Active Windows is slow ! Internet acts abnormal

[Active] Windows is slow ! Internet acts abnormal

Hi

From the last couple of days, my laptop is not working good. It was Windows XP wiht SP 3.

When I run any browser (Chrome, IE, FF) first it works ok, but after I visited about 2-3 pages, its got stuck. Nothing works, I cant refresh the browser, new pages do not opens, skype cant open and everything is stopped. And I have to press ALTER + CONTROL + DELETE To open the task manager and then I remove all the browsers instances and skype etc, and then i can start the itnernet again (for the same duration like 2-3 pages and then hang !!!)

I am posting the logs in my next message:

 

DDS (Ver_09-12-01.01) - NTFSx86
Run by Zeeshan Hashmi at 9:14:00.06 on Mon 03/08/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_07
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.502.138 [GMT 5:00]

AV: McAfee VirusScan *On-access scanning enabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall Plus *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
c:\PROGRA~1\mcafee.com\mps\mscifapp.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKAgent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Mindjet\MindManager 8\MMReminderService.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
c:\program files\mcafee.com\shared\mghtml.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Documents and Settings\Zeeshan Hashmi\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = about:blank
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\reader 8.0\activex\AcroIEHelper.dll
BHO: McBrwHelper Class: {227b8aa8-daf2-4892-bd1d-73f568bcb24e} - c:\progra~1\mcafee.com\mps\mcbrhlpr.dll
BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
BHO: McAfee Privacy Service Popup Blocker: {3ec8255f-e043-4cae-8b3b-b191550c2a22} - c:\program files\mcafee.com\mps\popupkiller.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: CmjBrowserHelperObject Object: {6fe6a929-59d1-4763-91ad-29b61cffb35b} - c:\program files\mindjet\mindmanager 8\Mm8InternetExplorer.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.4723.1820\swg.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
TB: McAfee VirusScan: {ba52b914-b692-46c4-b683-905236f6f655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [MSKAGENTEXE] c:\progra~1\mcafee\spamki~1\MSKAgent.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe "
uRun: [Google Update] "c:\documents and settings\zeeshan hashmi\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\Wcescomm.exe "
mRun: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
mRun: [Acrobat Assistant 7.0] "c:\program files\adobe\acrobat 7.0\distillr\Acrotray.exe "
mRun: [<NO NAME>]
mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe "
mRun: [VSOCheckTask] "c:\progra~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
mRun: [VirusScan Online] c:\program files\mcafee.com\vso\mcvsshld.exe
mRun: [MCAgentExe] c:\progra~1\mcafee.com\agent\mcagent.exe
mRun: [MCUpdateExe] c:\progra~1\mcafee.com\agent\McUpdate.exe
mRun: [MPSExe] c:\progra~1\mcafee.com\mps\mscifapp.exe /embedding
mRun: [MSKAGENTEXE] c:\progra~1\mcafee\spamki~1\MSKAgent.exe
mRun: [MSKDetectorExe] c:\progra~1\mcafee\spamki~1\MskDetct.exe /startup
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [MPFExe] c:\progra~1\mcafee.com\person~1\MpfTray.exe
mRun: [OASClnt] c:\program files\mcafee.com\vso\oasclnt.exe
mRun: [MMReminderService] c:\program files\mindjet\mindmanager 8\MMReminderService.exe
mRun: [googletalk] c:\program files\google\google talk\googletalk.exe /autostart
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobea~1.lnk - c:\windows\installer\{ac76ba86-1033-0000-7760-000000000002}\SC_Acrobat.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\reader 8.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~2.lnk - c:\program files\adobe\reader 8.0\reader\AdobeCollabSync.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\monito~1.lnk - c:\program files\apache software foundation\apache2.2\bin\ApacheMonitor.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\servic~1.lnk - c:\program files\microsoft sql server\80\tools\binn\sqlmangr.exe
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\micros~4\INetRepl.dll
IE: {2F72393D-2472-4F82-B600-ED77F354B7FF} - {6FE6A929-59D1-4763-91AD-29B61CFFB35B} - c:\program files\mindjet\mindmanager 8\Mm8InternetExplorer.dll
IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
LSP: c:\windows\system32\mclsp.dll
DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} - hxxp://www.worldwinner.com/games/v50/pool/pool.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab56649.cab
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} - hxxp://zone.msn.com/bingame/zpagames/zpa_pool.cab56649.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
Notify: LMIinit - LMIinit.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\zeesha~1\applic~1\mozilla\firefox\profiles\i2th74tw.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\documents and settings\zeeshan hashmi\application data\mozilla\firefox\profiles\i2th74tw.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\documents and settings\zeeshan hashmi\application data\mozilla\firefox\profiles\i2th74tw.default\extensions\iaplayer@instantaction.com\plugins\npiaplayer.dll
FF - plugin: c:\documents and settings\zeeshan hashmi\local settings\application data\google\update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\google\update\1.2.183.17\npGoogleOneClick8.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R1 MPFIREWL;MPFIREWL;c:\windows\system32\drivers\MpFirewall.sys [2007-12-23 67584]
R2 Apache2.2;Apache2.2;c:\program files\apache software foundation\apache2.2\bin\httpd.exe [2009-8-6 24645]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2007-8-1 46112]
R2 McDetect.exe;McAfee WSC Integration;c:\program files\mcafee.com\agent\Mcdetect.exe [2008-6-3 126976]
R2 McShield;McAfee.com McShield;c:\progra~1\mcafee.com\vso\mcshield.exe [2007-12-23 221184]
R2 McTskshd.exe;McAfee Task Scheduler;c:\progra~1\mcafee.com\agent\mctskshd.exe [2008-6-3 122368]
R3 NaiAvFilter1;NaiAvFilter1;c:\windows\system32\drivers\naiavf5x.sys [2008-6-3 114464]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-23 135664]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\logmein\x86\rainfo.sys --> c:\program files\logmein\x86\RaInfo.sys [?]
S3 cur_bus;Curitel USB Composite Device driver (WDM);c:\windows\system32\drivers\cur_bus.sys [2007-5-26 52384]
S3 cur_mdfl;Curitel Packet Service Filter;c:\windows\system32\drivers\cur_mdfl.sys [2007-5-26 6096]
S3 cur_mdm;Curitel Packet Service Drivers;c:\windows\system32\drivers\cur_mdm.sys [2007-5-26 84384]
S3 cur_serd;Curitel Packet Service Diagnostic Serial Port (WDM);c:\windows\system32\drivers\cur_serd.sys [2007-5-26 66048]
S3 mcupdmgr.exe;McAfee SecurityCenter Update Manager;c:\progra~1\mcafee.com\agent\mcupdmgr.exe [2007-12-23 245760]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

