp.dll
    c:\program files\Protector Suite QL\psqltray.dll

    - - - - - - - > 'lsass.exe'(1328)
    c:\windows\system32\psqlpwd.dll
    c:\program files\Protector Suite QL\homefus2.dll
    c:\program files\Protector Suite QL\infql2.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Intel\Wireless\Bin\EvtEng.exe
    c:\program files\Common Files\Microsoft Shared\Ink\keyboardsurrogate.exe
    c:\program files\Intel\Wireless\Bin\S24EvMon.exe
    c:\program files\Ad-Aware\aawservice.exe
    c:\program files\Avast\aswUpdSv.exe
    c:\program files\Avast\ashServ.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Toshiba\ConfigFree\CFSvcs.exe
    c:\program files\Cisco Systems\VPN Client\cvpnd.exe
    c:\windows\system32\DVDRAMSV.exe
    c:\program files\Toshiba\TOSHIBA RAID\Service\kraidsvc.exe
    c:\windows\system32\PSIService.exe
    c:\program files\Intel\Wireless\Bin\RegSrvc.exe
    c:\toshiba\IVP\swupdate\swupdtmr.exe
    c:\program files\Toshiba\TOSHIBA RAID\Service\krdevctl.exe
    c:\windows\system32\Tablet.exe
    c:\windows\system32\ThpSrv.exe
    c:\windows\system32\TODDSrv.exe
    c:\program files\Avast\ashMaiSv.exe
    c:\program files\Avast\ashWebSv.exe
    c:\windows\system32\wisptis.exe
    c:\windows\system32\tabbtnu.exe
    c:\program files\Common Files\Microsoft Shared\Ink\tcserver.exe
    c:\program files\Toshiba\ConfigFree\NDSTray.exe
    c:\program files\Toshiba\TOSHIBA Controls\TFncKy.exe
    c:\windows\system32\ThpSrv.exe
    c:\program files\Toshiba\TME3\TMETEMnu.exe
    c:\program files\Apoint2K\ApntEx.exe
    c:\windows\system32\TPSBattM.exe
    c:\program files\Protector Suite QL\psqltray.exe
    c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe
    .
    **************************************************************************
    .
    Completion time: 2008-12-18 23:20:57 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-12-19 05:20:54
    ComboFix2.txt 2008-12-18 15:42:21

    Pre-Run: 52,578,471,936 bytes free
    Post-Run: 52,567,908,352 bytes free

    339 --- E O F --- 2008-12-18 21:05:27
     
    Kajenx,
    #6
  8. 2008/12/19
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Looks good. Please do an online scan with Kaspersky Online Scanner

    Click Accept, when prompted to download and install the program files and database of malware definitions.
    • Click Run at the Security prompt.
    • The program will then begin downloading and installing and will also update the database.
    • Please be patient as this can take several minutes.
    • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
    • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
    • Click View scan report at the bottom.
    • Click the Save Report As... button.
    • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
    **Note**

    To optimize scanning time and produce a more sensible report for review:
    • Close any open programs.
    • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

    Post the Kaspersky log here.
     
    noahdfear,
    #7
  9. 2008/12/20
    Kajenx

    Kajenx Inactive Thread Starter

    Joined:
    2008/12/16
    Messages:
    6
    Likes Received:
    0
    Wow, that took a long time. Here's the log:

    --------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER 7 REPORT
    Saturday, December 20, 2008
    Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Friday, December 19, 2008 22:53:41
    Records in database: 1489151
    --------------------------------------------------------------------------------

    Scan settings:
    Scan using the following database: extended
    Scan archives: yes
    Scan mail databases: yes

    Scan area - My Computer:
    C:\
    D:\

    Scan statistics:
    Files scanned: 162049
    Threat name: 3
    Infected objects: 4
    Suspicious objects: 0
    Duration of the scan: 05:05:46


    File name / Threat name / Threats count
    C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\42\50a912ea-7d792b9d Infected: Trojan-Downloader.Java.OpenStream.ac 1
    C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\6.0\54\46a4d9b6-40ea48d3 Infected: Exploit.Java.ByteVerify 1
    C:\Documents and Settings\Owner\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\OP.jar-17cc0c8a-4b7613ef.zip Infected: Trojan-Downloader.Java.OpenStream.ac 1
    C:\Documents and Settings\Owner\My Documents\Warcraft\Zips\wc3namespooferPro.zip Infected: Trojan.Win32.Agent.fuc 1

    The selected area was scanned.
     
    Kajenx,
    #8
  10. 2008/12/21
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Recommend you delete the following infected file.

    C:\Documents and Settings\Owner\My Documents\Warcraft\Zips\wc3namespooferPro.zip

    Open the Java Plug-in in the Control Panel and delete the temporary files. Then download JavaRa and save the file to your desktop.
    • Right click and Extract All
    • Once extracted, open and run JavaRa.exe
    • Click Search For Updates
    • Select Update Using jucheck.exe
    • Click Search
    • If a newer version is found, allow it to be installed
    • When complete, click Remove Older Versions in the JavaRa interface and allow it to proceed
    • When that is complete, click Additional Tasks, then select Remove Useless JRE Files and click Go
    • Exit the tool when complete.


    Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing any infected files there as well.
    Verify the C:\Qoobox and C:\ComboFix folders were removed, as well as the C:\ComboFix.txt file.
    You can delete any other logs that were created/saved too.
    Go ahead and remove RSIT.exe and the C:\rsit folder too, then empty the recycle bin.

    That should wrap things up. Everything working properly?
     
    noahdfear,
    #9
  11. 2008/12/22
    Kajenx

    Kajenx Inactive Thread Starter

    Joined:
    2008/12/16
    Messages:
    6
    Likes Received:
    0
    Yes, everything looks/works great! Thanks for all the help, I really appreciate it!
     
    Kajenx,
    #10
  12. 2008/12/22
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    noahdfear,
    #11

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...