Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Dialer and who knows what else.


  • This topic is locked This topic is locked
2 replies to this topic

#1 RebelwoaCloo

RebelwoaCloo

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:12:50 PM

Posted 14 August 2009 - 06:47 PM

I am not well-versed in computerese but I shall do my best. When I log-on to my PC, the SpySweeper A/V program takes up a lot of RAM thwarting something that wants to dial out. There's other problems with my Gateway GT5432 but this is the worst. When I shut down the SpySweeper program, the random dialing, or at least the pop-up notices of random dialing, cease. I've re-installed SpySweeper a few times, thinking that it is infected, but the problem continuesAttached File  Attach.zip   3.7KB   1 downloads.

Try to bear with my ignorance of such things and please use layman's language if you decide to help me. I hope I'm posting and attaching correctly and apologies if I create havoc. I do appreciate your time.

Sharon

Please note: I thought some of my A/V programs, like CounterSpy and ThreatFire, were removed.

DDS (Ver_09-07-30.01) - NTFSx86
Run by RebelwoaCloo at 16:59:11.02 on Fri 08/14/2009
Internet Explorer: 8.0.6001.18813 BrowserJavaVersion: 1.6.0_15
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3454.1972 [GMT -6:00]

AV: ThreatFire *On-access scanning enabled* (Updated) {67B2B9A1-25C8-4057-962D-807958FFC9E3}
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: Avira AntiVir PersonalEdition *disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: AVG Anti-Spyware *enabled* (Outdated) {48F2E28D-ED66-4646-9C11-B3055B0AF604}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: Kaspersky Anti-Virus *disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
SP: ThreatFire *enabled* (Updated) {79E34F8F-D0AD-48d6-9223-C657C6491F67}
SP: Sunbelt Software CounterSpy 2.5.1032 *disabled* (Outdated) {9817B764-AE4E-4B29-AEE7-725B7A50BD48}
FW: Kaspersky Anti-Virus *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\agrsmsvc.exe
C:\Program Files\comcasttb\ComcastSpywareScan\ComcastAntiSpyService.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Windows\system32\LxrSII1s.exe
C:\Program Files\McAfee\MBK\MBackMonitor.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Windows\system32\rundll32.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\System32\tcpsvcs.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\PROGRA~1\SpeedBit Video Accelerator\VideoAcceleratorService.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\IObit\Advanced SystemCare 3a\AWC.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\SpeedBit Video Accelerator\VideoAcceleratorEngine.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe
C:\Program Files\Common Files\aol\1181357666\ee\aolsoftware.exe
C:\Windows\RtHDVCpl.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\DAP\DAP.exe
C:\Program Files\IObit\Advanced SystemCare 3a\Sup_SmartRAM.exe
C:\Program Files\Siber Systems\AI RoboForm\robotaskbaricon.exe
C:\Program Files\WordWeb\wweb32.exe
C:\@Home\Tools\DHCPChk.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\AOL 9.5\waol.exe
C:\Windows\system32\conime.exe
C:\PROGRAM FILES\CLIPBOARD HELP+SPELL\CLIPBOARDHELPANDSPELL.EXE
C:\Program Files\AOL 9.5\shellmon.exe
C:\Program Files\IObit\IObit Security 360\is360.exe
C:\Program Files\IObit\IObit Security 360\is360tray.exe
C:\Program Files\IObit\IObit Security 360\IS360srv.exe
C:\Windows\system32\Taskmgr.exe
C:\PROGRA~1\mcafee\msc\mcshell.exe
C:\Program Files\Common Files\McAfee\Core\mchost.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Users\RebelwoaCloo\AppData\Roaming\Maxthon\Maxthon.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\DllHost.exe
C:\Users\RebelwoaCloo\Desktop\dds.scr
C:\Windows\System32\osk.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/ig/gatewayr?hl=en
uWindow Title = RebelwoaCloo
uSearch Bar = hxxp://www.yahoo.com/search/ie.html
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=DTP&M=GT5432
mDefault_Page_URL = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=DTP&M=GT5432
mWindow Title = RebelwoaCloo, bleepFace
mSearchAssistant = hxxp://www.gateway.com/g/sidepanel.html?Ch=Retail&Br=GTW&Loc=ENG_US&Sys=DTP&M=GT5432
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
mURLSearchHooks: IAOLTBSearch Class: {ea756889-2338-43db-8f07-d1ca6fb9c90d} - c:\program files\aol toolbar\aoltb.dll