=============== Created Last 30 ================

2010-03-02 11:22:40 0 d-----w- c:\program files\Microsoft

==================== Find3M ====================


============= FINISH: 9:14:42.32 ===============

 

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 12/23/2007 9:08:49 PM
System Uptime: 3/8/2010 8:35:07 AM (1 hours ago)

Motherboard: Quanta | | 30BB
Processor: Intel(R) Celeron(R) M CPU 430 @ 1.73GHz | U2E1 | 1729/533mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 81 GiB total, 72.463 GiB free.
D: is FIXED (FAT32) - 12 GiB total, 1.072 GiB free.
E: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: ACPI\HPQ0006\4&38462492&0
Manufacturer:
Name:
PNP Device ID: ACPI\HPQ0006\4&38462492&0
Service:

==== System Restore Points ===================

RP119: 2/23/2010 11:43:10 AM - System Checkpoint
RP120: 2/24/2010 11:45:25 AM - System Checkpoint
RP121: 2/25/2010 6:50:18 PM - System Checkpoint
RP122: 2/26/2010 6:58:07 PM - System Checkpoint
RP123: 3/1/2010 10:33:15 AM - System Checkpoint
RP124: 3/2/2010 11:29:28 AM - System Checkpoint
RP125: 3/2/2010 4:39:43 PM - Installed Microsoft Office Visio Viewer 2003 (English)
RP126: 3/3/2010 5:36:15 PM - System Checkpoint
RP127: 3/5/2010 11:44:05 AM - System Checkpoint
RP128: 3/6/2010 2:11:23 PM - System Checkpoint
RP129: 3/7/2010 8:44:47 PM - System Checkpoint

==== Installed Programs ======================

Adobe Acrobat 7.0 Professional
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Photoshop CS2
Adobe Reader 8
Adobe Shockwave Player 11.5
Apache HTTP Server 2.2.13
Broadcom 802.11 Wireless LAN Adapter
Bullzip MS Access to MySQL 3.0.0.108
CamStudio
Compatibility Pack for the 2007 Office system
Conexant HD Audio
Curitel Packet Service Software
DeleteHistoryFree
Expresso
FileZilla Client 3.2.6.1
Google Chrome
Google Gmail Notifier
Google Talk (remove only)
Google Toolbar for Internet Explorer
Google Update Helper
HardBall 6 Demo
Hot CPU Tester Pro 4.4.1
Hotfix for Windows XP (KB909394)
Hotfix for Windows XP (KB942288-v3)
HP BatteryCheck 1.00 A7
Intel(R) Graphics Media Accelerator Driver
Intel(R) PRO Network Connections Drivers
Java(TM) 6 Update 7
Junk Mail filter update
Macromedia Dreamweaver 8
Macromedia Extension Manager
McAfee Personal Firewall Plus
McAfee Privacy Service
McAfee SecurityCenter
McAfee Shredder
McAfee SpamKiller
McAfee VirusScan
Microsoft .NET Framework 2.0
Microsoft ActiveSync
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office Visio Viewer 2003 (English)
Microsoft Office XP Professional with FrontPage
Microsoft Silverlight
Microsoft SQL Server 2000
Microsoft Visual C++ 2005 Redistributable
Mindjet MindManager 8
Morefunc
Mozilla Firefox (3.0.18)
MSVCRT
MSXML 6.0 Parser
MySQL Server 5.0
MySQL Tools for 5.0
OpenOffice.org Installer 1.0
PDF-XChange 3
pgAdmin III 1.8
PHP 5.2.9-2
Segoe UI
Skype web features
Skype™ 4.1
Skype™ for Windows Mobile 2.5
Soft Data Fax Modem with SmartCP
Software Update for Web Folders
VLC media player 1.0.1
Windows Genuine Advantage Validation Tool (KB892130)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
WinRAR archiver
WinSCP 4.0.5
WinUHA 2.0 RC1 (2005.02.27)
Yahoo! Browser Services
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Messenger

