Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Latest News: The Week in Ransomware - April 20th 2018 - Reveton Charges, GandCrab, and More

Featured Deal: Get 96% off the MCSA SQL Server Training Deal

Trying to remove udxfytw.sys

Started by jdguymon , Dec 13 2008 06:17 PM

This topic is locked

12 replies to this topic

#1 jdguymon

Members
6 posts
OFFLINE

Local time:01:13 AM

Posted 13 December 2008 - 06:17 PM

I have been trying to remove udxfytw.sys. I've managed to stop the process, so sounds are not still randomly occuring, however, I don't think I've gotten everything totally clean. The scans are still showing infection.
Posted below are both the kaspersky and RSIT logs. Thanks for any help you can offer.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, December 9, 2008
Operating System: Microsoft Windows 2000 Professional Service Pack 4 (build 2195)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, December 09, 2008 02:08:27
Records in database: 1445114
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\

Scan statistics:
Files scanned: 95937
Threat name: 7
Infected objects: 23
Suspicious objects: 0
Duration of the scan: 02:01:29

File name / Threat name / Threats count
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\G1MF0XY7\smain[1].php Infected: Trojan-Downloader.JS.Psyme.amg 1
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\G1MF0XY7\smain[2].php Infected: Trojan-Downloader.JS.Psyme.amg 1
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\G1MF0XY7\smain[3].php Infected: Trojan-Downloader.JS.Psyme.amg 1
C:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Content.IE5\IAVG5MKR\placeholder-1301916-572418144[1] Infected: Trojan-Downloader.JS.Psyme.amg 1
C:\Documents and Settings\Jeff Guymon\Desktop\MultiMedia\PgcEdit_install.exe Infected: not-a-virus:RiskTool.Win32.PsKill.k 1
C:\WINNT\system32\tmpxr_158618242174.bk Infected: Trojan.Win32.Agent.astn 1
C:\WINNT\system32\tmpxr_268128408325.bk Infected: Trojan.Win32.Agent.aqfq 1
C:\WINNT\system32\tmpxr_427141892459.bk Infected: Trojan.Win32.Agent.aqfq 1
C:\WINNT\system32\tmpxr_461821137132.bk Infected: Trojan.Win32.Agent.aqfq 1
C:\WINNT\system32\tmpxr_475613109801.bk Infected: Trojan.Win32.Agent.aqfq 1
C:\WINNT\system32\tmpxr_488321185830.bk Infected: Trojan.Win32.Agent.aqfq 1
C:\WINNT\system32\tmpxr_505848220557.bk Infected: Trojan.Win32.Agent.astn 1
C:\WINNT\system32\tmpxr_54862416073.bk Infected: Trojan.Win32.Agent.aqfq 1
C:\WINNT\system32\tmpxr_648854209698.bk Infected: Trojan.Win32.Agent.aqfq 1
C:\WINNT\system32\tmpxr_810622586013.bk Infected: Trojan.Win32.Agent.astn 1
C:\WINNT\system32\tmpxr_858065764191.bk Infected: Trojan.Win32.Agent.aqfq 1
C:\WINNT\system32\tmpxr_882573730860.bk Infected: Trojan.Win32.Agent.aqfq 1
C:\WINNT\system32\tmpxr_91901448108.bk Infected: Trojan.Win32.Agent.aqfq 1
C:\WINNT\system32\udxfytw-bak.sys Infected: Trojan.Win32.Agent.aohb 1
C:\WINNT\system32\udxfytw.sys Infected: Trojan.Win32.Agent.aouc 1
E:\Downloads\DVD Apps.zip Infected: not-a-virus:RiskTool.Win32.PsKill.k 1
E:\Downloads\WindowsXP\WinXPkeyChanger.exe Infected: not-a-virus:PSWTool.Win32.RAS.a 2

The selected area was scanned.

___________________________________________________________________

Logfile of random's system information tool 1.04 (written by random/random)
Run by Jeff Guymon at 2008-12-09 06:57:22
Microsoft Windows 2000 Professional Service Pack 4
System drive C: has 32 GB (73%) free of 44 GB
Total RAM: 1023 MB (65% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:57:26 AM, on 12/9/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\htpatch.exe
C:\WINNT\system32\PROMon.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\WINNT\SM1BG.EXE
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\system32\RUNDLL32.EXE
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Documents and Settings\Jeff Guymon\Desktop\RSIT.exe
C:\Program Files\trend micro\Jeff Guymon.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HTpatch] C:\WINNT\htpatch.exe
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [SM1BG] C:\WINNT\SM1BG.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClockEx\TCLOCKEX.EXE
O4 - HKCU\..\Run: [EPSON Stylus Photo R260 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE /FU "C:\WINNT\TEMP\E_S9F.tmp" /EF "HKCU"
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1150047754953
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://www.samsphotoclub.com/upload/FujifilmUploadClient.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe
O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
O23 - Service: afisicx - Unknown owner - C:\WINNT\system32\afisicx.exe (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: noytcyr - Unknown owner - C:\WINNT\system32\noytcyr.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: roytctm - Unknown owner - C:\WINNT\system32\roytctm.exe (file missing)
O23 - Service: tdydowkc - Unknown owner - C:\WINNT\system32\tdydowkc.exe (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: wsldoekd - Unknown owner - C:\WINNT\system32\wsldoekd.exe (file missing)

--
End of file - 8138 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll [2003-11-03 54248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-08-14 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-07 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [2003-05-15 147456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-07 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-07 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467} - @msdxmLC.dll,-1@1033,&Radio - C:\WINNT\System32\msdxm.ocx [2005-03-31 844560]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [2003-05-15 147456]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"=mobsync.exe /logon []
"HTpatch"=C:\WINNT\htpatch.exe [2002-10-30 28672]
"PROMon.exe"=C:\WINNT\system32\PROMon.exe [2002-04-18 73728]
"NvCplDaemon"=C:\WINNT\system32\NvCpl.dll [2006-10-22 7700480]
"nwiz"=nwiz.exe /install []
"Omnipage"=C:\Program Files\ScanSoft\OmniPageSE\opware32.exe [2002-06-03 49152]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2006-06-14 282624]
"RoxioDragToDisc"=C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe [2004-01-27 1179648]
"SM1BG"=C:\WINNT\SM1BG.EXE [2003-08-27 94208]
"SoundMan"=C:\WINNT\SOUNDMAN.EXE [2002-11-19 46592]
"NvMediaCenter"=C:\WINNT\system32\NvMcTray.dll [2006-10-22 86016]
"Logitech Hardware Abstraction Layer"=C:\WINNT\KHALMNPR.EXE [2006-07-19 94208]
"ShStatEXE"=C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE [2006-11-30 112216]
"McAfeeUpdaterUI"=C:\Program Files\McAfee\Common Framework\UdaterUI.exe [2006-11-17 136768]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-12-07 136600]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"TClockEx"=C:\Program Files\TClockEx\TCLOCKEX.EXE [2000-03-09 89088]
"EPSON Stylus Photo R260 Series"=C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE [2006-05-18 139264]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\nwprovau]
C:\WINNT\system32\nwprovau.dll [2006-08-31 140048]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=149

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2008-12-08 22:47:23 ----D---- C:\rsit
2008-12-08 22:47:23 ----D---- C:\Program Files\trend micro
2008-12-07 21:14:03 ----D---- C:\Documents and Settings\Jeff Guymon\Application Data\Malwarebytes
2008-12-07 21:13:58 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-12-07 21:13:58 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\javaws.exe
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\javaw.exe
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\java.exe
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\deploytk.dll
2008-12-07 20:09:56 ----D---- C:\Program Files\Java
2008-11-23 19:12:40 ----HDC---- C:\WINNT\$NtUninstallKB957097$
2008-11-23 19:12:25 ----HDC---- C:\WINNT\$NtUninstallKB955069$
2008-11-23 19:11:28 ----HDC---- C:\WINNT\$NtUninstallKB956390-IE6SP1-20080820.120000$
2008-11-23 19:11:20 ----HDC---- C:\WINNT\$NtUninstallKB957095$
2008-11-23 19:11:14 ----HDC---- C:\WINNT\$NtUninstallKB956391$
2008-11-23 19:11:03 ----HDC---- C:\WINNT\$NtUninstallKB954211$
2008-11-23 19:01:28 ----HDC---- C:\WINNT\$NtUninstallKB938464-IE6SP1-20080429.120000$
2008-11-23 18:59:56 ----HDC---- C:\WINNT\$NtUninstallKB952954$
2008-11-23 18:59:51 ----HDC---- C:\WINNT\$NtUninstallKB950974$
2008-11-23 18:59:42 ----HDC---- C:\WINNT\$NtUninstallKB951066-OE6SP1-20080625.120000$
2008-11-23 18:59:34 ----HDC---- C:\WINNT\$NtUninstallKB951748$
2008-11-23 18:58:58 ----HDC---- C:\WINNT\$NtUninstallKB951698_DX9$
2008-11-23 18:54:09 ----HDC---- C:\WINNT\$NtUninstallKB950749$
2008-11-23 18:54:02 ----HDC---- C:\WINNT\$NtUninstallKB944338$
2008-11-23 18:53:27 ----HDC---- C:\WINNT\$NtUninstallKB948590$
2008-11-23 18:53:21 ----HDC---- C:\WINNT\$NtUninstallKB945553$
2008-11-23 18:52:49 ----HDC---- C:\WINNT\$NtUninstallKB943055$
2008-11-23 18:51:56 ----HDC---- C:\WINNT\$NtUninstallKB943485$
2008-11-23 18:51:47 ----HDC---- C:\WINNT\$NtUninstallKB937894$
2008-11-23 18:50:59 ----HDC---- C:\WINNT\$NtUninstallKB941569$
2008-11-23 18:50:51 ----HDC---- C:\WINNT\$NtUninstallKB923810$
2008-11-23 18:50:46 ----HDC---- C:\WINNT\$NtUninstallKB933729$
2008-11-23 18:50:40 ----HDC---- C:\WINNT\$NtUninstallKB938827$
2008-11-23 18:50:30 ----A---- C:\WINNT\system32\wmpns.dll
2008-11-23 18:50:24 ----HDC---- C:\WINNT\$NtUninstallKB936782_WMP9$
2008-11-23 18:50:17 ----HDC---- C:\WINNT\$NtUninstallKB926122$
2008-11-23 18:50:12 ----HDC---- C:\WINNT\$NtUninstallKB935839$
2008-11-23 18:50:06 ----HDC---- C:\WINNT\$NtUninstallKB935840$
2008-11-23 18:49:59 ----HDC---- C:\WINNT\$NtUninstallKB927891$
2008-11-23 14:38:10 ----HDC---- C:\WINNT\$NtUninstallKB958644$
2008-11-23 00:35:50 ----D---- C:\WINNT\ERUNT
2008-11-23 00:32:06 ----A---- C:\WINNT\ntbtlog.txt
2008-11-21 20:21:13 ----D---- C:\Program Files\TeaTimer (Spybot - Search & Destroy)
2008-11-21 20:21:13 ----D---- C:\Program Files\SDHelper (Spybot - Search & Destroy)