mURLSearchHooks: Answers.com Toolbar: {6341761b-babe-406d-b0d6-8d99b81c2ee5} -
mURLSearchHooks: H - No File
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AOL Radio Toolbar Loader: {2abdb2f7-4cbf-4939-ba12-fddc827b6a2d} - c:\program files\aol radio toolbar\aolradiotb.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: RoboForm: {724d43a9-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
BHO: Comcast Toolbar: {79ceea4e-c231-4614-9e3b-53b2a02f39b7} - c:\program files\comcasttb\comcastdx.dll
BHO: AOL Toolbar Loader: {7c554162-8cb7-45a4-b8f4-8ea1c75885f9} - c:\program files\aol toolbar\aoltb.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptsn.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: DAPIELoader Class: {ff6c3cf0-4b15-11d1-abed-709549c10000} - c:\progra~1\dap\dapieloader.dll
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: AOL Toolbar: {de9c389f-3316-41a7-809b-aa305ed9d922} - c:\program files\aol toolbar\aoltb.dll
TB: WOT: {71576546-354d-41c9-aae8-31f2ec22bf0d} - c:\program files\wot\WOT.dll
TB: Comcast Toolbar: {79ceea4e-c231-4614-9e3b-53b2a02f39b7} - c:\program files\comcasttb\comcastdx.dll
TB: AOL Radio Toolbar: {9167da98-6f9b-46f1-991d-826cae46cab6} - c:\program files\aol radio toolbar\aolradiotb.dll
uRun: [DownloadAccelerator] "c:\program files\dap\DAP.EXE" /STARTUP
uRun: [AOL Fast Start] "c:\program files\aol 9.5\AOL.EXE" -b
uRun: [SmartRAM] "c:\program files\iobit\advanced systemcare 3a\Sup_SmartRAM.exe" /m
uRun: [WMPNSCFG] "c:\program files\windows media player\WMPNSCFG.exe"
uRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"
mRun: [WinPatrol] "c:\program files\billp studios\winpatrol\WinPatrol.exe" -expressboot
mRun: [HostManager] "c:\program files\common files\aol\1181357666\ee\AOLSoftware.exe"
mRun: [RtHDVCpl] "c:\windows\RtHDVCpl.exe"
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [McAfee Backup] "c:\program files\mcafee\mbk\McAfeeDataBackup.exe"
mRun: [MBkLogOnHook] "c:\program files\mcafee\mbk\LogOnHook.exe"
mRun: [NvCplDaemon] "c:\windows\system32\rundll32.exe" c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] "c:\windows\system32\rundll32.exe" c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SpywareTerminator] "c:\program files\spyware terminator\SpywareTerminatorShield.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [SpySweeper] "c:\program files\webroot\spy sweeper\SpySweeperUI.exe" /startintray
mRun: [IObit Security 360] c:\program files\iobit\iobit security 360\IS360tray.exe
dRun: [DelayShred] c:\progra~1\mcafee\mshr\shrcl.exe /p3 /q c:\users\rebelw~1\appdata\local\temp\tempor~1.net\root\a9948d60\64a74056\assembly\dl3\2b070262\00f662~1.sh! c:\users\rebelw~1\appdata\local\temp\tempor~1.net\root\a9948d60\64a74056\assembly\dl3\2b070262.sh! c:\users\rebelw~1\appdata\local\temp\tempor~1.net\root\a9948d60\64a74056\assembly\dl3.sh! c:\users\rebelw~1\appdata\local\temp\tempor~1.net\root\a9948d60\64a74056\assembly.sh! c:\users\rebelw~1\appdata\local\temp\tempor~1.net\root\a9948d60\64a74056.sh! c:\users\rebelw~1\appdata\local\temp\tempor~1.net\root\a9948d60.sh! c:\users\rebelw~1\appdata\local\temp\tempor~1.net\root.sh! c:\users\rebelw~1\appdata\local\temp\TEMPOR~1.SH!
dRun: [RunWeather] c:\progra~1\crawler\weather\CWeather.exe /SHOWTRAY
StartupFolder: c:\users\rebelw~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\dhcpchk.lnk - c:\@home\tools\DHCPChk.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\wordweb.lnk - c:\program files\wordweb\wweb32.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: EnableLinkedConnections = 1 (0x1)
IE: &AOL Radio Toolbar Search - c:\programdata\aol radio toolbar\ietoolbar\resources\en-us\local\search.html
IE: &AOL Toolbar Search - c:\programdata\aol\ietoolbar\resources\en-us\local\search.html
IE: &Clean Traces - c:\program files\dap\privacy package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\dap\dapextie.htm
IE: &Webshots Photo Search - c:\program files\webshots\WSToolbar4IE.dll/MENUSEARCH.HTM
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: Download &all with DAP - c:\program files\dap\dapextie2.htm
IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: Scan link by Dr.Web - http://www.drweb.com/online/drweb-online-en.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\MSMSGS.EXE
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - c:\program files\wot\WOT.dll
AppInit_DLLs: avgrsstx.dllgoogle\google~1\goec62~1.dll