==== Event Viewer Messages From Past Week ========

3/7/2010 10:58:04 PM, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 001636A361B8 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
3/7/2010 10:54:21 PM, error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{E6EE474A-7644-4BF0-854F-7FFB21237C27} because another computer on the network has the same name. The server could not start.
3/7/2010 10:37:09 PM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
3/7/2010 10:37:05 PM, error: Dhcp [1002] - The IP address lease 192.168.1.3 for the Network Card with network address 001636A361B8 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
3/7/2010 10:35:04 AM, error: Service Control Manager [7024] - The Background Intelligent Transfer Service service terminated with service-specific error 2147952450 (0x80072742).
3/5/2010 8:21:10 PM, error: Dhcp [1002] - The IP address lease 192.168.1.2 for the Network Card with network address 0014A5D25410 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
3/2/2010 10:15:59 AM, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service winmgmt with arguments " " in order to run the server: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
3/2/2010 10:15:59 AM, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
3/2/2010 10:15:59 AM, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
3/2/2010 10:15:59 AM, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service BITS with arguments " " in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}
3/1/2010 9:35:12 PM, error: Service Control Manager [7023] - The IPSEC Services service terminated with the following error: The attempted operation is not supported for the type of object referenced.
3/1/2010 9:31:52 AM, error: Service Control Manager [7024] - The Apache2.2 service terminated with service-specific error 1 (0x1).
3/1/2010 9:31:52 AM, error: Service Control Manager [7001] - The World Wide Web Publishing service depends on the IIS Admin service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
3/1/2010 9:31:52 AM, error: Service Control Manager [7001] - The Simple Mail Transfer Protocol (SMTP) service depends on the IIS Admin service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
3/1/2010 9:31:52 AM, error: Service Control Manager [7000] - The LogMeIn Kernel Information Provider service failed to start due to the following error: The system cannot find the path specified.
3/1/2010 4:39:22 PM, error: Tcpip [4199] - The system detected an address conflict for IP address 192.168.1.2 with the system having network hardware address 00:191:9D:4B:36. Network operations on this system may be disrupted as a result.
3/1/2010 3:14:59 PM, error: i8042prt [22] - Could not set the mouse sample rate.
3/1/2010 10:33:15 AM, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service IISADMIN with arguments " " in order to run the server: {A9E69610-B80D-11D0-B9B9-00A0C922E750}

==== End Of File ===========================

 

Hi

Thanks for your reply.

Here is what I did:

1) I downloaded Malwarebytes' Anti-Malware,
2) Installed and then RUN for the first time, (Launch and Update)
3) MAM is Hanged !
4) I renamed the MAM file to scan.exe
5) I run it again using explorer.
6) it started and I click on scan.
7) Scan completed and found 3 infections, and click on Remove Selected.
8) it HANGED AGAIN, i tried to remove it from Task Manger and still not removed and the sceeen is showing no progress and just "Not Responding" in the title !

Please suggest what to do ?

 

ComboFix 10-03-08.01 - Zeeshan Hashmi 03/08/2010 22:34:33.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.502.161 [GMT 5:00]
Running from: c:\documents and settings\Zeeshan Hashmi\Desktop\Naats\ComboFix.exe
AV: McAfee VirusScan *On-access scanning enabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: Personal Firewall Plus *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Cache
c:\windows\system32\temp2.exe

.
((((((((((((((((((((((((( Files Created from 2010-02-08 to 2010-03-08 )))))))))))))))))))))))))))))))
.