======List of files/folders modified in the last 1 months======

2008-12-09 06:57:22 ----D---- C:\WINNT\system32
2008-12-09 06:57:04 ----AD---- C:\WINNT\Debug
2008-12-09 06:55:41 ----AD---- C:\WINNT\Temp
2008-12-09 06:53:03 ----A---- C:\WINNT\SchedLgU.Txt
2008-12-09 06:39:28 ----AD---- C:\WINNT\security
2008-12-08 23:12:20 ----D---- C:\WINNT\system32\NtmsData
2008-12-08 22:47:23 ----RAD---- C:\Program Files
2008-12-07 21:35:24 ----AD---- C:\WINNT\system32\drivers
2008-12-07 21:32:40 ----AD---- C:\WINNT
2008-12-07 20:53:21 ----D---- C:\Quarantine
2008-12-07 20:11:29 ----SHD---- C:\WINNT\Installer
2008-12-07 19:59:47 ----AD---- C:\Program Files\Common Files
2008-12-07 19:40:23 ----A---- C:\WINNT\wininit.ini
2008-12-04 19:07:59 ----D---- C:\Documents and Settings\Jeff Guymon\Application Data\Identities
2008-12-04 18:59:22 ----A---- C:\WINNT\KA.INI
2008-12-04 18:59:01 ----D---- C:\KA
2008-11-23 21:17:53 ----AD---- C:\WINNT\system32\wbem
2008-11-23 21:17:53 ----A---- C:\WINNT\system32\PerfStringBackup.INI
2008-11-23 19:20:32 ----RASHDC---- C:\WINNT\system32\dllcache
2008-11-23 19:20:31 ----AD---- C:\WINNT\system32\Setup
2008-11-23 19:20:31 ----AD---- C:\WINNT\msagent
2008-11-23 19:14:31 ----D---- C:\WINNT\Microsoft.NET
2008-11-23 19:12:45 ----HD---- C:\WINNT\inf
2008-11-23 19:12:30 ----A---- C:\WINNT\imsins.BAK
2008-11-23 19:10:23 ----A---- C:\WINNT\win.ini
2008-11-23 19:08:29 ----D---- C:\WINNT\Registration
2008-11-23 19:07:25 ----AD---- C:\WINNT\system32\mui
2008-11-23 19:07:24 ----D---- C:\Program Files\Internet Explorer
2008-11-23 18:59:47 ----D---- C:\Program Files\Common Files\System
2008-11-23 18:59:46 ----D---- C:\Program Files\Outlook Express
2008-11-23 18:57:20 ----RASD---- C:\WINNT\Fonts
2008-11-23 18:56:42 ----AD---- C:\Program Files\Common Files\Microsoft Shared
2008-11-23 18:54:28 ----D---- C:\WINNT\winsxs
2008-11-22 11:51:26 ----SHD---- C:\WINNT\CSC
2008-11-21 20:27:17 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-11-21 16:46:07 ----AD---- C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-11-21 16:46:05 ----D---- C:\Documents and Settings\Jeff Guymon\Application Data\ZoomBrowser EX
2008-11-20 15:26:28 ----AD---- C:\WINNT\Help
2008-11-19 01:44:51 ----D---- C:\WINNT\Minidump
2008-11-18 14:06:57 ----A---- C:\WINNT\ODBC.INI
2008-11-17 10:05:54 ----AD---- C:\Documents and Settings

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Cdr4_2K;Cdr4_2K; C:\WINNT\system32\drivers\Cdr4_2K.sys [2004-01-27 43008]
R1 Cdralw2k;Cdralw2k; C:\WINNT\system32\drivers\Cdralw2k.sys [2004-01-27 24576]
R1 cdudf;cdudf; C:\WINNT\system32\drivers\cdudf.sys [2004-01-27 284928]
R1 DVDVRRdr;DVDVRRdr; C:\WINNT\system32\drivers\DVDVRRdr.sys [2004-01-27 140416]
R1 mferkdk;VSCore mferkdk; \??\C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys []
R1 mfetdik;McAfee Inc.; C:\WINNT\system32\drivers\mfetdik.sys [2006-11-30 52136]
R1 pwd_2k;pwd_2k; C:\WINNT\system32\drivers\pwd_2k.sys [2004-01-27 117248]
R1 UDFReadr;UDFReadr; C:\WINNT\system32\drivers\UDFReadr.sys [2004-01-27 197632]
R2 LBeepKE;LBeepKE; C:\WINNT\System32\Drivers\LBeepKE.sys [2006-09-01 3712]
R2 Nbf;NetBEUI Protocol; C:\WINNT\System32\DRIVERS\nbf.sys [2001-05-08 102160]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINNT\system32\drivers\ALCXWDM.SYS [2002-11-26 730700]
R3 dvd_2K;dvd_2K; C:\WINNT\system32\drivers\dvd_2K.sys [2004-01-27 23680]
R3 E1000;Intel® PRO/1000 Adapter Driver; C:\WINNT\System32\DRIVERS\e1000nt5.sys [2002-05-05 103680]
R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINNT\system32\DRIVERS\L8042Kbd.sys [2006-07-19 13568]
R3 L8042mou;SetPoint PS/2 Mouse Filter Driver; C:\WINNT\system32\DRIVERS\L8042mou.Sys [2006-07-19 55936]
R3 LMouKE;SetPoint Mouse Filter Driver; C:\WINNT\system32\DRIVERS\LMouKE.Sys [2006-07-19 71936]
R3 mfeapfk;McAfee Inc.; C:\WINNT\system32\drivers\mfeapfk.sys [2006-11-30 64360]
R3 mfeavfk;McAfee Inc.; C:\WINNT\system32\drivers\mfeavfk.sys [2006-11-30 72264]
R3 mfebopk;McAfee Inc.; C:\WINNT\system32\drivers\mfebopk.sys [2006-11-30 34152]
R3 mfehidk;McAfee Inc.; C:\WINNT\system32\drivers\mfehidk.sys [2006-11-30 168776]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINNT\system32\drivers\msmpu401.sys [1999-09-25 2832]
R3 nv;nv; C:\WINNT\System32\DRIVERS\nv4_mini.sys [2006-10-22 3994624]
R3 openhci;Microsoft USB Open Host Controller Driver; C:\WINNT\System32\DRIVERS\openhci.sys [2003-06-19 24784]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINNT\System32\DRIVERS\usbehci.sys [2003-06-19 19728]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINNT\System32\DRIVERS\usbhub.sys [2003-06-19 40176]
R3 usbhub20;USB Hub Support; C:\WINNT\System32\DRIVERS\usbhub20.sys [2003-06-19 49776]
S3 CCDECODE;Closed Caption Decoder; C:\WINNT\system32\DRIVERS\CCDECODE.sys [2004-07-09 16384]
S3 cmuda;C-Media WDM Audio Interface; C:\WINNT\system32\drivers\cmuda.sys []
S3 mmc_2K;mmc_2K; C:\WINNT\system32\drivers\mmc_2K.sys [2004-01-27 23680]
S3 MPE;BDA MPE Filter; C:\WINNT\system32\DRIVERS\MPE.sys [2004-07-09 15104]
S3 MSDV;Microsoft DV Camera and VCR; C:\WINNT\System32\DRIVERS\msdv.sys [2004-07-09 56832]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINNT\system32\drivers\MSTEE.sys [2002-12-12 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINNT\system32\DRIVERS\NABTSFEC.sys [2004-07-09 83968]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINNT\system32\DRIVERS\NdisIP.sys [2004-07-09 10112]
S3 SLIP;BDA Slip De-Framer; C:\WINNT\system32\DRIVERS\SLIP.sys [2004-07-09 10880]
S3 streamip;BDA IPSink; C:\WINNT\system32\DRIVERS\StreamIP.sys [2004-07-09 14976]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINNT\System32\DRIVERS\usbprint.sys [2003-06-19 21872]
S3 usbscan;USB Scanner Driver; C:\WINNT\System32\DRIVERS\usbscan.sys [2003-06-19 12592]
S3 USBSTOR;USB Mass Storage Driver; C:\WINNT\System32\DRIVERS\USBSTOR.SYS [2003-06-19 21552]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINNT\system32\DRIVERS\WSTCODEC.SYS [2004-07-09 18688]
S4 IntelIde;IntelIde; C:\WINNT\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 awfgzrzf;awfgzrzf; C:\WINNT\system32\svchost.exe [2001-05-08 7952]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-07 152984]
R2 McAfeeFramework;McAfee Framework Service; C:\Program Files\McAfee\Common Framework\FrameworkService.exe [2006-11-17 104000]
R2 McShield;McAfee McShield; C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe [2006-11-30 144960]
R2 McTaskManager;McAfee Task Manager; C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe [2006-11-30 54872]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINNT\system32\nvsvc32.exe [2006-10-22 159810]
R2 StiSvc;Still Image Service; C:\WINNT\system32\stisvc.exe [2003-06-19 61712]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2003-12-04 49152]
S2 afisicx;afisicx; C:\WINNT\system32\afisicx.exe []
S2 NMSSvc;Intel® NMS; C:\WINNT\System32\NMSSvc.exe [2002-05-03 1118208]
S2 noytcyr;noytcyr; C:\WINNT\system32\noytcyr.exe []
S2 roytctm;roytctm; C:\WINNT\system32\roytctm.exe []
S2 tdydowkc;tdydowkc; C:\WINNT\system32\tdydowkc.exe []
S2 wsldoekd;wsldoekd; C:\WINNT\system32\wsldoekd.exe []
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINNT\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WmdmPmSN;Portable Media Serial Number Service; C:\WINNT\System32\svchost.exe [2001-05-08 7952]