================= FIREFOX ===================

FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox 3 beta 4\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox 3 beta 4\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox 3 beta 4\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 ssfs0bbc;ssfs0bbc;c:\windows\system32\drivers\ssfs0bbc.sys [2009-4-21 29808]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2008-8-23 141312]
R2 AntiSpywareService;Comcast AntiSpyware;c:\program files\comcasttb\comcastspywarescan\ComcastAntiSpyService.exe [2009-3-16 616408]
R2 IS360service;IS360service;c:\program files\iobit\iobit security 360\is360srv.exe [2009-8-14 307472]
R2 LxrSII1d;Secure II Driver;c:\windows\system32\drivers\LxrSII1d.sys [2007-6-13 72672]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-8-9 206096]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512]
R2 VideoAcceleratorService;VideoAcceleratorService;c:\progra~1\speedbit video accelerator\videoacceleratorservice.exe -start -scm --> c:\progra~1\speedbit video accelerator\VideoAcceleratorService.exe -start -scm [?]
R2 WRConsumerService;Webroot Client Service;c:\program files\webroot\spy sweeper\WRConsumerService.exe [2009-5-17 1205760]
R3 dc3d;USBCCGP filter driver (dc3d);c:\windows\system32\drivers\dc3d.sys [2009-1-15 15360]
S3 BEFCMU10;Linksys BEFCMU10 EtherFast Cable Modem with USB;c:\windows\system32\drivers\BEFCMU10.sys [2007-6-4 15423]
S3 GVRBHBXP;GVRBHBXP;c:\users\rebelw~1\appdata\local\temp\gvrbhbxp.exe --> c:\users\rebelw~1\appdata\local\temp\GVRBHBXP.exe [?]
S3 L;L; [x]
S3 NETw2v32;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\drivers\NETw2v32.sys [2006-11-2 2589184]
S3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2009-3-24 7808]
S3 YFVHEBHD;YFVHEBHD; [x]
S3 ZYYUPLOMAEG;ZYYUPLOMAEG; [x]

=============== Created Last 30 ================

2009-08-14 14:48 775,168 a------- c:\windows\isRS-000.tmp
2009-08-13 09:52 <DIR> --dsh--- C:\$RECYCLE.BIN
2009-08-11 12:08 270,848 a------- c:\windows\system32\schannel.dll
2009-08-11 12:08 1,259,008 a------- c:\windows\system32\lsasrv.dll
2009-08-11 12:08 439,864 a------- c:\windows\system32\drivers\ksecdd.sys
2009-08-11 12:08 72,704 a------- c:\windows\system32\secur32.dll
2009-08-11 12:08 9,728 a------- c:\windows\system32\lsass.exe
2009-08-11 12:08 160,256 a------- c:\windows\system32\wkssvc.dll
2009-08-01 11:06 <DIR> --d----- c:\program files\Michael's Ghost-Fox
2009-08-01 11:05 <DIR> --d----- c:\program files\common files\DivX Shared
2009-07-30 10:17 <DIR> --d----- c:\programdata\NOS
2009-07-29 07:35 915,456 a------- c:\windows\system32\wininet.dll
2009-07-29 07:35 1,469,440 a------- c:\windows\system32\inetcpl.cpl
2009-07-29 07:34 133,632 a------- c:\windows\system32\ieUnatt.exe
2009-07-29 07:34 109,056 a------- c:\windows\system32\iesysprep.dll
2009-07-29 07:34 71,680 a------- c:\windows\system32\iesetup.dll
2009-07-29 07:34 1,638,912 a------- c:\windows\system32\mshtml.tlb
2009-07-29 07:34 57,667 a------- c:\windows\system32\ieuinit.inf
2009-07-22 20:27 <DIR> --d----- c:\programdata\AOL Radio Toolbar
2009-07-22 20:27 <DIR> --d----- c:\progra~2\AOL Radio Toolbar
2009-07-22 20:27 <DIR> --d----- c:\program files\AOL Radio Toolbar