2010-03-08 07:38 . 2010-03-08 07:38 -------- d-----w- c:\documents and settings\Zeeshan Hashmi\Application Data\Malwarebytes
2010-03-08 07:38 . 2010-01-07 11:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-08 07:38 . 2010-03-08 07:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-08 07:38 . 2010-01-07 11:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-02 11:39 . 2010-03-02 11:39 -------- d-----r- C:\MSOCache
2010-03-02 11:22 . 2010-03-02 11:22 -------- d-----w- c:\program files\Microsoft
2010-03-01 06:46 . 2010-03-01 06:46 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-02-23 11:31 . 2010-02-23 11:31 -------- d-----w- c:\program files\Common Files\Skype
2010-02-19 10:39 . 2009-12-16 09:42 43008 ----a-w- c:\documents and settings\Zeeshan Hashmi\Application Data\Mozilla\Firefox\Profiles\i2th74tw.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-02-19 10:39 . 2009-12-16 09:42 340480 ----a-w- c:\documents and settings\Zeeshan Hashmi\Application Data\Mozilla\Firefox\Profiles\i2th74tw.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-02-19 10:39 . 2009-12-16 09:42 872960 ----a-w- c:\documents and settings\Zeeshan Hashmi\Application Data\Mozilla\Firefox\Profiles\i2th74tw.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-02-19 10:39 . 2009-12-16 09:41 346624 ----a-w- c:\documents and settings\Zeeshan Hashmi\Application Data\Mozilla\Firefox\Profiles\i2th74tw.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-08 17:28 . 2007-11-14 14:25 -------- d-----w- c:\documents and settings\Zeeshan Hashmi\Application Data\Skype
2010-03-08 16:57 . 2008-12-22 12:28 -------- d-----w- c:\documents and settings\Zeeshan Hashmi\Application Data\FileZilla
2010-03-08 12:39 . 2008-12-27 18:06 -------- d-----w- c:\documents and settings\Zeeshan Hashmi\Application Data\skypePM
2010-03-03 04:40 . 2009-05-23 19:28 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-26 15:15 . 2009-08-04 14:03 -------- d-----w- c:\documents and settings\Zeeshan Hashmi\Application Data\vlc
2010-02-23 18:38 . 2007-06-06 03:46 -------- d-----w- c:\program files\Google
2010-02-23 11:31 . 2009-06-25 11:54 -------- d-----r- c:\program files\Skype
2010-02-23 11:30 . 2007-11-14 14:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSKAGENTEXE "= "c:\progra~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-03-23 126976]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-30 68856]
"Google Update "= "c:\documents and settings\Zeeshan Hashmi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-01-01 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut "= "CHDAudPropShortcut.exe" [2007-12-23 61952]
"Acrobat Assistant 7.0 "= "c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2007-12-23 483328]
"VSOCheckTask "= "c:\progra~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 151552]
"VirusScan Online "= "c:\program files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 163840]
"MCAgentExe "= "c:\progra~1\mcafee.com\agent\mcagent.exe" [2005-09-22 303104]
"MCUpdateExe "= "c:\progra~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 212992]
"MPSExe "= "c:\progra~1\mcafee.com\mps\mscifapp.exe" [2005-05-24 274432]
"MSKAGENTEXE "= "c:\progra~1\McAfee\SPAMKI~1\MSKAgent.exe" [2005-03-23 126976]
"MSKDetectorExe "= "c:\progra~1\McAfee\SPAMKI~1\MskDetct.exe" [2005-03-23 1111040]
"igfxtray "= "c:\windows\System32\igfxtray.exe" [2006-03-22 94208]
"igfxhkcmd "= "c:\windows\System32\hkcmd.exe" [2006-03-22 77824]
"igfxpers "= "c:\windows\System32\igfxpers.exe" [2006-03-22 118784]
"MPFExe "= "c:\progra~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-04-05 950272]
"OASClnt "= "c:\program files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 53248]
"MMReminderService "= "c:\program files\Mindjet\MindManager 8\MMReminderService.exe" [2008-12-11 37656]
"googletalk "= "c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-7-22 25214]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-8-11 40448]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-8-10 745472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 86016]
Monitor Apache Servers.lnk - c:\program files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe [2009-8-6 41051]
Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2007-5-25 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2007-05-25 10:22 63040 ----a-w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring "=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\program files\Microsoft ActiveSync\WCESMgr.exe "= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0isabled:ActiveSync Application
"c:\program files\Microsoft ActiveSync\wcescomm.exe "= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0isabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\rapimgr.exe "= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0isabled:ActiveSync RAPI Manager
"c:\\WINDOWS\\system32\\sessmgr.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe "=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP "= 26675:TCP:169.254.2.0/255.255.255.0isabled:ActiveSync Service

