Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Serious problem? Msword98.exe? Malware?


  • This topic is locked This topic is locked
65 replies to this topic

#16 dbwhit

dbwhit
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:09:25 AM

Posted 16 August 2009 - 01:40 PM

BTW...Reboot & load time appeared faster & smoother, but I just got Symantec AV Auto-Protect saying "Packed.Generic.233"...Filename "BN2.tmp"...location "C:\windows\temp\"...Action taken "Restart required - Cleaned by deletion"

Waiting for your reply, before doing anything...For safety, I'll disable internet connection.

BC AdBot (Login to Remove)

 


#17 kahdah

kahdah

  • Security Colleague
  • 11,138 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:10:25 AM

Posted 16 August 2009 - 01:42 PM

That is fine please download the file then disconnect from the internet then go through with my previous instructions.
Please do not pm for help, post it in the forums instead.

If I am helping you and have not responded for 48 hours please send me a pm as I don't always get notifications.

My help is always free, however, if you would like to make a donation to me for the help I have provided please click here Posted Image

#18 dbwhit

dbwhit
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:09:25 AM

Posted 16 August 2009 - 05:17 PM

Ok looks better please do the following:

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

  • Doubleclick the drweb-cureit.exe file and Allow to run the express scan
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, mark the drives that you want to scan.
  • Select all drives. A red dot shows which drives have been chosen.
  • Click the green arrow at the right, and the scan will start.
  • Click 'Yes to all' if it asks if you want to cure/move the file.
  • When the scan has finished, in the menu, click file and choose save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.
  • Post that log in your next reply.
(Note if you cannot open the log it produces then right click on it and choose rename.
Rename it to .txt and you will be able to open it)


Ok....I ran drweb-cureit.exe & only had 2 options "Start" & "Update"...NO express scan...so I choose "Start"...I then got the horrible "blue screen (BSD)" which stated

"STOP: 0x00000F4 (0x00000003,0x8A89A020, 0x8A89A194, 0x8060566e"..."physical memory dump"

Also reveived Windows error w/ this "Error signature"
BCCode : f4 BCP1 : 00000003 BCP2 : 8A89A020 BCP3 : 8A89A194
BCP4 : 8060566E OSVer : 5_1_2600 SP : 3_0 Product : 256_1


I'll try again?

#19 kahdah

kahdah

  • Security Colleague
  • 11,138 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:10:25 AM

Posted 16 August 2009 - 07:30 PM

Ok try this instead:

Please perform the following online scan:

* Go here to run an online scannner from ESET.
  • Note: You will need to use Internet explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Check next options: Remove found threats and Scan unwanted applications.
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic

Please do not pm for help, post it in the forums instead.

If I am helping you and have not responded for 48 hours please send me a pm as I don't always get notifications.

My help is always free, however, if you would like to make a donation to me for the help I have provided please click here Posted Image

#20 dbwhit

dbwhit
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:09:25 AM

Posted 16 August 2009 - 07:43 PM

Ok....I ran drweb-cureit.exe & only had 2 options "Start" & "Update"...I choose "Start"...I then got the horrible "blue screen (BSD)" which stated

"STOP: 0x00000F4 (0x00000003,0x8A89A020, 0x8A89A194, 0x8060566e"..."physical memory dump"

Also reveived Windows error w/ this "Error signature"
BCCode : f4 BCP1 : 00000003 BCP2 : 8A89A020 BCP3 : 8A89A194
BCP4 : 8060566E OSVer : 5_1_2600 SP : 3_0 Product : 256_1

Rebooted & rerun drweb, still no luck...This time reconnecting internet failed, then PC got super sluggish...Rebooted & was able to reconnect internet...Posting this reply & will try once again to run drweb...Post results in the morning...Thanks for your assistance.

#21 kahdah

kahdah

  • Security Colleague
  • 11,138 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:10:25 AM

Posted 17 August 2009 - 06:18 AM

Ok well it probably will continue to do that so go ahead with the online scanner please.
Please do not pm for help, post it in the forums instead.

If I am helping you and have not responded for 48 hours please send me a pm as I don't always get notifications.

My help is always free, however, if you would like to make a donation to me for the help I have provided please click here Posted Image

#22 dbwhit

dbwhit
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:09:25 AM

Posted 17 August 2009 - 11:51 AM

Ok...I ran drweb scan (x2) & both times it gave me something along the lines of "file location not found"(?)...click "ok"...brought up a drweb "purchase?" or "trial version?"...I closed out & disabled internet, then ran it again...Now, I didn't notice the underlined text ("Select all drives. A red dot shows which drives have been chosen Click the green arrow at the right, and the scan will start.") being like you described in the program. The way it was, is when I ran the program it showed a window w/ 2 options, "start" & "updare" (should the definitions be updated?)...I choose "start"...Then a Dr. Web description window appeared w/ "Start scan now?"..."ok" or "cancel"...Choose "ok"...At which it did a scan, but no other options (express & drives). When complete said "no viruses found" & no option under "File" to save report?...Then it allowed me to choose "express (default)", "complete", "custom"...Also when I click on the "Statistics" tab, I see a pull-down menu "Show statistics for:", default said "Total", drop down menu shows individual drives...Left it on "Total", at which time, I go back to "scan" tab & click a play button/icon (also a pause & stop) under the Dr. Web pic (green w/ DrWeb & spider(?), at which it did a longer, more indepth scan, during which it found the results posted below.