-----------------EOF-----------------

BC AdBot (Login to Remove)

BleepingComputer.com
Register to remove ads

#2 teacup61

Bleepin' Texan!

Malware Response Team
17,075 posts
OFFLINE

Gender:Female
Location:Wills Point, Texas
Local time:03:13 AM

Posted 21 December 2008 - 02:47 PM

Hello jdguymon,

Posted Image

Sorry about the delay. :thumbsup:

If you still need help, please post a new HijackThis log to make sure nothing has changed, and I'll be happy to look at it for you.

Thanks,
tea

Please make a donation so I can keep helping people just like you.
Every little bit helps!
You can even use your credit card! Thank you!

Error reading poptart in Drive A: Delete kids y/n?

#3 jdguymon

Topic Starter

Members
6 posts
OFFLINE

Local time:01:13 AM

Posted 21 December 2008 - 05:21 PM

Yes, I still could use some help. Here is an updated HiJack log (I didn't rerun the kaspersky log):

Logfile of random's system information tool 1.04 (written by random/random)
Run by Jeff Guymon at 2008-12-21 15:15:52
Microsoft Windows 2000 Professional Service Pack 4
System drive C: has 32 GB (72%) free of 44 GB
Total RAM: 1023 MB (42% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:15:56 PM, on 12/21/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\htpatch.exe
C:\WINNT\system32\PROMon.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\WINNT\SM1BG.EXE
C:\WINNT\SOUNDMAN.EXE
C:\WINNT\system32\RUNDLL32.EXE
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Jeff Guymon\Desktop\RSIT.exe
C:\Program Files\trend micro\Jeff Guymon.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HTpatch] C:\WINNT\htpatch.exe
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [SM1BG] C:\WINNT\SM1BG.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClockEx\TCLOCKEX.EXE
O4 - HKCU\..\Run: [EPSON Stylus Photo R260 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE /FU "C:\WINNT\TEMP\E_S9F.tmp" /EF "HKCU"
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1150047754953
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://www.samsphotoclub.com/upload/FujifilmUploadClient.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe
O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
O23 - Service: afisicx - Unknown owner - C:\WINNT\system32\afisicx.exe (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: noytcyr - Unknown owner - C:\WINNT\system32\noytcyr.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: roytctm - Unknown owner - C:\WINNT\system32\roytctm.exe (file missing)
O23 - Service: tdydowkc - Unknown owner - C:\WINNT\system32\tdydowkc.exe (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: wsldoekd - Unknown owner - C:\WINNT\system32\wsldoekd.exe (file missing)

--
End of file - 8342 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll [2003-11-03 54248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-08-14 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-07 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [2003-05-15 147456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-07 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-07 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467} - @msdxmLC.dll,-1@1033,&Radio - C:\WINNT\System32\msdxm.ocx [2005-03-31 844560]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [2003-05-15 147456]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"=mobsync.exe /logon []
"HTpatch"=C:\WINNT\htpatch.exe [2002-10-30 28672]
"PROMon.exe"=C:\WINNT\system32\PROMon.exe [2002-04-18 73728]
"NvCplDaemon"=C:\WINNT\system32\NvCpl.dll [2006-10-22 7700480]
"nwiz"=nwiz.exe /install []
"Omnipage"=C:\Program Files\ScanSoft\OmniPageSE\opware32.exe [2002-06-03 49152]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2006-06-14 282624]
"RoxioDragToDisc"=C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe [2004-01-27 1179648]
"SM1BG"=C:\WINNT\SM1BG.EXE [2003-08-27 94208]
"SoundMan"=C:\WINNT\SOUNDMAN.EXE [2002-11-19 46592]
"NvMediaCenter"=C:\WINNT\system32\NvMcTray.dll [2006-10-22 86016]
"Logitech Hardware Abstraction Layer"=C:\WINNT\KHALMNPR.EXE [2006-07-19 94208]
"ShStatEXE"=C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE [2006-11-30 112216]
"McAfeeUpdaterUI"=C:\Program Files\McAfee\Common Framework\UdaterUI.exe [2006-11-17 136768]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-12-07 136600]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"TClockEx"=C:\Program Files\TClockEx\TCLOCKEX.EXE [2000-03-09 89088]
"EPSON Stylus Photo R260 Series"=C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE [2006-05-18 139264]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\nwprovau]
C:\WINNT\system32\nwprovau.dll [2006-08-31 140048]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=149

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2008-12-18 06:36:54 ----HDC---- C:\WINNT\$NtUninstallKB960714-IE6SP1-20081211.120000$
2008-12-11 08:02:24 ----HDC---- C:\WINNT\$NtUninstallKB952069_WM71$
2008-12-11 08:01:50 ----HDC---- C:\WINNT\$NtUninstallKB954600_WM41$
2008-12-11 08:01:35 ----HDC---- C:\WINNT\$NtUninstallKB958215-IE6SP1-20081016.120000$
2008-12-11 08:00:44 ----HDC---- C:\WINNT\$NtUninstallKB956802$
2008-12-10 23:03:00 ----A---- C:\WINNT\system32\MSHTML.DLL
2008-12-08 22:47:23 ----D---- C:\rsit
2008-12-08 22:47:23 ----D---- C:\Program Files\trend micro
2008-12-07 21:14:03 ----D---- C:\Documents and Settings\Jeff Guymon\Application Data\Malwarebytes
2008-12-07 21:13:58 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-12-07 21:13:58 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\javaws.exe
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\javaw.exe
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\java.exe
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\deploytk.dll
2008-12-07 20:09:56 ----D---- C:\Program Files\Java
2008-11-23 19:12:40 ----HDC---- C:\WINNT\$NtUninstallKB957097$
2008-11-23 19:12:25 ----HDC---- C:\WINNT\$NtUninstallKB955069$
2008-11-23 19:11:28 ----HDC---- C:\WINNT\$NtUninstallKB956390-IE6SP1-20080820.120000$
2008-11-23 19:11:20 ----HDC---- C:\WINNT\$NtUninstallKB957095$
2008-11-23 19:11:14 ----HDC---- C:\WINNT\$NtUninstallKB956391$
2008-11-23 19:11:03 ----HDC---- C:\WINNT\$NtUninstallKB954211$
2008-11-23 19:01:28 ----HDC---- C:\WINNT\$NtUninstallKB938464-IE6SP1-20080429.120000$
2008-11-23 18:59:56 ----HDC---- C:\WINNT\$NtUninstallKB952954$
2008-11-23 18:59:51 ----HDC---- C:\WINNT\$NtUninstallKB950974$
2008-11-23 18:59:42 ----HDC---- C:\WINNT\$NtUninstallKB951066-OE6SP1-20080625.120000$
2008-11-23 18:59:34 ----HDC---- C:\WINNT\$NtUninstallKB951748$
2008-11-23 18:58:58 ----HDC---- C:\WINNT\$NtUninstallKB951698_DX9$
2008-11-23 18:54:09 ----HDC---- C:\WINNT\$NtUninstallKB950749$
2008-11-23 18:54:02 ----HDC---- C:\WINNT\$NtUninstallKB944338$
2008-11-23 18:53:27 ----HDC---- C:\WINNT\$NtUninstallKB948590$
2008-11-23 18:53:21 ----HDC---- C:\WINNT\$NtUninstallKB945553$
2008-11-23 18:52:49 ----HDC---- C:\WINNT\$NtUninstallKB943055$
2008-11-23 18:51:56 ----HDC---- C:\WINNT\$NtUninstallKB943485$
2008-11-23 18:51:47 ----HDC---- C:\WINNT\$NtUninstallKB937894$
2008-11-23 18:50:59 ----HDC---- C:\WINNT\$NtUninstallKB941569$
2008-11-23 18:50:51 ----HDC---- C:\WINNT\$NtUninstallKB923810$
2008-11-23 18:50:46 ----HDC---- C:\WINNT\$NtUninstallKB933729$
2008-11-23 18:50:40 ----HDC---- C:\WINNT\$NtUninstallKB938827$
2008-11-23 18:50:30 ----A---- C:\WINNT\system32\wmpns.dll
2008-11-23 18:50:24 ----HDC---- C:\WINNT\$NtUninstallKB936782_WMP9$
2008-11-23 18:50:17 ----HDC---- C:\WINNT\$NtUninstallKB926122$
2008-11-23 18:50:12 ----HDC---- C:\WINNT\$NtUninstallKB935839$
2008-11-23 18:50:06 ----HDC---- C:\WINNT\$NtUninstallKB935840$
2008-11-23 18:49:59 ----HDC---- C:\WINNT\$NtUninstallKB927891$
2008-11-23 14:38:10 ----HDC---- C:\WINNT\$NtUninstallKB958644$
2008-11-23 00:35:50 ----D---- C:\WINNT\ERUNT
2008-11-23 00:32:06 ----A---- C:\WINNT\ntbtlog.txt