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [8/1/2007 8:09 PM 46112]
S2 Apache2.2;Apache2.2;c:\program files\Apache Software Foundation\Apache2.2\bin\httpd.exe [8/6/2009 3:50 PM 24645]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/23/2010 11:38 PM 135664]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?]
S3 cur_bus;Curitel USB Composite Device driver (WDM);c:\windows\system32\drivers\cur_bus.sys [5/26/2007 1:00 PM 52384]
S3 cur_mdfl;Curitel Packet Service Filter;c:\windows\system32\drivers\cur_mdfl.sys [5/26/2007 1:00 PM 6096]
S3 cur_mdm;Curitel Packet Service Drivers;c:\windows\system32\drivers\cur_mdm.sys [5/26/2007 1:00 PM 84384]
S3 cur_serd;Curitel Packet Service Diagnostic Serial Port (WDM);c:\windows\system32\drivers\cur_serd.sys [5/26/2007 1:00 PM 66048]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [3/8/2010 12:38 PM 38224]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
.
Contents of the 'Scheduled Tasks' folder

2010-03-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 18:38]

2010-03-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 18:38]

2010-03-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-152049171-725345543-1003Core.job
- c:\documents and settings\Zeeshan Hashmi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-01 17:22]

2010-03-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-152049171-725345543-1003UA.job
- c:\documents and settings\Zeeshan Hashmi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-01 17:22]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
LSP: c:\windows\system32\mclsp.dll
FF - ProfilePath - c:\documents and settings\Zeeshan Hashmi\Application Data\Mozilla\Firefox\Profiles\i2th74tw.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\documents and settings\Zeeshan Hashmi\Application Data\Mozilla\Firefox\Profiles\i2th74tw.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\documents and settings\Zeeshan Hashmi\Application Data\Mozilla\Firefox\Profiles\i2th74tw.default\extensions\iaplayer@instantaction.com\plugins\npiaplayer.dll
FF - plugin: c:\documents and settings\Zeeshan Hashmi\Local Settings\Application Data\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-LogMeIn GUI - c:\program files\LogMeIn\x86\LogMeInSystray.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-08 22:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\MySQL]
"ImagePath "= "\ "c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\ "c:\program files\MySQL\MySQL Server 5.0\my.ini\" MySQL "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\TelnetServer\1.0\ReadConfig]
@DACL=(02 0000)
"Defaults "=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(516)
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
c:\windows\system32\igfxdev.dll

- - - - - - - > 'lsass.exe'(572)
c:\windows\system32\mclsp.dll
c:\windows\system32\SPORDER.dll
c:\windows\system32\mclsphlr\gdlsphlr.dll
c:\windows\system32\McRtl32.dll
.
Completion time: 2010-03-08 22:43:12
ComboFix-quarantined-files.txt 2010-03-08 17:42

Pre-Run: 77,829,472,256 bytes free
Post-Run: 78,367,604,736 bytes free

- - End Of File - - 83B9FE7C4C29DA15F44643A73EAE4F72

 

Hi

Is it mandatory to install that Microsoft Recovery thing ? I checked its like 544MBs of data. I tried many times, but my any application (Browsers, MSN, Skype) anything that uses internet get hang every 15-20 minutes.

Please help

 

I tried to download, etc, but all my applications that interacts with internet gets hanged after 15-20 minutes so i cant download the file as again and again it hangs when it is half downloaded.

 

okay I am trying that and will post the results here.

 

Hi

Here is the result :

1) I downloaded the software, and run it, it started setup and finally update the software !

2) I perform Quick Scan, and this ended up with 3 infections.

3) I click on show results, and then Remove Selected and then it is in NOT RESPONDING state.

Please have a look at the attached image.

 

Here are the logs : first logs.txt

ComboFix 10-03-16.03 - Zeeshan Hashmi 03/17/2010 9:32.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.502.124 [GMT 5:00]
Running from: c:\documents and settings\Zeeshan Hashmi\Desktop\Naats\ComboFix.exe
Command switches used :: c:\documents and settings\Zeeshan Hashmi\Desktop\Naats\CFScript.txt
AV: McAfee VirusScan *On-access scanning enabled* (Outdated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall Plus *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

FILE ::
"c:\windows\system32\msnsc.exe "
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\eSellerateEngine.dll
c:\windows\system32\msnsc.exe

.
((((((((((((((((((((((((( Files Created from 2010-02-17 to 2010-03-17 )))))))))))))))))))))))))))))))
.