Note: When I went to save the result log it kept saying something like, "not enough quota", acted like RAM (3G) was full, eventually, I was able to save the following report.

drweb-cureit results:
ntfs.sys;C:\WINDOWS\system32\dllcache;BackDoor.Bulknet.404;Cured.;
ntfs.sys;C:\WINDOWS\system32\drivers;BackDoor.Bulknet.404;Cured.;

To be able to retrieve the above notes, I stepped back thru the process, having no problems w/ the "file location not found" issue. I even choose to run an additional scan which detected no problems.

Should the definitions have been updated, proir to scanning?

#23 dbwhit

dbwhit
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:09:25 AM

Posted 17 August 2009 - 11:53 AM

Ok try this instead:

Please perform the following online scan:

* Go here to run an online scannner from ESET.

  • Note: You will need to use Internet explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Check next options: Remove found threats and Scan unwanted applications.
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
  • Copy and paste that log as a reply to this topic



I missed this post last nite, but because the DrWebCureIt finally ran, this instruction can be skipped! That's okay...Right?

.

Edited by dbwhit, 17 August 2009 - 11:57 AM.


#24 kahdah

kahdah

  • Security Colleague
  • 11,138 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:10:25 AM

Posted 17 August 2009 - 12:41 PM

Go ahead with the Eset scan as well and post the log from it please.
Please do not pm for help, post it in the forums instead.

If I am helping you and have not responded for 48 hours please send me a pm as I don't always get notifications.

My help is always free, however, if you would like to make a donation to me for the help I have provided please click here Posted Image

#25 dbwhit

dbwhit
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:09:25 AM

Posted 17 August 2009 - 08:24 PM

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=6
# iexplore.exe=7.00.6000.16876 (vista_gdr.090625-2339)
# OnlineScanner.ocx=1.0.0.6048
# api_version=3.0.2
# EOSSerial=86d8c538ceb6654d82d04630abe65d47
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-08-18 01:21:35
# local_time=2009-08-17 09:21:35 (-0500, Eastern Daylight Time)
# country="United States"
# lang=9
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=3585 63 50 0 0
# compatibility_mode=4355 63 259 1 128950320809626532
# compatibility_mode=4354 63 259 1 128950320809626532
# compatibility_mode=5889 63 259 1 128950320809626532
# scanned=192606
# found=0
# cleaned=0
# scan_time=4027

#26 kahdah

kahdah

  • Security Colleague
  • 11,138 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:10:25 AM

Posted 17 August 2009 - 08:27 PM

Looks good how are things running?
  • Double click on OTL to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Under the Standard Registry box change it to All.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open one notepad window. OTListIt.Txt a This is saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.

Please do not pm for help, post it in the forums instead.

If I am helping you and have not responded for 48 hours please send me a pm as I don't always get notifications.

My help is always free, however, if you would like to make a donation to me for the help I have provided please click here Posted Image

#27 dbwhit

dbwhit
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:09:25 AM

Posted 17 August 2009 - 10:16 PM

:) :) Like NEW man...Like NEW!!! :) :cool: So many thanks & appreciation for your patience & instructions, w/out you & bleepingcomputer.com, I'd been screwed! I'll certainly get you a donation, I live on a disability check, so I hope you can wait til' the 3rd? What about the programs, should I uninstall them? But if I'm correct only 1 actually installed, right?

Could you answer a few questions?
1) What was my problem? virus, adware, or both?...Would you mind a simple explanation?

2) What What programs do you prefer when it comes to virus & adware protection?
-I generally use Symantec Endpoint Protection for virus & I've never got virus, but it didn't catch this one!
-I use to use Adaware Pro, but it stopped working last year. I uninstalled & reinstalled, but it still won't work. Could it've stopped working due to adware? Maybe it'll install now?

3) I'm thinking of getting rid of my old PC, but I'm concerned about private information.
-Is there a way to completely erase a hard drive?
-Would I need to be concerned of other hardware on it (RAM?) containing private information?
-Or to be safe just remove the hard drive completely?