======List of files/folders modified in the last 1 months======

2008-12-21 15:15:52 ----D---- C:\WINNT\system32
2008-12-21 14:16:42 ----AD---- C:\WINNT\Temp
2008-12-21 14:12:29 ----AD---- C:\WINNT\Debug
2008-12-21 14:10:16 ----AD---- C:\WINNT\security
2008-12-20 12:39:04 ----A---- C:\WINNT\SchedLgU.Txt
2008-12-18 14:47:41 ----D---- C:\Quarantine
2008-12-18 06:37:00 ----HD---- C:\WINNT\inf
2008-12-18 06:37:00 ----AD---- C:\WINNT
2008-12-18 06:36:57 ----RASHDC---- C:\WINNT\system32\dllcache
2008-12-13 14:50:33 ----AD---- C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-12-13 14:50:32 ----D---- C:\Documents and Settings\Jeff Guymon\Application Data\ZoomBrowser EX
2008-12-11 08:45:05 ----AD---- C:\WINNT\system32\wbem
2008-12-11 08:45:04 ----A---- C:\WINNT\system32\PerfStringBackup.INI
2008-12-11 08:03:56 ----SHD---- C:\WINNT\Installer
2008-12-11 08:03:35 ----A---- C:\WINNT\win.ini
2008-12-11 08:02:28 ----A---- C:\WINNT\imsins.BAK
2008-12-11 08:01:52 ----D---- C:\Program Files\Windows Media Player
2008-12-09 16:24:37 ----A---- C:\WINNT\system32\MRT.exe
2008-12-08 23:12:20 ----D---- C:\WINNT\system32\NtmsData
2008-12-08 22:47:23 ----RAD---- C:\Program Files
2008-12-07 21:35:24 ----AD---- C:\WINNT\system32\drivers
2008-12-07 19:59:47 ----AD---- C:\Program Files\Common Files
2008-12-07 19:40:23 ----A---- C:\WINNT\wininit.ini
2008-12-04 19:07:59 ----D---- C:\Documents and Settings\Jeff Guymon\Application Data\Identities
2008-12-04 18:59:22 ----A---- C:\WINNT\KA.INI
2008-12-04 18:59:01 ----D---- C:\KA
2008-11-23 19:20:31 ----AD---- C:\WINNT\system32\Setup
2008-11-23 19:20:31 ----AD---- C:\WINNT\msagent
2008-11-23 19:14:31 ----D---- C:\WINNT\Microsoft.NET
2008-11-23 19:08:29 ----D---- C:\WINNT\Registration
2008-11-23 19:07:25 ----AD---- C:\WINNT\system32\mui
2008-11-23 19:07:24 ----D---- C:\Program Files\Internet Explorer
2008-11-23 18:59:47 ----D---- C:\Program Files\Common Files\System
2008-11-23 18:59:46 ----D---- C:\Program Files\Outlook Express
2008-11-23 18:57:20 ----RASD---- C:\WINNT\Fonts
2008-11-23 18:56:42 ----AD---- C:\Program Files\Common Files\Microsoft Shared
2008-11-23 18:54:28 ----D---- C:\WINNT\winsxs
2008-11-22 11:51:26 ----SHD---- C:\WINNT\CSC

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Cdr4_2K;Cdr4_2K; C:\WINNT\system32\drivers\Cdr4_2K.sys [2004-01-27 43008]
R1 Cdralw2k;Cdralw2k; C:\WINNT\system32\drivers\Cdralw2k.sys [2004-01-27 24576]
R1 cdudf;cdudf; C:\WINNT\system32\drivers\cdudf.sys [2004-01-27 284928]
R1 DVDVRRdr;DVDVRRdr; C:\WINNT\system32\drivers\DVDVRRdr.sys [2004-01-27 140416]
R1 mferkdk;VSCore mferkdk; \??\C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys []
R1 mfetdik;McAfee Inc.; C:\WINNT\system32\drivers\mfetdik.sys [2006-11-30 52136]
R1 pwd_2k;pwd_2k; C:\WINNT\system32\drivers\pwd_2k.sys [2004-01-27 117248]
R1 UDFReadr;UDFReadr; C:\WINNT\system32\drivers\UDFReadr.sys [2004-01-27 197632]
R2 LBeepKE;LBeepKE; C:\WINNT\System32\Drivers\LBeepKE.sys [2006-09-01 3712]
R2 Nbf;NetBEUI Protocol; C:\WINNT\System32\DRIVERS\nbf.sys [2001-05-08 102160]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINNT\system32\drivers\ALCXWDM.SYS [2002-11-26 730700]
R3 dvd_2K;dvd_2K; C:\WINNT\system32\drivers\dvd_2K.sys [2004-01-27 23680]
R3 E1000;Intel® PRO/1000 Adapter Driver; C:\WINNT\System32\DRIVERS\e1000nt5.sys [2002-05-05 103680]
R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINNT\system32\DRIVERS\L8042Kbd.sys [2006-07-19 13568]
R3 L8042mou;SetPoint PS/2 Mouse Filter Driver; C:\WINNT\system32\DRIVERS\L8042mou.Sys [2006-07-19 55936]
R3 LMouKE;SetPoint Mouse Filter Driver; C:\WINNT\system32\DRIVERS\LMouKE.Sys [2006-07-19 71936]
R3 mfeapfk;McAfee Inc.; C:\WINNT\system32\drivers\mfeapfk.sys [2006-11-30 64360]
R3 mfeavfk;McAfee Inc.; C:\WINNT\system32\drivers\mfeavfk.sys [2006-11-30 72264]
R3 mfebopk;McAfee Inc.; C:\WINNT\system32\drivers\mfebopk.sys [2006-11-30 34152]
R3 mfehidk;McAfee Inc.; C:\WINNT\system32\drivers\mfehidk.sys [2006-11-30 168776]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINNT\system32\drivers\msmpu401.sys [1999-09-25 2832]
R3 nv;nv; C:\WINNT\System32\DRIVERS\nv4_mini.sys [2006-10-22 3994624]
R3 openhci;Microsoft USB Open Host Controller Driver; C:\WINNT\System32\DRIVERS\openhci.sys [2003-06-19 24784]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINNT\System32\DRIVERS\usbehci.sys [2003-06-19 19728]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINNT\System32\DRIVERS\usbhub.sys [2003-06-19 40176]
R3 usbhub20;USB Hub Support; C:\WINNT\System32\DRIVERS\usbhub20.sys [2003-06-19 49776]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINNT\System32\DRIVERS\usbprint.sys [2003-06-19 21872]
S3 CCDECODE;Closed Caption Decoder; C:\WINNT\system32\DRIVERS\CCDECODE.sys [2004-07-09 16384]
S3 cmuda;C-Media WDM Audio Interface; C:\WINNT\system32\drivers\cmuda.sys []
S3 mmc_2K;mmc_2K; C:\WINNT\system32\drivers\mmc_2K.sys [2004-01-27 23680]
S3 MPE;BDA MPE Filter; C:\WINNT\system32\DRIVERS\MPE.sys [2004-07-09 15104]
S3 MSDV;Microsoft DV Camera and VCR; C:\WINNT\System32\DRIVERS\msdv.sys [2004-07-09 56832]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINNT\system32\drivers\MSTEE.sys [2002-12-12 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINNT\system32\DRIVERS\NABTSFEC.sys [2004-07-09 83968]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINNT\system32\DRIVERS\NdisIP.sys [2004-07-09 10112]
S3 SLIP;BDA Slip De-Framer; C:\WINNT\system32\DRIVERS\SLIP.sys [2004-07-09 10880]
S3 streamip;BDA IPSink; C:\WINNT\system32\DRIVERS\StreamIP.sys [2004-07-09 14976]
S3 usbscan;USB Scanner Driver; C:\WINNT\System32\DRIVERS\usbscan.sys [2003-06-19 12592]
S3 USBSTOR;USB Mass Storage Driver; C:\WINNT\System32\DRIVERS\USBSTOR.SYS [2003-06-19 21552]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINNT\system32\DRIVERS\WSTCODEC.SYS [2004-07-09 18688]
S4 IntelIde;IntelIde; C:\WINNT\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 awfgzrzf;awfgzrzf; C:\WINNT\system32\svchost.exe [2001-05-08 7952]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-07 152984]
R2 McAfeeFramework;McAfee Framework Service; C:\Program Files\McAfee\Common Framework\FrameworkService.exe [2006-11-17 104000]
R2 McShield;McAfee McShield; C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe [2006-11-30 144960]
R2 McTaskManager;McAfee Task Manager; C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe [2006-11-30 54872]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINNT\system32\nvsvc32.exe [2006-10-22 159810]
R2 StiSvc;Still Image Service; C:\WINNT\system32\stisvc.exe [2003-06-19 61712]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2003-12-04 49152]
S2 afisicx;afisicx; C:\WINNT\system32\afisicx.exe []
S2 NMSSvc;Intel® NMS; C:\WINNT\System32\NMSSvc.exe [2002-05-03 1118208]
S2 noytcyr;noytcyr; C:\WINNT\system32\noytcyr.exe []
S2 roytctm;roytctm; C:\WINNT\system32\roytctm.exe []
S2 tdydowkc;tdydowkc; C:\WINNT\system32\tdydowkc.exe []
S2 wsldoekd;wsldoekd; C:\WINNT\system32\wsldoekd.exe []
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINNT\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WmdmPmSN;Portable Media Serial Number Service; C:\WINNT\System32\svchost.exe [2001-05-08 7952]

#4 teacup61

Bleepin' Texan!