2010-03-13 12:16 . 2010-03-16 17:55 -------- d-----w- c:\documents and settings\Zeeshan Hashmi\Application Data\Apple Computer
2010-03-13 12:16 . 2009-05-18 09:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2010-03-13 12:16 . 2008-04-17 08:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
2010-03-13 12:14 . 2010-03-13 12:14 -------- d-----w- c:\program files\iPod
2010-03-13 12:14 . 2010-03-13 12:16 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2010-03-13 12:13 . 2010-03-13 12:13 -------- d-----w- c:\program files\Bonjour
2010-03-13 12:12 . 2010-03-13 12:13 -------- d-----w- c:\program files\QuickTime
2010-03-13 12:12 . 2010-03-13 12:12 -------- d-----w- c:\documents and settings\Zeeshan Hashmi\Local Settings\Application Data\Apple
2010-03-13 12:11 . 2010-03-13 12:11 -------- d-----w- c:\program files\Apple Software Update
2010-03-13 12:11 . 2010-03-13 12:16 -------- dc----w- c:\windows\system32\DRVSTORE
2010-03-13 12:10 . 2010-03-13 12:14 -------- d-----w- c:\program files\Common Files\Apple
2010-03-13 12:10 . 2010-03-13 12:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-03-08 07:38 . 2010-03-08 07:38 -------- d-----w- c:\documents and settings\Zeeshan Hashmi\Application Data\Malwarebytes
2010-03-08 07:38 . 2010-01-07 11:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-08 07:38 . 2010-03-08 07:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-08 07:38 . 2010-01-07 11:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-03-02 11:39 . 2010-03-02 11:39 -------- d-----r- C:\MSOCache
2010-03-02 11:22 . 2010-03-02 11:22 -------- d-----w- c:\program files\Microsoft
2010-03-01 06:46 . 2010-03-01 06:46 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-02-23 11:31 . 2010-02-23 11:31 -------- d-----w- c:\program files\Common Files\Skype
2010-02-19 10:39 . 2009-12-16 09:42 43008 ----a-w- c:\documents and settings\Zeeshan Hashmi\Application Data\Mozilla\Firefox\Profiles\i2th74tw.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2010-02-19 10:39 . 2009-12-16 09:42 340480 ----a-w- c:\documents and settings\Zeeshan Hashmi\Application Data\Mozilla\Firefox\Profiles\i2th74tw.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2010-02-19 10:39 . 2009-12-16 09:42 872960 ----a-w- c:\documents and settings\Zeeshan Hashmi\Application Data\Mozilla\Firefox\Profiles\i2th74tw.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2010-02-19 10:39 . 2009-12-16 09:41 346624 ----a-w- c:\documents and settings\Zeeshan Hashmi\Application Data\Mozilla\Firefox\Profiles\i2th74tw.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2010-02-15 13:41 . 2010-02-15 13:41 72488 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-16 18:48 . 2007-11-14 14:25 -------- d-----w- c:\documents and settings\Zeeshan Hashmi\Application Data\Skype
2010-03-16 17:11 . 2008-12-27 18:06 -------- d-----w- c:\documents and settings\Zeeshan Hashmi\Application Data\skypePM
2010-03-15 04:42 . 2008-12-22 12:28 -------- d-----w- c:\documents and settings\Zeeshan Hashmi\Application Data\FileZilla
2010-03-15 04:38 . 2008-12-22 12:28 -------- d-----w- c:\program files\FileZilla FTP Client
2010-03-13 12:14 . 2007-08-07 14:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-03-03 04:40 . 2009-05-23 19:28 -------- d-----w- c:\program files\Microsoft Silverlight
2010-02-26 15:15 . 2009-08-04 14:03 -------- d-----w- c:\documents and settings\Zeeshan Hashmi\Application Data\vlc
2010-02-23 18:38 . 2007-06-06 03:46 -------- d-----w- c:\program files\Google
2010-02-23 11:31 . 2009-06-25 11:54 -------- d-----r- c:\program files\Skype
2010-02-23 11:30 . 2007-11-14 14:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
.