:thumbup2: :) B) AGAIN...YOUR THE BEST!!! :) :) :)

WOOPS! Got so excited I forgot to post OTL log...My bad.

eOTL logfile created on: 8/17/2009 11:18:46 PM - Run 2
OTL by OldTimer - Version 3.0.10.7 Folder = C:\Documents and Settings\Doug Whitted\Desktop\New Folder
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 100.00% Memory free
4.00 Gb Paging File | 3.66 Gb Available in Paging File | 91.44% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 232.77 Gb Total Space | 121.11 Gb Free Space | 52.03% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Drive J: | 298.09 Gb Total Space | 215.06 Gb Free Space | 72.15% Space Free | Partition Type: NTFS

Computer Name: DOUGW
Current User Name: Doug Whitted
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe (Nero AG)
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - C:\Program Files\Maxtor\Sync\SyncServices.exe (Seagate Technology LLC)
PRC - C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation)
PRC - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit)
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)
PRC - C:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe (Symantec Corporation)
PRC - C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
PRC - C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe (Maxtor Corporation)
PRC - C:\Program Files\QuickBooks Online Backup\OnlineBackup.exe (SwapDrive, Inc.)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\WINDOWS\System32\osk.exe (Microsoft Corporation)
PRC - C:\WINDOWS\System32\MSSWCHX.EXE (Microsoft Corporation)
PRC - C:\WINDOWS\System32\cidaemon.exe (Microsoft Corporation)
PRC - C:\Documents and Settings\Doug Whitted\Desktop\New Folder\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Win32 Services (SafeList) ==========

SRV - (aawservice [Auto | Stopped]) -- File not found
SRV - (Adobe LM Service [On_Demand | Stopped]) -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe (Adobe Systems)
SRV - (Apple Mobile Device [Auto | Running]) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (Bonjour Service [Auto | Running]) -- C:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (ccEvtMgr [Auto | Running]) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (ccSetMgr [Auto | Running]) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (Symantec Corporation)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) -- c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (GoogleDesktopManager-061008-081103 [On_Demand | Stopped]) -- File not found
SRV - (helpsvc [Auto | Running]) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (IDriverT [On_Demand | Stopped]) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (idsvc [Unknown | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (InCDsrv [Auto | Running]) -- C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe (Nero AG)
SRV - (iPod Service [On_Demand | Stopped]) -- C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (LiveUpdate [On_Demand | Stopped]) -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE (Symantec Corporation)
SRV - (Maxtor Sync Service [Auto | Running]) -- C:\Program Files\Maxtor\Sync\SyncServices.exe (Seagate Technology LLC)
SRV - (NetTcpPortSharing [Disabled | Stopped]) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (NVSvc [Auto | Running]) -- C:\WINDOWS\System32\nvsvc32.exe (NVIDIA Corporation)
SRV - (odserv [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose [On_Demand | Stopped]) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (QBCFMonitorService [Auto | Running]) -- C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intuit)
SRV - (QBFCService [On_Demand | Stopped]) -- C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe (Intuit Inc.)
SRV - (SmcService [Auto | Running]) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe (Symantec Corporation)
SRV - (SNAC [On_Demand | Stopped]) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE (Symantec Corporation)
SRV - (Symantec AntiVirus [Auto | Running]) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe (Symantec Corporation)
SRV - (WMPNetworkSvc [On_Demand | Stopped]) -- C:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (cercsr6 [Boot | Stopped]) -- C:\WINDOWS\System32\drivers\cercsr6.sys (Adaptec, Inc.)
DRV - (COH_Mon [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\COH_Mon.sys (Symantec Corporation)
DRV - (ctsfm2k [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ctsfm2k.sys (Creative Technology Ltd)
DRV - (CTUSFSYN [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\ctusfsyn.sys (Creative Technology Ltd.)
DRV - (e1express [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\e1e5132.sys (Intel Corporation)
DRV - (eeCtrl [System | Running]) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv [On_Demand | Running]) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (GEARAspiWDM [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (HDAudBus [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (InCDfs [Disabled | Running]) -- C:\WINDOWS\System32\drivers\InCDFs.sys (Nero AG)
DRV - (InCDPass [System | Running]) -- C:\WINDOWS\System32\drivers\InCDPass.sys (Nero AG)
DRV - (incdrm [System | Running]) -- C:\WINDOWS\System32\drivers\InCDRm.sys (Nero AG)
DRV - (mf [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\mf.sys (Microsoft Corporation)
DRV - (monfilt [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\monfilt.sys (Creative Technology Ltd.)
DRV - (MXOPSWD [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\mxopswd.sys (Maxtor Corp.)
DRV - (NAVENG [On_Demand | Running]) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090816.003\NAVENG.SYS (Symantec Corporation)
DRV - (NAVEX15 [On_Demand | Running]) -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20090816.003\NAVEX15.SYS (Symantec Corporation)
DRV - (NmPar [System | Running]) -- C:\WINDOWS\System32\DRIVERS\NmPar.sys (Windows ® 2000 DDK provider)
DRV - (nv [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (ossrv [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ctoss2k.sys (Creative Technology Ltd.)
DRV - (pcouffin [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\pcouffin.sys (VSO Software)
DRV - (Ptilink [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (PxHelp20 [Boot | Running]) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (SASDIFSV [System | Running]) -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM [On_Demand | Running]) -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL [System | Running]) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (Secdrv [On_Demand | Stopped]) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (Sentinel [Auto | Running]) -- C:\WINDOWS\System32\Drivers\SENTINEL.SYS (SafeNet, Inc.)
DRV - (SNTNLUSB [On_Demand | Running]) -- C:\WINDOWS\System32\DRIVERS\SNTNLUSB.SYS (SafeNet, Inc.)
DRV - (SPBBCDrv [System | Running]) -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys (Symantec Corporation)
DRV - (SRTSP [System | Running]) -- C:\WINDOWS\System32\Drivers\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPL [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\SRTSPL.SYS (Symantec Corporation)
DRV - (SRTSPX [System | Running]) -- C:\WINDOWS\System32\Drivers\SRTSPX.SYS (Symantec Corporation)
DRV - (SSIPDDP [Auto | Stopped]) -- C:\WINDOWS\System32\DRIVERS\SSIPDDP.SYS ()
DRV - (STHDA [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\sthda.sys (SigmaTel, Inc.)
DRV - (SymEvent [On_Demand | Running]) -- C:\WINDOWS\System32\Drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SYMREDRV [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS (Symantec Corporation)
DRV - (SYMTDI [System | Running]) -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS (Symantec Corporation)
DRV - (USBAAPL [On_Demand | Stopped]) -- C:\WINDOWS\System32\Drivers\usbaapl.sys (Apple, Inc.)
DRV - (usbaudio [On_Demand | Running]) -- C:\WINDOWS\System32\drivers\usbaudio.sys (Microsoft Corporation)