Malware Response Team
17,075 posts
OFFLINE

Gender:Female
Location:Wills Point, Texas
Local time:03:13 AM

Posted 21 December 2008 - 05:27 PM

Hello,

That's okay. I don't really need the Kaspersky log anyway. :thumbsup:

Please uninstall Need2Find via Add/Remove Programs, then reboot.

Please run HijackThis! and click "Scan." Place checks next to the following entries, if present:

O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O8 - Extra context menu item: &Search - http://kl.bar.need2find.com/KL/menusearch.html?p=KL
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
O23 - Service: afisicx - Unknown owner - C:\WINNT\system32\afisicx.exe (file missing)
O23 - Service: noytcyr - Unknown owner - C:\WINNT\system32\noytcyr.exe (file missing)
O23 - Service: roytctm - Unknown owner - C:\WINNT\system32\roytctm.exe (file missing)
O23 - Service: tdydowkc - Unknown owner - C:\WINNT\system32\tdydowkc.exe (file missing)
O23 - Service: wsldoekd - Unknown owner - C:\WINNT\system32\wsldoekd.exe (file missing)

Close all browsers and other windows except for HijackThis!, and click "Fix checked".

Reboot your computer.

Please download Malwarebytes' Anti-Malware from one of these places:
http://www.majorgeeks.com/Malwarebytes_Ant...ware_d5756.html
http://www.besttechie.net/mbam/mbam-setup.exe

Double Click mbam-setup.exe to install the application.

* Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select "Perform Quick Scan", then click Scan.
* The scan may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
* The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
* Copy&Paste the entire report in your next reply along with a fresh HijackThis log.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

Also please let me know how it's running now.

Thanks,
tea

Please make a donation so I can keep helping people just like you.
Every little bit helps!
You can even use your credit card! Thank you!

Error reading poptart in Drive A: Delete kids y/n?

#5 jdguymon

Topic Starter

Members
6 posts
OFFLINE

Local time:01:13 AM

Posted 22 December 2008 - 12:15 AM

OK, I can't get past your first step. I don't think I have a program called "Need2Find" on my computer and I don't see it on my add/remove programs list.

#6 teacup61

Bleepin' Texan!

Malware Response Team
17,075 posts
OFFLINE

Gender:Female
Location:Wills Point, Texas
Local time:03:13 AM

Posted 22 December 2008 - 12:56 AM

Hello,

That's okay.

Just go on with the rest of the directions. :thumbsup:

tea

Please make a donation so I can keep helping people just like you.
Every little bit helps!
You can even use your credit card! Thank you!

Error reading poptart in Drive A: Delete kids y/n?

#7 jdguymon

Topic Starter

Members
6 posts
OFFLINE

Local time:01:13 AM

Posted 22 December 2008 - 08:42 PM

Malwarebytes log looks clean now...please advise if further action is needed.

Malwarebytes' Anti-Malware 1.31
Database version: 1533
Windows 5.0.2195 Service Pack 4

12/22/2008 6:36:48 PM
mbam-log-2008-12-22 (18-36-48).txt

Scan type: Quick Scan
Objects scanned: 76712
Time elapsed: 20 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Logfile of random's system information tool 1.04 (written by random/random)
Run by Jeff Guymon at 2008-12-22 18:38:15
Microsoft Windows 2000 Professional Service Pack 4
System drive C: has 32 GB (72%) free of 44 GB
Total RAM: 1023 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:38:17 PM, on 12/22/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\htpatch.exe
C:\WINNT\system32\PROMon.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\WINNT\SM1BG.EXE
C:\WINNT\system32\RUNDLL32.EXE
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Jeff Guymon\Desktop\RSIT.exe
C:\Documents and Settings\Jeff Guymon\Desktop\Jeff Guymon.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HTpatch] C:\WINNT\htpatch.exe
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [SM1BG] C:\WINNT\SM1BG.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClockEx\TCLOCKEX.EXE
O4 - HKCU\..\Run: [EPSON Stylus Photo R260 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE /FU "C:\WINNT\TEMP\E_S9F.tmp" /EF "HKCU"
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1150047754953
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://www.samsphotoclub.com/upload/FujifilmUploadClient.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe
O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
O23 - Service: afisicx - Unknown owner - C:\WINNT\system32\afisicx.exe (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: noytcyr - Unknown owner - C:\WINNT\system32\noytcyr.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: roytctm - Unknown owner - C:\WINNT\system32\roytctm.exe (file missing)
O23 - Service: tdydowkc - Unknown owner - C:\WINNT\system32\tdydowkc.exe (file missing)
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: wsldoekd - Unknown owner - C:\WINNT\system32\wsldoekd.exe (file missing)

--
End of file - 8022 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll [2003-11-03 54248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-08-14 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-07 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [2003-05-15 147456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-07 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-07 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467} - @msdxmLC.dll,-1@1033,&Radio - C:\WINNT\System32\msdxm.ocx [2005-03-31 844560]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [2003-05-15 147456]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"=mobsync.exe /logon []
"HTpatch"=C:\WINNT\htpatch.exe [2002-10-30 28672]
"PROMon.exe"=C:\WINNT\system32\PROMon.exe [2002-04-18 73728]
"NvCplDaemon"=C:\WINNT\system32\NvCpl.dll [2006-10-22 7700480]
"nwiz"=nwiz.exe /install []
"Omnipage"=C:\Program Files\ScanSoft\OmniPageSE\opware32.exe [2002-06-03 49152]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2006-06-14 282624]
"RoxioDragToDisc"=C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe [2004-01-27 1179648]
"SM1BG"=C:\WINNT\SM1BG.EXE [2003-08-27 94208]
"NvMediaCenter"=C:\WINNT\system32\NvMcTray.dll [2006-10-22 86016]
"Logitech Hardware Abstraction Layer"=C:\WINNT\KHALMNPR.EXE [2006-07-19 94208]
"ShStatEXE"=C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE [2006-11-30 112216]
"McAfeeUpdaterUI"=C:\Program Files\McAfee\Common Framework\UdaterUI.exe [2006-11-17 136768]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-12-07 136600]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"TClockEx"=C:\Program Files\TClockEx\TCLOCKEX.EXE [2000-03-09 89088]
"EPSON Stylus Photo R260 Series"=C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE [2006-05-18 139264]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\nwprovau]
C:\WINNT\system32\nwprovau.dll [2006-08-31 140048]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=149