((((((((((((((((((((((((((((( SnapShot@2010-03-08_17.41.19 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-17 02:24 . 2010-03-17 02:24 16384 c:\windows\temp\Perflib_Perfdata_788.dat
+ 2010-03-13 12:11 . 2009-08-28 14:42 40448 c:\windows\system32\DRVSTORE\usbaapl_6DA28B91FF48C57089E4D2436654AFA4ECAD0622\usbaapl.sys
+ 2010-03-13 12:11 . 2009-08-28 14:42 17408 c:\windows\system32\DRVSTORE\netaapl_F433E854B3FF3BEE74986FDE8E16A64162342BFF\netaapl.sys
+ 2010-03-13 12:16 . 2009-05-18 09:17 26600 c:\windows\system32\DRVSTORE\GEARAspiWD_3B7AACF0636A2C042EB7AD2AFF76D37B27BDD28C\x86\GEARAspiWDM.sys
+ 2008-12-12 06:11 . 2008-12-12 06:11 61440 c:\windows\system32\dnssd.dll
+ 2008-12-12 06:18 . 2008-12-12 06:18 87336 c:\windows\system32\dns-sd.exe
- 2007-05-25 04:39 . 2010-03-08 03:37 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2007-05-25 04:39 . 2010-03-17 02:23 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2010-03-17 02:24 . 2010-03-17 02:24 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012010031720100318\index.dat
+ 2010-03-16 03:50 . 2010-03-16 03:50 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012010031620100317\index.dat
+ 2010-03-09 03:18 . 2010-03-09 03:18 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012010030920100310\index.dat
+ 2007-05-25 04:39 . 2010-03-17 02:23 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-05-25 04:39 . 2010-03-08 03:37 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-03-09 03:17 . 2010-03-17 02:23 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2007-05-25 04:39 . 2010-03-08 03:37 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-03-13 12:12 . 2010-03-13 12:12 27136 c:\windows\Installer\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}\AppleSoftwareUpdateIco.exe
+ 2010-03-13 12:13 . 2010-03-13 12:13 86016 c:\windows\Installer\{07287123-B8AC-41CE-8346-3D777245C35B}\PrntWzrdIco.exe
+ 2009-07-11 20:12 . 2009-07-11 20:12 632656 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll
+ 2009-07-11 20:09 . 2009-07-11 20:09 554832 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcp80.dll
+ 2009-07-11 20:08 . 2009-07-11 20:08 479232 c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcm80.dll
+ 2010-03-13 12:16 . 2008-04-17 08:12 107368 c:\windows\system32\DRVSTORE\GEARAspiWD_3B7AACF0636A2C042EB7AD2AFF76D37B27BDD28C\x86\GEARAspi.dll
+ 2010-03-13 12:10 . 2010-03-13 12:10 796672 c:\windows\Installer\1f525b9.msi
+ 2010-03-13 12:17 . 2010-03-13 12:17 102400 c:\windows\Installer\{81063354-9060-42B2-A000-1EBE96778AA9}\iTunesIco.exe
+ 2010-03-13 12:11 . 2009-08-28 14:42 2065696 c:\windows\system32\DRVSTORE\usbaapl_6DA28B91FF48C57089E4D2436654AFA4ECAD0622\usbaaplrc.dll
+ 2010-03-13 12:11 . 2009-08-28 14:42 1417504 c:\windows\system32\DRVSTORE\netaapl_F433E854B3FF3BEE74986FDE8E16A64162342BFF\wdfcoinstaller01005.dll
+ 2010-03-13 12:17 . 2010-03-13 12:17 4449280 c:\windows\Installer\1f525d9.msi
+ 2010-03-13 12:13 . 2010-03-13 12:13 1659392 c:\windows\Installer\1f525d5.msi
+ 2010-03-13 12:13 . 2010-03-13 12:13 9473024 c:\windows\Installer\1f525ce.msi
+ 2010-03-13 12:12 . 2010-03-13 12:12 1549312 c:\windows\Installer\1f525c7.msi
+ 2010-03-13 12:11 . 2010-03-13 12:11 3310592 c:\windows\Installer\1f525c0.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSKAGENTEXE "= "c:\progra~1\McAfee\SPAMKI~1\MSKAgent.exe" [2005-03-23 126976]
"swg "= "c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-30 68856]
"Google Update "= "c:\documents and settings\Zeeshan Hashmi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-01-01 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"High Definition Audio Property Page Shortcut "= "CHDAudPropShortcut.exe" [2007-12-23 61952]
"Acrobat Assistant 7.0 "= "c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2007-12-23 483328]
"VSOCheckTask "= "c:\progra~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 151552]
"VirusScan Online "= "c:\program files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 163840]
"MCAgentExe "= "c:\progra~1\mcafee.com\agent\mcagent.exe" [2005-09-22 303104]
"MCUpdateExe "= "c:\progra~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 212992]
"MPSExe "= "c:\progra~1\mcafee.com\mps\mscifapp.exe" [2005-05-24 274432]
"MSKAGENTEXE "= "c:\progra~1\McAfee\SPAMKI~1\MSKAgent.exe" [2005-03-23 126976]
"MSKDetectorExe "= "c:\progra~1\McAfee\SPAMKI~1\MskDetct.exe" [2005-03-23 1111040]
"igfxtray "= "c:\windows\System32\igfxtray.exe" [2006-03-22 94208]
"igfxhkcmd "= "c:\windows\System32\hkcmd.exe" [2006-03-22 77824]
"igfxpers "= "c:\windows\System32\igfxpers.exe" [2006-03-22 118784]
"MPFExe "= "c:\progra~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-04-05 950272]
"OASClnt "= "c:\program files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 53248]
"MMReminderService "= "c:\program files\Mindjet\MindManager 8\MMReminderService.exe" [2008-12-11 37656]
"googletalk "= "c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper "= "d:\program files\iTunes\iTunesHelper.exe" [2010-02-15 141608]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2007-7-22 25214]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-8-11 40448]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-8-10 745472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 86016]
Monitor Apache Servers.lnk - c:\program files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe [2009-8-6 41051]
Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2007-5-25 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2007-05-25 10:22 63040 ----a-w- c:\windows\system32\LMIinit.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\program files\Microsoft ActiveSync\WCESMgr.exe "= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0isabled:ActiveSync Application
"c:\program files\Microsoft ActiveSync\wcescomm.exe "= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0isabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\rapimgr.exe "= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0isabled:ActiveSync RAPI Manager
"c:\\WINDOWS\\system32\\sessmgr.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe "=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe "=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"d:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Skype\\Phone\\Skype.exe "=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP "= 26675:TCP:169.254.2.0/255.255.255.0isabled:ActiveSync Service