========== Standard Registry (All) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://search.msn.com/spbasic.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p...amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.waycrosslocal.com/
IE - URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\System32\ieframe.dll (Microsoft Corporation)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.waycrosslocal.com/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}:6.0.06
FF - prefs.js..extensions.enabledItems: {96118df2-0d02-4dbc-9ad5-98995dc7d977}:0.2.7
FF - prefs.js..extensions.enabledItems: {D02B1E87-A8C6-433f-9B5C-2CEC4A072736}:04.10.01.03
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.13


FF - HKLM\software\mozilla\Mozilla Firefox 3.0.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/08/03 23:07:53 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/08/03 23:07:53 | 00,000,000 | ---D | M]

[2009/04/04 15:58:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Doug Whitted\Application Data\mozilla\Extensions
[2008/08/26 20:59:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Doug Whitted\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009/04/04 15:58:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Doug Whitted\Application Data\mozilla\Extensions\mozswing@mozswing.org
[2009/08/17 20:49:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Doug Whitted\Application Data\mozilla\Firefox\Profiles\xvt5eq9k.default\extensions
[2009/02/07 17:22:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Doug Whitted\Application Data\mozilla\Firefox\Profiles\xvt5eq9k.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2008/06/26 17:40:06 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Doug Whitted\Application Data\mozilla\Firefox\Profiles\xvt5eq9k.default\extensions\{96118df2-0d02-4dbc-9ad5-98995dc7d977}
[2009/02/07 17:22:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Doug Whitted\Application Data\mozilla\Firefox\Profiles\xvt5eq9k.default\extensions\{D02B1E87-A8C6-433f-9B5C-2CEC4A072736}
[2009/02/07 17:22:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Doug Whitted\Application Data\mozilla\Firefox\Profiles\xvt5eq9k.default\extensions\{D02B1E87-A8C6-433f-9B5C-2CEC4A072736}-trash
[2009/06/04 17:09:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Doug Whitted\Application Data\mozilla\Firefox\Profiles\xvt5eq9k.default\extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6}
[2008/12/12 14:23:54 | 00,002,158 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\Application Data\Mozilla\FireFox\Profiles\xvt5eq9k.default\searchplugins\MySpace.xml
[2009/08/17 20:49:01 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009/08/03 23:07:53 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2008/06/01 14:16:30 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
[2009/08/03 23:07:47 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009/08/03 23:07:47 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2008/12/17 12:09:01 | 00,135,680 | ---- | M] (Google) -- C:\Program Files\mozilla firefox\components\GoogleDesktopMozilla.dll
[2008/06/27 16:03:12 | 01,446,440 | ---- | M] (Microsoft Corporation) -- C:\Program Files\mozilla firefox\plugins\npLegitCheckPlugin.dll
[2009/08/03 23:07:50 | 00,065,528 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2007/05/10 22:52:34 | 00,095,864 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\mozilla firefox\plugins\nppdf32.dll
[2009/06/04 19:24:34 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2009/06/04 19:24:34 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2009/06/04 19:24:34 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll
[2009/06/04 19:24:34 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll
[2009/06/04 19:24:34 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll
[2009/06/04 19:24:34 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll
[2009/06/04 19:24:34 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll
[2006/09/26 12:03:14 | 00,098,304 | ---- | M] (Zylom) -- C:\Program Files\mozilla firefox\plugins\npzylomgamesplayer.dll
[2007/05/16 08:22:00 | 00,151,300 | ---- | M] (NOS Microsystems Ltd.) -- C:\Program Files\mozilla firefox\plugins\np_gp.dll
[2009/02/06 18:08:23 | 00,001,394 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom.xml
[2009/02/06 18:08:23 | 00,002,193 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\answers.xml
[2009/02/06 18:08:23 | 00,001,534 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml
[2009/02/06 18:08:23 | 00,002,343 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay.xml
[2009/02/06 18:08:23 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2009/02/06 18:08:23 | 00,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia.xml
[2009/02/06 18:08:23 | 00,000,792 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml

O1 HOSTS File: (734 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\ShellBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\System32\SHELL32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\System32\SHELL32.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [mxomssmenu] C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe (Maxtor Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [Regedit32] C:\WINDOWS\System32\regedit.exe File not found
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKCU..\Run: [OnlineBackupScheduler] C:\Program Files\QuickBooks Online Backup\OnlineBackup.exe (SwapDrive, Inc.)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: C:\Documents and Settings\Doug Whitted\Start Menu\Programs\Startup\On-Screen Keyboard.lnk = C:\WINDOWS\System32\osk.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\npjpi160_06.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\System32\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\System32\mswsock.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: musicmatch.com ([online] https in Trusted sites)
O15 - HKLM\..Trusted Domains: 2 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd...b?1212085511437 (WUWebControl Class)
O16 - DPF: {6F714D46-E4EF-11D4-93EF-00D0D7032099} http://www.christianrock2.net/amp3dj.cab (Active DJ Studio ActiveX Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} file:///C:/Program%20Files/Autodesk%20Architectural%20Desktop%203/AcDcToday.ocx (AcDcToday Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} file:///C:/Program%20Files/Autodesk%20Architectural%20Desktop%203/InstFred.ocx (NOXLATE)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} file:///C:/Program%20Files/Autodesk%20Architectural%20Desktop%203/AcPreview.ocx (AcPreview Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 216.81.96.67 216.81.96.68
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\System32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\intu-help-qb1 {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll (TODO: <Company name>)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\System32\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\System32\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\qbwc {FC598A64-626C-4447-85B8-53150405FD57} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\System32\msvidctl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\System32\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\System32\wiascr.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/octet-stream - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-complus - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - application/x-msdownload - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter: - Class Install Handler - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - deflate - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - gzip - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - lzdhtml - C:\WINDOWS\System32\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Filter: - text/webviewhtml - C:\WINDOWS\System32\SHELL32.dll (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)
O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)
O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\System32\dimsntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)
O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\WlNotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation)
O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)
O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\System32\SHELL32.dll (Microsoft Corporation)
O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\System32\SHELL32.dll (Microsoft Corporation)
O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\System32\stobject.dll (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\System32\webcheck.dll (Microsoft Corporation)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\System32\WPDShServiceObj.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\System32\browseui.dll (Microsoft Corporation)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O27 - HKLM IFEO\Your Image File Name Here without a path: Debugger - C:\WINDOWS\System32\ntsd.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/06/25 16:22:21 | 00,000,047 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/08/16 13:37:54 | 00,000,055 | ---- | M] () - J:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{a14b656e-d6bd-11dd-a106-0019d13d8f04}\Shell - "" = Autorun
O33 - MountPoints2\{a14b656e-d6bd-11dd-a106-0019d13d8f04}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a14b656e-d6bd-11dd-a106-0019d13d8f04}\Shell\AutoRun\command - "" = C:\WINDOWS\System32\Shell32.DLL -- [2008/06/17 15:02:19 | 08,461,312 | ---- | M] (Microsoft Corporation)
O33 - MountPoints2\{a14b656e-d6bd-11dd-a106-0019d13d8f04}\Shell\Open\command - "" = L:\RECYCLER\S-1-1-21-100018033-100000048-100018173-1317.com -- File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()