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2008-12-18 06:36:54 ----HDC---- C:\WINNT\$NtUninstallKB960714-IE6SP1-20081211.120000$
2008-12-11 08:02:24 ----HDC---- C:\WINNT\$NtUninstallKB952069_WM71$
2008-12-11 08:01:50 ----HDC---- C:\WINNT\$NtUninstallKB954600_WM41$
2008-12-11 08:01:35 ----HDC---- C:\WINNT\$NtUninstallKB958215-IE6SP1-20081016.120000$
2008-12-11 08:00:44 ----HDC---- C:\WINNT\$NtUninstallKB956802$
2008-12-10 23:03:00 ----A---- C:\WINNT\system32\MSHTML.DLL
2008-12-08 22:47:23 ----D---- C:\rsit
2008-12-08 22:47:23 ----D---- C:\Program Files\trend micro
2008-12-07 21:14:03 ----D---- C:\Documents and Settings\Jeff Guymon\Application Data\Malwarebytes
2008-12-07 21:13:58 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-12-07 21:13:58 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\javaws.exe
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\javaw.exe
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\java.exe
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\deploytk.dll
2008-12-07 20:09:56 ----D---- C:\Program Files\Java
2008-11-23 19:12:40 ----HDC---- C:\WINNT\$NtUninstallKB957097$
2008-11-23 19:12:25 ----HDC---- C:\WINNT\$NtUninstallKB955069$
2008-11-23 19:11:28 ----HDC---- C:\WINNT\$NtUninstallKB956390-IE6SP1-20080820.120000$
2008-11-23 19:11:20 ----HDC---- C:\WINNT\$NtUninstallKB957095$
2008-11-23 19:11:14 ----HDC---- C:\WINNT\$NtUninstallKB956391$
2008-11-23 19:11:03 ----HDC---- C:\WINNT\$NtUninstallKB954211$
2008-11-23 19:01:28 ----HDC---- C:\WINNT\$NtUninstallKB938464-IE6SP1-20080429.120000$
2008-11-23 18:59:56 ----HDC---- C:\WINNT\$NtUninstallKB952954$
2008-11-23 18:59:51 ----HDC---- C:\WINNT\$NtUninstallKB950974$
2008-11-23 18:59:42 ----HDC---- C:\WINNT\$NtUninstallKB951066-OE6SP1-20080625.120000$
2008-11-23 18:59:34 ----HDC---- C:\WINNT\$NtUninstallKB951748$
2008-11-23 18:58:58 ----HDC---- C:\WINNT\$NtUninstallKB951698_DX9$
2008-11-23 18:54:09 ----HDC---- C:\WINNT\$NtUninstallKB950749$
2008-11-23 18:54:02 ----HDC---- C:\WINNT\$NtUninstallKB944338$
2008-11-23 18:53:27 ----HDC---- C:\WINNT\$NtUninstallKB948590$
2008-11-23 18:53:21 ----HDC---- C:\WINNT\$NtUninstallKB945553$
2008-11-23 18:52:49 ----HDC---- C:\WINNT\$NtUninstallKB943055$
2008-11-23 18:51:56 ----HDC---- C:\WINNT\$NtUninstallKB943485$
2008-11-23 18:51:47 ----HDC---- C:\WINNT\$NtUninstallKB937894$
2008-11-23 18:50:59 ----HDC---- C:\WINNT\$NtUninstallKB941569$
2008-11-23 18:50:51 ----HDC---- C:\WINNT\$NtUninstallKB923810$
2008-11-23 18:50:46 ----HDC---- C:\WINNT\$NtUninstallKB933729$
2008-11-23 18:50:40 ----HDC---- C:\WINNT\$NtUninstallKB938827$
2008-11-23 18:50:30 ----A---- C:\WINNT\system32\wmpns.dll
2008-11-23 18:50:24 ----HDC---- C:\WINNT\$NtUninstallKB936782_WMP9$
2008-11-23 18:50:17 ----HDC---- C:\WINNT\$NtUninstallKB926122$
2008-11-23 18:50:12 ----HDC---- C:\WINNT\$NtUninstallKB935839$
2008-11-23 18:50:06 ----HDC---- C:\WINNT\$NtUninstallKB935840$
2008-11-23 18:49:59 ----HDC---- C:\WINNT\$NtUninstallKB927891$
2008-11-23 14:38:10 ----HDC---- C:\WINNT\$NtUninstallKB958644$
2008-11-23 00:35:50 ----D---- C:\WINNT\ERUNT
2008-11-23 00:32:06 ----A---- C:\WINNT\ntbtlog.txt

======List of files/folders modified in the last 1 months======

2008-12-22 18:38:16 ----D---- C:\WINNT\system32
2008-12-22 18:11:27 ----AD---- C:\WINNT\Debug
2008-12-22 18:10:09 ----AD---- C:\WINNT\Temp
2008-12-22 18:07:10 ----A---- C:\WINNT\SchedLgU.Txt
2008-12-22 12:10:11 ----D---- C:\Quarantine
2008-12-21 14:16:52 ----AD---- C:\WINNT\security
2008-12-21 14:11:09 ----D---- C:\WINNT\system32\NtmsData
2008-12-18 06:37:00 ----HD---- C:\WINNT\inf
2008-12-18 06:37:00 ----AD---- C:\WINNT
2008-12-18 06:36:57 ----RASHDC---- C:\WINNT\system32\dllcache
2008-12-13 14:50:37 ----D---- C:\Documents and Settings\Jeff Guymon\Application Data\ZoomBrowser EX
2008-12-13 14:50:33 ----AD---- C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-12-11 08:45:05 ----AD---- C:\WINNT\system32\wbem
2008-12-11 08:45:04 ----A---- C:\WINNT\system32\PerfStringBackup.INI
2008-12-11 08:03:56 ----SHD---- C:\WINNT\Installer
2008-12-11 08:03:35 ----A---- C:\WINNT\win.ini
2008-12-11 08:02:28 ----A---- C:\WINNT\imsins.BAK
2008-12-11 08:01:52 ----D---- C:\Program Files\Windows Media Player
2008-12-09 16:24:37 ----A---- C:\WINNT\system32\MRT.exe
2008-12-08 22:47:23 ----RAD---- C:\Program Files
2008-12-07 21:35:24 ----AD---- C:\WINNT\system32\drivers
2008-12-07 19:59:47 ----AD---- C:\Program Files\Common Files
2008-12-07 19:40:23 ----A---- C:\WINNT\wininit.ini
2008-12-04 19:07:59 ----D---- C:\Documents and Settings\Jeff Guymon\Application Data\Identities
2008-12-04 18:59:22 ----A---- C:\WINNT\KA.INI
2008-12-04 18:59:01 ----D---- C:\KA
2008-11-23 19:20:31 ----AD---- C:\WINNT\system32\Setup
2008-11-23 19:20:31 ----AD---- C:\WINNT\msagent
2008-11-23 19:14:31 ----D---- C:\WINNT\Microsoft.NET
2008-11-23 19:08:29 ----D---- C:\WINNT\Registration
2008-11-23 19:07:25 ----AD---- C:\WINNT\system32\mui
2008-11-23 19:07:24 ----D---- C:\Program Files\Internet Explorer
2008-11-23 18:59:47 ----D---- C:\Program Files\Common Files\System
2008-11-23 18:59:46 ----D---- C:\Program Files\Outlook Express
2008-11-23 18:57:20 ----RASD---- C:\WINNT\Fonts
2008-11-23 18:56:42 ----AD---- C:\Program Files\Common Files\Microsoft Shared
2008-11-23 18:54:28 ----D---- C:\WINNT\winsxs

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Cdr4_2K;Cdr4_2K; C:\WINNT\system32\drivers\Cdr4_2K.sys [2004-01-27 43008]
R1 Cdralw2k;Cdralw2k; C:\WINNT\system32\drivers\Cdralw2k.sys [2004-01-27 24576]
R1 cdudf;cdudf; C:\WINNT\system32\drivers\cdudf.sys [2004-01-27 284928]
R1 DVDVRRdr;DVDVRRdr; C:\WINNT\system32\drivers\DVDVRRdr.sys [2004-01-27 140416]
R1 mferkdk;VSCore mferkdk; \??\C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys []
R1 mfetdik;McAfee Inc.; C:\WINNT\system32\drivers\mfetdik.sys [2006-11-30 52136]
R1 pwd_2k;pwd_2k; C:\WINNT\system32\drivers\pwd_2k.sys [2004-01-27 117248]
R1 UDFReadr;UDFReadr; C:\WINNT\system32\drivers\UDFReadr.sys [2004-01-27 197632]
R2 LBeepKE;LBeepKE; C:\WINNT\System32\Drivers\LBeepKE.sys [2006-09-01 3712]
R2 Nbf;NetBEUI Protocol; C:\WINNT\System32\DRIVERS\nbf.sys [2001-05-08 102160]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINNT\system32\drivers\ALCXWDM.SYS [2002-11-26 730700]
R3 dvd_2K;dvd_2K; C:\WINNT\system32\drivers\dvd_2K.sys [2004-01-27 23680]
R3 E1000;Intel® PRO/1000 Adapter Driver; C:\WINNT\System32\DRIVERS\e1000nt5.sys [2002-05-05 103680]
R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINNT\system32\DRIVERS\L8042Kbd.sys [2006-07-19 13568]
R3 L8042mou;SetPoint PS/2 Mouse Filter Driver; C:\WINNT\system32\DRIVERS\L8042mou.Sys [2006-07-19 55936]
R3 LMouKE;SetPoint Mouse Filter Driver; C:\WINNT\system32\DRIVERS\LMouKE.Sys [2006-07-19 71936]
R3 mfeapfk;McAfee Inc.; C:\WINNT\system32\drivers\mfeapfk.sys [2006-11-30 64360]
R3 mfeavfk;McAfee Inc.; C:\WINNT\system32\drivers\mfeavfk.sys [2006-11-30 72264]
R3 mfebopk;McAfee Inc.; C:\WINNT\system32\drivers\mfebopk.sys [2006-11-30 34152]
R3 mfehidk;McAfee Inc.; C:\WINNT\system32\drivers\mfehidk.sys [2006-11-30 168776]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINNT\system32\drivers\msmpu401.sys [1999-09-25 2832]
R3 NMSCFG;NIC Management Service Configuration Driver; \??\C:\WINNT\system32\drivers\NMSCFG.SYS []
R3 nv;nv; C:\WINNT\System32\DRIVERS\nv4_mini.sys [2006-10-22 3994624]
R3 openhci;Microsoft USB Open Host Controller Driver; C:\WINNT\System32\DRIVERS\openhci.sys [2003-06-19 24784]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINNT\System32\DRIVERS\usbehci.sys [2003-06-19 19728]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINNT\System32\DRIVERS\usbhub.sys [2003-06-19 40176]
R3 usbhub20;USB Hub Support; C:\WINNT\System32\DRIVERS\usbhub20.sys [2003-06-19 49776]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINNT\System32\DRIVERS\usbprint.sys [2003-06-19 21872]
S3 CCDECODE;Closed Caption Decoder; C:\WINNT\system32\DRIVERS\CCDECODE.sys [2004-07-09 16384]
S3 cmuda;C-Media WDM Audio Interface; C:\WINNT\system32\drivers\cmuda.sys []
S3 mmc_2K;mmc_2K; C:\WINNT\system32\drivers\mmc_2K.sys [2004-01-27 23680]
S3 MPE;BDA MPE Filter; C:\WINNT\system32\DRIVERS\MPE.sys [2004-07-09 15104]
S3 MSDV;Microsoft DV Camera and VCR; C:\WINNT\System32\DRIVERS\msdv.sys [2004-07-09 56832]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINNT\system32\drivers\MSTEE.sys [2002-12-12 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINNT\system32\DRIVERS\NABTSFEC.sys [2004-07-09 83968]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINNT\system32\DRIVERS\NdisIP.sys [2004-07-09 10112]
S3 SLIP;BDA Slip De-Framer; C:\WINNT\system32\DRIVERS\SLIP.sys [2004-07-09 10880]
S3 streamip;BDA IPSink; C:\WINNT\system32\DRIVERS\StreamIP.sys [2004-07-09 14976]
S3 usbscan;USB Scanner Driver; C:\WINNT\System32\DRIVERS\usbscan.sys [2003-06-19 12592]
S3 USBSTOR;USB Mass Storage Driver; C:\WINNT\System32\DRIVERS\USBSTOR.SYS [2003-06-19 21552]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINNT\system32\DRIVERS\WSTCODEC.SYS [2004-07-09 18688]
S4 IntelIde;IntelIde; C:\WINNT\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 awfgzrzf;awfgzrzf; C:\WINNT\system32\svchost.exe [2001-05-08 7952]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-07 152984]
R2 McAfeeFramework;McAfee Framework Service; C:\Program Files\McAfee\Common Framework\FrameworkService.exe [2006-11-17 104000]
R2 McShield;McAfee McShield; C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe [2006-11-30 144960]
R2 McTaskManager;McAfee Task Manager; C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe [2006-11-30 54872]
R2 NMSSvc;Intel® NMS; C:\WINNT\System32\NMSSvc.exe [2002-05-03 1118208]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINNT\system32\nvsvc32.exe [2006-10-22 159810]
R2 StiSvc;Still Image Service; C:\WINNT\system32\stisvc.exe [2003-06-19 61712]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2003-12-04 49152]
S2 afisicx;afisicx; C:\WINNT\system32\afisicx.exe []
S2 noytcyr;noytcyr; C:\WINNT\system32\noytcyr.exe []
S2 roytctm;roytctm; C:\WINNT\system32\roytctm.exe []
S2 tdydowkc;tdydowkc; C:\WINNT\system32\tdydowkc.exe []
S2 wsldoekd;wsldoekd; C:\WINNT\system32\wsldoekd.exe []
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINNT\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WmdmPmSN;Portable Media Serial Number Service; C:\WINNT\System32\svchost.exe [2001-05-08 7952]