R2 Apache2.2;Apache2.2;c:\program files\Apache Software Foundation\Apache2.2\bin\httpd.exe [8/6/2009 3:50 PM 24645]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [3/8/2010 12:38 PM 38224]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/23/2010 11:38 PM 135664]
S2 LMIInfo;LogMeIn Kernel Information Provider;\??\c:\program files\LogMeIn\x86\RaInfo.sys --> c:\program files\LogMeIn\x86\RaInfo.sys [?]
S3 cur_bus;Curitel USB Composite Device driver (WDM);c:\windows\system32\drivers\cur_bus.sys [5/26/2007 1:00 PM 52384]
S3 cur_mdfl;Curitel Packet Service Filter;c:\windows\system32\drivers\cur_mdfl.sys [5/26/2007 1:00 PM 6096]
S3 cur_mdm;Curitel Packet Service Drivers;c:\windows\system32\drivers\cur_mdm.sys [5/26/2007 1:00 PM 84384]
S3 cur_serd;Curitel Packet Service Diagnostic Serial Port (WDM);c:\windows\system32\drivers\cur_serd.sys [5/26/2007 1:00 PM 66048]
.
Contents of the 'Scheduled Tasks' folder

2010-03-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 18:38]

2010-03-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 18:38]

2010-03-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-152049171-725345543-1003Core.job
- c:\documents and settings\Zeeshan Hashmi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-01 17:22]

2010-03-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1085031214-152049171-725345543-1003UA.job
- c:\documents and settings\Zeeshan Hashmi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-01-01 17:22]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
LSP: c:\windows\system32\mclsp.dll
FF - ProfilePath - c:\documents and settings\Zeeshan Hashmi\Application Data\Mozilla\Firefox\Profiles\i2th74tw.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\documents and settings\Zeeshan Hashmi\Application Data\Mozilla\Firefox\Profiles\i2th74tw.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - plugin: c:\documents and settings\Zeeshan Hashmi\Application Data\Mozilla\Firefox\Profiles\i2th74tw.default\extensions\iaplayer@instantaction.com\plugins\npiaplayer.dll
FF - plugin: c:\documents and settings\Zeeshan Hashmi\Local Settings\Application Data\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: d:\program files\iTunes\Mozilla Plugins\npitunes.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_popup_windows ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.enable_click_image_resizing ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "accessibility.browsewithcaret_shortcut.enabled ", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "javascript.options.mem.high_water_mark ", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "javascript.options.mem.gc_frequency ", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.trackpoint_hack.enabled ", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.debug ", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.agedWeight ", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.bucketSize ", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.maxTimeGroupings ", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.timeGroupingSize ", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.boundaryWeight ", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "browser.formfill.prefixWeight ", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref( "html5.enable ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "app.update.download.backgroundInterval ", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "app.update.url.manual ", "http://www.firefox.com ");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref( "browser.search.param.yahoo-fr-ja ", "mozff ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add ", "addons.mozilla.org ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "xpinstall.whitelist.add.36 ", "getpersonas.com ");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "lightweightThemes.update.enabled ", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.allTabs.previews ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.hide_infobar_for_outdated_plugin ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "toolbar.customization.usesheet ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.enable ", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.max ", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "browser.taskbar.previews.cachetime ", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-17 09:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\MySQL]
"ImagePath "= "\ "c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\ "c:\program files\MySQL\MySQL Server 5.0\my.ini\" MySQL "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\TelnetServer\1.0\ReadConfig]
@DACL=(02 0000)
"Defaults "=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(520)
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
c:\windows\system32\igfxdev.dll

- - - - - - - > 'lsass.exe'(576)
c:\windows\system32\mclsp.dll
c:\windows\system32\SPORDER.dll
c:\windows\system32\mclsphlr\gdlsphlr.dll
c:\windows\system32\McRtl32.dll
.
Completion time: 2010-03-17 09:37:51
ComboFix-quarantined-files.txt 2010-03-17 04:37
ComboFix2.txt 2010-03-08 17:43

Pre-Run: 77,707,599,872 bytes free
Post-Run: 77,780,140,032 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 8AEDD988628EA84B563269400FA5FB49

 

okay thanks , I am following those instructions, but what if the browser (internet) with the Kaspersky WEbsite gets hanged again ?