========== Files/Folders - Created Within 30 Days ==========

[2009/08/17 20:10:18 | 00,000,000 | ---D | C] -- C:\Program Files\ESET
[2009/08/16 21:05:00 | 00,000,135 | ---- | C] () -- C:\Documents and Settings\Doug Whitted\Desktop\DrWeb.csv
[2009/08/16 17:48:17 | 15,579,448 | ---- | C] (Doctor Web, Ltd.) -- C:\Documents and Settings\Doug Whitted\Desktop\drweb-cureit.exe
[2009/08/16 12:19:14 | 00,000,000 | ---D | C] -- C:\_OTL
[2009/08/15 18:57:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Doug Whitted\Desktop\New Folder
[2009/08/15 16:56:26 | 00,230,295 | ---- | C] () -- C:\Documents and Settings\Doug Whitted\My Documents\Lemon Turkey Recipe.jpg
[2009/08/15 15:35:50 | 00,000,124 | ---- | C] () -- C:\Documents and Settings\Doug Whitted\Desktop\Serious problem Msword98.exe Malware.URL
[2009/08/14 09:10:36 | 00,003,026 | ---- | C] () -- C:\Documents and Settings\Doug Whitted\My Documents\cc_20090814_091031.reg
[2009/08/13 17:50:38 | 00,036,288 | ---- | C] () -- C:\Documents and Settings\Doug Whitted\My Documents\20387400_640X360.jpg
[2009/08/11 14:23:40 | 00,123,362 | ---- | C] () -- C:\Documents and Settings\Doug Whitted\My Documents\Winges-1967.jpg
[2009/08/11 13:30:21 | 00,128,512 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dhtmled.ocx
[2009/08/11 13:29:53 | 01,315,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msoe.dll
[2009/08/08 16:58:42 | 00,065,250 | ---- | C] () -- C:\Documents and Settings\Doug Whitted\My Documents\6134_243578780407_805660407_7999248_3582047_n.jpg
[2009/08/05 05:01:48 | 00,204,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mswebdvd.dll
[2009/08/03 23:16:56 | 00,000,958 | ---- | C] () -- C:\Documents and Settings\Doug Whitted\My Documents\cc_20090803_231654.reg
[2009/08/02 19:28:04 | 00,034,631 | ---- | C] () -- C:\Documents and Settings\Doug Whitted\My Documents\columbus2.jpg
[2009/08/02 19:09:28 | 00,180,203 | ---- | C] () -- C:\Documents and Settings\Doug Whitted\My Documents\Applied-Knowledge-by-Language-Arts-Crew_vR8FNt3HJtMx_full.jpg
[2009/08/02 19:06:47 | 01,306,966 | ---- | C] () -- C:\Documents and Settings\Doug Whitted\My Documents\language-arts-quotes.jpg
[2009/08/02 19:05:41 | 04,431,159 | ---- | C] () -- C:\Documents and Settings\Doug Whitted\My Documents\language-arts-small-run.jpg
[2009/07/27 14:48:31 | 00,000,656 | -H-- | C] () -- C:\Documents and Settings\All Users\Documents\os084633.bin
[2009/07/27 14:36:52 | 00,001,901 | ---- | C] () -- C:\WINDOWS\panose.bin
[2009/07/27 14:32:37 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Vbox
[2009/07/27 14:32:28 | 00,243,712 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\KPCP32.DLL
[2009/07/27 14:32:28 | 00,156,672 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\sprof32.dll
[2009/07/27 14:32:28 | 00,070,144 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\KPFP32.DLL
[2009/07/27 14:32:28 | 00,058,368 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\pfpick.dll
[2009/07/27 14:32:28 | 00,053,760 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\PTPICK32.DLL
[2009/07/27 14:32:28 | 00,048,128 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\KPSYS32.DLL
[2009/07/27 14:32:28 | 00,042,483 | ---- | C] () -- C:\WINDOWS\ICCCODES.DAT
[2009/07/27 14:32:28 | 00,039,095 | ---- | C] () -- C:\WINDOWS\Iccsigs.dat
[2009/07/27 14:32:28 | 00,031,744 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\KPSHARP.DLL
[2009/07/27 14:32:28 | 00,031,232 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\KPSCALE.DLL
[2009/07/27 14:32:28 | 00,020,992 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\icccodes.dll
[2009/07/27 14:32:28 | 00,000,156 | ---- | C] () -- C:\WINDOWS\KPCMS.INI
[2009/07/27 14:32:17 | 00,401,484 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSVCRTD.DLL
[2009/07/27 14:32:17 | 00,322,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MFC30.DLL
[2009/07/27 14:32:17 | 00,212,480 | ---- | C] (Eastman Kodak) -- C:\WINDOWS\PCDLIB32.DLL
[2009/07/27 14:32:17 | 00,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL
[2009/07/27 14:32:17 | 00,133,904 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MFCANS32.DLL
[2009/07/27 14:32:17 | 00,133,392 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MFCO30.DLL
[2009/07/27 14:32:17 | 00,094,285 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSVCIRTD.DLL
[2009/07/27 14:32:17 | 00,033,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\URLCACHE.DLL
[2009/07/27 14:32:17 | 00,032,792 | ---- | C] (Eastman Kodak Company) -- C:\WINDOWS\SPWHPT.DLL
[2009/07/27 14:32:17 | 00,006,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\W95FIBER.DLL
[2009/07/27 14:32:17 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MFCUIA32.DLL
[2009/07/27 14:32:10 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\Color
[2009/07/27 14:32:10 | 00,000,000 | ---D | C] -- C:\Kpcms
[2009/07/27 14:14:00 | 00,027,305 | ---- | C] () -- C:\Documents and Settings\Doug Whitted\My Documents\Tonya-Ad-01.pdf
[2009/07/27 14:05:00 | 00,028,971 | ---- | C] () -- C:\Documents and Settings\Doug Whitted\My Documents\Tonya-Ad.png
[2009/07/23 21:36:19 | 00,012,920 | ---- | C] () -- C:\Documents and Settings\Doug Whitted\My Documents\cc_20090723_213615.reg
[2009/07/09 17:51:23 | 00,021,504 | ---- | C] () -- C:\WINDOWS\System32\WBCustomizer.dll
[2008/09/14 12:01:47 | 00,000,000 | ---- | C] () -- C:\WINDOWS\mtstack.INI
[2008/08/15 15:54:37 | 00,055,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\SSIPDDP.SYS
[2008/07/19 13:47:28 | 00,006,656 | R--- | C] () -- C:\WINDOWS\System32\NmCoInst.dll
[2008/07/09 14:17:10 | 00,000,130 | ---- | C] () -- C:\WINDOWS\ccolwiz.ini
[2008/06/27 23:24:53 | 00,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2008/06/27 23:24:50 | 00,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008/06/27 23:24:50 | 00,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008/06/27 23:24:49 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/06/27 23:24:47 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2008/06/27 23:24:47 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2008/06/12 20:12:44 | 00,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2008/06/02 16:00:59 | 00,000,397 | ---- | C] () -- C:\WINDOWS\hpw9800k.ini
[2008/06/02 16:00:09 | 00,000,092 | ---- | C] () -- C:\WINDOWS\hpdj9800.ini
[2008/06/02 16:00:04 | 00,001,545 | ---- | C] () -- C:\WINDOWS\mariner.ini
[2008/05/31 17:30:02 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/05/29 14:15:25 | 00,022,629 | ---- | C] () -- C:\WINDOWS\System32\CiFilter.ini
[2006/04/17 22:08:14 | 00,017,920 | ---- | C] () -- C:\WINDOWS\System32\implode.dll
[2004/08/04 08:00:00 | 00,000,633 | ---- | C] () -- C:\WINDOWS\win.ini
[2004/08/04 08:00:00 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini

========== Files - Modified Within 30 Days ==========

[2009/08/17 11:51:37 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009/08/17 11:50:46 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009/08/17 11:50:30 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009/08/16 21:08:05 | 04,830,960 | -H-- | M] () -- C:\Documents and Settings\Doug Whitted\Local Settings\Application Data\IconCache.db
[2009/08/16 21:05:00 | 00,000,135 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\Desktop\DrWeb.csv
[2009/08/16 17:50:15 | 15,579,448 | ---- | M] (Doctor Web, Ltd.) -- C:\Documents and Settings\Doug Whitted\Desktop\drweb-cureit.exe
[2009/08/15 16:56:27 | 00,230,295 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\My Documents\Lemon Turkey Recipe.jpg
[2009/08/15 15:35:50 | 00,000,124 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\Desktop\Serious problem Msword98.exe Malware.URL
[2009/08/14 14:36:32 | 00,574,976 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\ntfs.sys
[2009/08/14 14:36:32 | 00,574,976 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntfs.sys
[2009/08/14 14:31:38 | 00,000,633 | ---- | M] () -- C:\WINDOWS\win.ini
[2009/08/14 14:31:38 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009/08/14 14:31:38 | 00,000,211 | -HS- | M] () -- C:\boot.ini
[2009/08/14 09:10:42 | 00,003,026 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\My Documents\cc_20090814_091031.reg
[2009/08/13 21:26:27 | 00,136,496 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\drivers\SYMEVENT.SYS
[2009/08/13 21:26:27 | 00,060,808 | ---- | M] (Symantec Corporation) -- C:\WINDOWS\System32\S32EVNT1.DLL
[2009/08/13 21:26:27 | 00,010,652 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.CAT
[2009/08/13 21:26:27 | 00,000,806 | ---- | M] () -- C:\WINDOWS\System32\drivers\SYMEVENT.INF
[2009/08/13 18:03:00 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009/08/13 17:50:38 | 00,036,288 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\My Documents\20387400_640X360.jpg
[2009/08/11 14:23:41 | 00,123,362 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\My Documents\Winges-1967.jpg
[2009/08/08 16:58:42 | 00,065,250 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\My Documents\6134_243578780407_805660407_7999248_3582047_n.jpg
[2009/08/08 12:59:05 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009/08/05 05:01:48 | 00,204,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mswebdvd.dll
[2009/08/05 05:01:48 | 00,204,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mswebdvd.dll
[2009/08/04 01:45:24 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2009/08/03 23:17:00 | 00,000,958 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\My Documents\cc_20090803_231654.reg
[2009/08/03 19:13:40 | 00,199,168 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 13:36:28 | 00,038,160 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/08/03 13:36:06 | 00,019,096 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2009/08/02 19:28:05 | 00,034,631 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\My Documents\columbus2.jpg
[2009/08/02 19:09:29 | 00,180,203 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\My Documents\Applied-Knowledge-by-Language-Arts-Crew_vR8FNt3HJtMx_full.jpg
[2009/08/02 19:06:48 | 01,306,966 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\My Documents\language-arts-quotes.jpg
[2009/08/02 19:05:41 | 04,431,159 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\My Documents\language-arts-small-run.jpg
[2009/07/29 20:49:14 | 24,281,536 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe
[2009/07/29 17:10:44 | 00,000,656 | -H-- | M] () -- C:\Documents and Settings\All Users\Documents\os084633.bin
[2009/07/27 18:27:12 | 00,128,512 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dhtmled.ocx
[2009/07/27 14:40:31 | 00,001,901 | ---- | M] () -- C:\WINDOWS\panose.bin
[2009/07/27 14:14:02 | 00,027,305 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\My Documents\Tonya-Ad-01.pdf
[2009/07/27 14:05:00 | 00,028,971 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\My Documents\Tonya-Ad.png
[2009/07/23 21:36:22 | 00,012,920 | ---- | M] () -- C:\Documents and Settings\Doug Whitted\My Documents\cc_20090723_213615.reg
[2009/07/19 09:33:02 | 03,597,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mshtml.dll
[2009/07/19 09:33:02 | 03,597,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2009/07/19 09:32:59 | 06,067,200 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\ieframe.dll
[2009/07/19 09:32:59 | 06,067,200 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll
< End of report >