-----------------EOF-----------------

#8 teacup61

Bleepin' Texan!

Malware Response Team
17,075 posts
OFFLINE

Gender:Female
Location:Wills Point, Texas
Local time:03:13 AM

Posted 22 December 2008 - 08:53 PM

Hello,

Is that the most current HijackThis log? Everything I asked you to fix is still there. :thumbsup:

Please make a donation so I can keep helping people just like you.
Every little bit helps!
You can even use your credit card! Thank you!

Error reading poptart in Drive A: Delete kids y/n?

#9 jdguymon

Topic Starter

Members
6 posts
OFFLINE

Local time:01:13 AM

Posted 23 December 2008 - 11:16 PM

OK, here's a redo of the scans and logs.

Logfile of random's system information tool 1.04 (written by random/random)
Run by Jeff Guymon at 2008-12-23 21:11:35
Microsoft Windows 2000 Professional Service Pack 4
System drive C: has 32 GB (72%) free of 44 GB
Total RAM: 1023 MB (52% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:11:39 PM, on 12/23/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\system32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\htpatch.exe
C:\WINNT\system32\PROMon.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\WINNT\SM1BG.EXE
C:\WINNT\system32\RUNDLL32.EXE
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\NOTEPAD.EXE
C:\Documents and Settings\Jeff Guymon\Desktop\Utilities\RSIT.exe
C:\Documents and Settings\Jeff Guymon\Desktop\Utilities\Jeff Guymon.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [HTpatch] C:\WINNT\htpatch.exe
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [SM1BG] C:\WINNT\SM1BG.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [TClockEx] C:\Program Files\TClockEx\TCLOCKEX.EXE
O4 - HKCU\..\Run: [EPSON Stylus Photo R260 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE /FU "C:\WINNT\TEMP\E_S9F.tmp" /EF "HKCU"
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://www.maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1150047754953
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://www.samsphotoclub.com/upload/FujifilmUploadClient.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe
O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 7634 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll [2003-11-03 54248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2008-08-14 1562448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java™ Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-07 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
AcroIEToolbarHelper Class - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [2003-05-15 147456]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java™ Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-07 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-07 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{8E718888-423F-11D2-876E-00A0C9082467} - @msdxmLC.dll,-1@1033,&Radio - C:\WINNT\System32\msdxm.ocx [2005-03-31 844560]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll [2003-05-15 147456]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"=mobsync.exe /logon []
"HTpatch"=C:\WINNT\htpatch.exe [2002-10-30 28672]
"PROMon.exe"=C:\WINNT\system32\PROMon.exe [2002-04-18 73728]
"NvCplDaemon"=C:\WINNT\system32\NvCpl.dll [2006-10-22 7700480]
"nwiz"=nwiz.exe /install []
"Omnipage"=C:\Program Files\ScanSoft\OmniPageSE\opware32.exe [2002-06-03 49152]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2006-06-14 282624]
"RoxioDragToDisc"=C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe [2004-01-27 1179648]
"SM1BG"=C:\WINNT\SM1BG.EXE [2003-08-27 94208]
"NvMediaCenter"=C:\WINNT\system32\NvMcTray.dll [2006-10-22 86016]
"Logitech Hardware Abstraction Layer"=C:\WINNT\KHALMNPR.EXE [2006-07-19 94208]
"ShStatEXE"=C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE [2006-11-30 112216]
"McAfeeUpdaterUI"=C:\Program Files\McAfee\Common Framework\UdaterUI.exe [2006-11-17 136768]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-12-07 136600]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"TClockEx"=C:\Program Files\TClockEx\TCLOCKEX.EXE [2000-03-09 89088]
"EPSON Stylus Photo R260 Series"=C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATIBNA.EXE [2006-05-18 139264]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\nwprovau]
C:\WINNT\system32\nwprovau.dll [2006-08-31 140048]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=149

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======List of files/folders created in the last 1 months======

2008-12-18 06:36:54 ----HDC---- C:\WINNT\$NtUninstallKB960714-IE6SP1-20081211.120000$
2008-12-11 08:02:24 ----HDC---- C:\WINNT\$NtUninstallKB952069_WM71$
2008-12-11 08:01:50 ----HDC---- C:\WINNT\$NtUninstallKB954600_WM41$
2008-12-11 08:01:35 ----HDC---- C:\WINNT\$NtUninstallKB958215-IE6SP1-20081016.120000$
2008-12-11 08:00:44 ----HDC---- C:\WINNT\$NtUninstallKB956802$
2008-12-10 23:03:00 ----A---- C:\WINNT\system32\MSHTML.DLL
2008-12-08 22:47:23 ----D---- C:\rsit
2008-12-08 22:47:23 ----D---- C:\Program Files\trend micro
2008-12-07 21:14:03 ----D---- C:\Documents and Settings\Jeff Guymon\Application Data\Malwarebytes
2008-12-07 21:13:58 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-12-07 21:13:58 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\javaws.exe
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\javaw.exe
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\java.exe
2008-12-07 20:11:26 ----A---- C:\WINNT\system32\deploytk.dll
2008-12-07 20:09:56 ----D---- C:\Program Files\Java

======List of files/folders modified in the last 1 months======

2008-12-23 17:49:07 ----D---- C:\Quarantine
2008-12-23 17:45:00 ----AD---- C:\WINNT\Temp
2008-12-23 17:27:08 ----AD---- C:\WINNT\security
2008-12-23 17:09:10 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-12-23 17:01:50 ----D---- C:\WINNT\system32
2008-12-22 22:39:50 ----AD---- C:\WINNT
2008-12-22 21:51:03 ----AD---- C:\WINNT\Debug
2008-12-22 21:50:13 ----D---- C:\WINNT\system32\NtmsData
2008-12-22 21:45:57 ----A---- C:\WINNT\SchedLgU.Txt
2008-12-22 21:27:47 ----A---- C:\WINNT\ModemDet.txt
2008-12-18 06:37:00 ----HD---- C:\WINNT\inf
2008-12-18 06:36:57 ----RASHDC---- C:\WINNT\system32\dllcache
2008-12-13 14:50:37 ----D---- C:\Documents and Settings\Jeff Guymon\Application Data\ZoomBrowser EX
2008-12-13 14:50:33 ----AD---- C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-12-11 08:45:05 ----AD---- C:\WINNT\system32\wbem
2008-12-11 08:45:04 ----A---- C:\WINNT\system32\PerfStringBackup.INI
2008-12-11 08:03:56 ----SHD---- C:\WINNT\Installer
2008-12-11 08:03:35 ----A---- C:\WINNT\win.ini
2008-12-11 08:02:28 ----A---- C:\WINNT\imsins.BAK
2008-12-11 08:01:52 ----D---- C:\Program Files\Windows Media Player
2008-12-09 16:24:37 ----A---- C:\WINNT\system32\MRT.exe
2008-12-08 22:47:23 ----RAD---- C:\Program Files
2008-12-07 21:35:24 ----AD---- C:\WINNT\system32\drivers
2008-12-07 19:59:47 ----AD---- C:\Program Files\Common Files
2008-12-07 19:40:23 ----A---- C:\WINNT\wininit.ini
2008-12-04 21:29:28 ----A---- C:\WINNT\ntbtlog.txt
2008-12-04 19:07:59 ----D---- C:\Documents and Settings\Jeff Guymon\Application Data\Identities
2008-12-04 18:59:22 ----A---- C:\WINNT\KA.INI
2008-12-04 18:59:01 ----D---- C:\KA