==================== Find3M ====================

2009-08-14 16:58 143,360 a------- c:\windows\inf\infstrng.dat
2009-08-14 16:58 51,200 a------- c:\windows\inf\infpub.dat
2009-07-30 11:00 1,574 a------- c:\users\rebelw~1\appdata\roaming\wklnhst.dat
2009-07-25 05:23 411,368 a------- c:\windows\system32\deploytk.dll
2009-07-17 07:54 71,680 a------- c:\windows\system32\atl.dll
2009-07-15 06:40 8,147,456 a------- c:\windows\system32\wmploc.DLL
2009-07-15 06:39 313,344 a------- c:\windows\system32\wmpdxm.dll
2009-07-15 06:39 4,096 a------- c:\windows\system32\dxmasf.dll
2009-07-15 06:39 7,680 a------- c:\windows\system32\spwmp.dll
2009-06-28 11:20 118,784 a------- c:\windows\SeaMonkeyUninstall.exe
2009-06-28 11:20 58,876 a------- c:\windows\mozver.dat
2009-06-28 11:19 118,784 a------- c:\windows\GREUninstall.exe
2009-06-15 08:54 175,104 a------- c:\windows\system32\wdigest.dll
2009-06-15 08:53 156,672 a------- c:\windows\system32\t2embed.dll
2009-06-15 08:53 218,624 a------- c:\windows\system32\msv1_0.dll
2009-06-15 08:52 23,552 a------- c:\windows\system32\lpk.dll
2009-06-15 08:52 499,712 a------- c:\windows\system32\kerberos.dll
2009-06-15 08:52 72,704 a------- c:\windows\system32\fontsub.dll
2009-06-15 08:51 10,240 a------- c:\windows\system32\dciman32.dll
2009-06-15 06:42 289,792 a------- c:\windows\system32\atmfd.dll
2009-06-10 05:38 91,136 a------- c:\windows\system32\avifil32.dll
2009-06-04 21:11 86,016 a------- c:\windows\inf\infstor.dat
2009-06-04 06:07 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-05-28 02:59 665,600 a------- c:\windows\inf\drvindex.dat
2009-01-28 12:19 30,615 a------- c:\users\rebelwoacloo\x.exe
2008-03-05 23:06 13,000,704 a------- c:\users\rebelwoacloo\seamonkey-1.1.8.en-US.win32.installer.exe
2007-12-04 03:19 13,025,280 a------- c:\users\rebelwoacloo\seamonkey-1.1.7.en-US.win32.installer.exe
2007-11-14 17:13 13,021,184 a------- c:\users\rebelwoacloo\seamonkey-1.1.6.en-US.win32.installer.exe
2006-11-02 06:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 06:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 06:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 06:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 03:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 03:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 03:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 03:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat
2002-01-03 07:15 61,440 a------- c:\windows\inf\i386\onetUSD.dll
1998-05-12 05:01 8,944 a------- c:\windows\inf\i386\Usbscan.sys
2006-04-14 00:43 8 a--shr-- c:\windows\neoqaz2.dll
2008-01-06 01:36 16,384 a--sh--- c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2008-01-06 01:36 32,768 a--sh--- c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2008-01-06 01:36 16,384 a--sh--- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\cookies\index.dat
2008-08-28 09:26 32,768 a--sh--- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012008082820080829\index.dat
2008-08-30 19:45 32,768 a--sh--- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012008083020080831\index.dat
2008-09-20 12:14 32,768 a--sh--- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012008092020080921\index.dat
2009-03-26 13:16 32,768 a--sh--- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012009032620090327\index.dat
2009-05-04 04:00 32,768 a--sh--- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012009050420090505\index.dat

============= FINISH: 17:00:25.07 ===============
Thanks again!

BC AdBot (Login to Remove)

 


#2 Shannon2012

Shannon2012

  • Security Colleague
  • 3,657 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina, USA
  • Local time:03:50 PM

Posted 27 August 2009 - 02:15 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE
Shannon

#3 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 36,962 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:03:50 PM

Posted 04 September 2009 - 05:31 AM

Due to the lack of feedback, this Topic is now closed.

In case you still have problems, please send me a Private message to reopen this topic within the next 5 days. Beyond that point, please start a new topic.

Orange Blossom :thumbup2:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users