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Cdr4_2K;Cdr4_2K; C:\WINNT\system32\drivers\Cdr4_2K.sys [2004-01-27 43008]
R1 Cdralw2k;Cdralw2k; C:\WINNT\system32\drivers\Cdralw2k.sys [2004-01-27 24576]
R1 cdudf;cdudf; C:\WINNT\system32\drivers\cdudf.sys [2004-01-27 284928]
R1 DVDVRRdr;DVDVRRdr; C:\WINNT\system32\drivers\DVDVRRdr.sys [2004-01-27 140416]
R1 mferkdk;VSCore mferkdk; \??\C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys []
R1 mfetdik;McAfee Inc.; C:\WINNT\system32\drivers\mfetdik.sys [2006-11-30 52136]
R1 pwd_2k;pwd_2k; C:\WINNT\system32\drivers\pwd_2k.sys [2004-01-27 117248]
R1 UDFReadr;UDFReadr; C:\WINNT\system32\drivers\UDFReadr.sys [2004-01-27 197632]
R2 LBeepKE;LBeepKE; C:\WINNT\System32\Drivers\LBeepKE.sys [2006-09-01 3712]
R2 Nbf;NetBEUI Protocol; C:\WINNT\System32\DRIVERS\nbf.sys [2001-05-08 102160]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINNT\system32\drivers\ALCXWDM.SYS [2002-11-26 730700]
R3 dvd_2K;dvd_2K; C:\WINNT\system32\drivers\dvd_2K.sys [2004-01-27 23680]
R3 E1000;Intel® PRO/1000 Adapter Driver; C:\WINNT\System32\DRIVERS\e1000nt5.sys [2002-05-05 103680]
R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINNT\system32\DRIVERS\L8042Kbd.sys [2006-07-19 13568]
R3 L8042mou;SetPoint PS/2 Mouse Filter Driver; C:\WINNT\system32\DRIVERS\L8042mou.Sys [2006-07-19 55936]
R3 LMouKE;SetPoint Mouse Filter Driver; C:\WINNT\system32\DRIVERS\LMouKE.Sys [2006-07-19 71936]
R3 mfeapfk;McAfee Inc.; C:\WINNT\system32\drivers\mfeapfk.sys [2006-11-30 64360]
R3 mfeavfk;McAfee Inc.; C:\WINNT\system32\drivers\mfeavfk.sys [2006-11-30 72264]
R3 mfebopk;McAfee Inc.; C:\WINNT\system32\drivers\mfebopk.sys [2006-11-30 34152]
R3 mfehidk;McAfee Inc.; C:\WINNT\system32\drivers\mfehidk.sys [2006-11-30 168776]
R3 ms_mpu401;Microsoft MPU-401 MIDI UART Driver; C:\WINNT\system32\drivers\msmpu401.sys [1999-09-25 2832]
R3 NMSCFG;NIC Management Service Configuration Driver; \??\C:\WINNT\system32\drivers\NMSCFG.SYS []
R3 nv;nv; C:\WINNT\System32\DRIVERS\nv4_mini.sys [2006-10-22 3994624]
R3 openhci;Microsoft USB Open Host Controller Driver; C:\WINNT\System32\DRIVERS\openhci.sys [2003-06-19 24784]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINNT\System32\DRIVERS\usbehci.sys [2003-06-19 19728]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINNT\System32\DRIVERS\usbhub.sys [2003-06-19 40176]
R3 usbhub20;USB Hub Support; C:\WINNT\System32\DRIVERS\usbhub20.sys [2003-06-19 49776]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINNT\System32\DRIVERS\usbprint.sys [2003-06-19 21872]
S3 CCDECODE;Closed Caption Decoder; C:\WINNT\system32\DRIVERS\CCDECODE.sys [2004-07-09 16384]
S3 cmuda;C-Media WDM Audio Interface; C:\WINNT\system32\drivers\cmuda.sys []
S3 mmc_2K;mmc_2K; C:\WINNT\system32\drivers\mmc_2K.sys [2004-01-27 23680]
S3 MPE;BDA MPE Filter; C:\WINNT\system32\DRIVERS\MPE.sys [2004-07-09 15104]
S3 MSDV;Microsoft DV Camera and VCR; C:\WINNT\System32\DRIVERS\msdv.sys [2004-07-09 56832]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINNT\system32\drivers\MSTEE.sys [2002-12-12 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINNT\system32\DRIVERS\NABTSFEC.sys [2004-07-09 83968]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINNT\system32\DRIVERS\NdisIP.sys [2004-07-09 10112]
S3 SLIP;BDA Slip De-Framer; C:\WINNT\system32\DRIVERS\SLIP.sys [2004-07-09 10880]
S3 streamip;BDA IPSink; C:\WINNT\system32\DRIVERS\StreamIP.sys [2004-07-09 14976]
S3 usbscan;USB Scanner Driver; C:\WINNT\System32\DRIVERS\usbscan.sys [2003-06-19 12592]
S3 USBSTOR;USB Mass Storage Driver; C:\WINNT\System32\DRIVERS\USBSTOR.SYS [2003-06-19 21552]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINNT\system32\DRIVERS\WSTCODEC.SYS [2004-07-09 18688]
S4 IntelIde;IntelIde; C:\WINNT\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 awfgzrzf;awfgzrzf; C:\WINNT\system32\svchost.exe [2001-05-08 7952]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-07 152984]
R2 McAfeeFramework;McAfee Framework Service; C:\Program Files\McAfee\Common Framework\FrameworkService.exe [2006-11-17 104000]
R2 McShield;McAfee McShield; C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe [2006-11-30 144960]
R2 McTaskManager;McAfee Task Manager; C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe [2006-11-30 54872]
R2 NMSSvc;Intel® NMS; C:\WINNT\System32\NMSSvc.exe [2002-05-03 1118208]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINNT\system32\nvsvc32.exe [2006-10-22 159810]
R2 StiSvc;Still Image Service; C:\WINNT\system32\stisvc.exe [2003-06-19 61712]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [2003-12-04 49152]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINNT\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 WmdmPmSN;Portable Media Serial Number Service; C:\WINNT\System32\svchost.exe [2001-05-08 7952]

-----------------EOF-----------------
Malwarebytes' Anti-Malware 1.31
Database version: 1533
Windows 5.0.2195 Service Pack 4

12/23/2008 9:08:34 PM
mbam-log-2008-12-23 (21-08-34).txt

Scan type: Quick Scan
Objects scanned: 75508
Time elapsed: 19 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#10 teacup61

Bleepin' Texan!

Malware Response Team
17,075 posts
OFFLINE

Gender:Female
Location:Wills Point, Texas
Local time:03:13 AM

Posted 23 December 2008 - 11:25 PM

Hi there,

Much better, thanks. :thumbsup:

How is it running please?

Please make a donation so I can keep helping people just like you.
Every little bit helps!
You can even use your credit card! Thank you!

Error reading poptart in Drive A: Delete kids y/n?

#11 jdguymon

Topic Starter

Members
6 posts
OFFLINE

Local time:01:13 AM

Posted 24 December 2008 - 01:44 AM

It still seems like memory usage is a bit high and IE is slower than it has been. Right after I performed the cleanup as you instructed, my memory gage dropped to about 25%. Now it has crept back up to ~50%. I don't know if this is a related issue though. I probably need to work through some of your "computer slowness" tips.

#12 teacup61

Bleepin' Texan!

Malware Response Team
17,075 posts
OFFLINE

Gender:Female
Location:Wills Point, Texas
Local time:03:13 AM

Posted 24 December 2008 - 02:15 AM

Hello,

Give this a try :

Please download ATF Cleaner by Atribune.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Please run HijackThis! and click "Scan." Place checks next to the following entries, if present:

O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [SM1BG] C:\WINNT\SM1BG.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O18 - Filter hijack: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)

Close all browsers and other windows except for HijackThis!, and click "Fix checked".

Reboot your computer a time or two and see if it's a bit faster.

Also have a look here: http://users.telenet.be/bluepatchy/miekiem...owcomputer.html

Let me know how you come out. :thumbsup:

Regards,
tea

Please make a donation so I can keep helping people just like you.
Every little bit helps!
You can even use your credit card! Thank you!

Error reading poptart in Drive A: Delete kids y/n?

#13 teacup61

Bleepin' Texan!

Malware Response Team
17,075 posts
OFFLINE

Gender:Female
Location:Wills Point, Texas
Local time:03:13 AM

Posted 31 December 2008 - 02:53 AM

Since this issue appears resolved ... this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.

Please make a donation so I can keep helping people just like you.
Every little bit helps!
You can even use your credit card! Thank you!

Error reading poptart in Drive A: Delete kids y/n?

Back to Virus, Trojan, Spyware, and Malware Removal Logs