Edited by dbwhit, 17 August 2009 - 10:27 PM.


#28 dbwhit

dbwhit
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:09:25 AM

Posted 18 August 2009 - 06:28 PM

I've still got my problem...See Malwarebytes & SuperAntiSpyware log below...

Malwarebytes' Anti-Malware 1.40

Database version: 2644
Windows 5.1.2600 Service Pack 3

8/18/2009 7:24:05 PM
mbam-log-2009-08-18 (19-24-05).txt

Scan type: Full Scan (C:\|)
Objects scanned: 284899
Time elapsed: 1 hour(s), 30 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 3
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{bca95e31-1fbf-4f84-8f23-1ba653007a1e} (Adware.Agent) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6156a32a-c512-4e23-aa9a-2315f4265681} (Adware.BHO) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{994b5fb4-0103-44a6-b6b3-c73572b362bc} (Adware.BHO) -> Delete on reboot.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msword98 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msword98 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Regedit32 (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd (Trace.Pandex) -> Quarantined and deleted successfully.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com


Generated 08/18/2009 at 00:40 AM

Application Version : 4.26.1006

Core Rules Database Version : 4060
Trace Rules Database Version: 2000

Scan type : Complete Scan
Total Scan Time : 00:37:15

Memory items scanned : 508
Memory threats detected : 0
Registry items scanned : 6929
Registry threats detected : 3
File items scanned : 22779
File threats detected : 4

Trojan.Agent/Gen
HKU\S-1-5-21-1659004503-776561741-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6156A32A-C512-4E23-AA9A-2315F4265681}

Adware.Vundo Variant
HKU\S-1-5-21-1659004503-776561741-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{994B5FB4-0103-44A6-B6B3-C73572B362BC}
HKU\S-1-5-21-1659004503-776561741-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BCA95E31-1FBF-4F84-8F23-1BA653007A1E}

Adware.Tracking Cookie
C:\Documents and Settings\Doug Whitted\Cookies\doug_whitted@ads.bleepingcomputer[2].txt
C:\Documents and Settings\Doug Whitted\Cookies\doug_whitted@doubleclick[1].txt
C:\Documents and Settings\Doug Whitted\Cookies\doug_whitted@advertising[1].txt
C:\Documents and Settings\Doug Whitted\Cookies\doug_whitted@kontera[2].txt

#29 kahdah

kahdah

  • Security Colleague
  • 11,138 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:10:25 AM

Posted 18 August 2009 - 08:37 PM

Download ComboFix from one of these locations:

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


Posted Image



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Posted Image


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Please do not pm for help, post it in the forums instead.

If I am helping you and have not responded for 48 hours please send me a pm as I don't always get notifications.

My help is always free, however, if you would like to make a donation to me for the help I have provided please click here Posted Image

#30 dbwhit

dbwhit
  • Topic Starter

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Local time:09:25 AM

Posted 19 August 2009 - 04:01 PM

Ok...I noticed that w/in the combofix log below QUICK BOOKS, multiple times, should I be concerned that my personnal info. has been hijacked?

ComboFix 09-08-18.04 - Doug Whitted 08/19/2009 16:44.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2557 [GMT -4:00]
Running from: c:\documents and settings\Doug Whitted\Desktop\ComboFix.exe
AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Doug Whitted\Application Data\inst.exe
c:\windows\system32\1d1673c4-b865-9478-144c-fad57635bd8a.exe
c:\windows\system32\drivers\1028_DELL_XPS_Dell DXP061 .MRK
c:\windows\system32\drivers\DELL_XPS_Dell DXP061 .MRK
J:\Autorun.inf

Infected copy of c:\windows\system32\mspmsnsv.dll was found and disinfected
Restored copy from - c:\windows\system32\dllcache\mspmsnsv.dll

.
((((((((((((((((((((((((( Files Created from 2009-07-19 to 2009-08-19 )))))))))))))))))))))))))))))))
.

2009-08-18 00:10 . 2009-08-18 00:10 -------- d-----w- c:\program files\ESET
2009-08-16 21:52 . 2009-08-16 21:52 -------- d-----w- c:\documents and settings\Doug Whitted\DoctorWeb
2009-08-16 16:19 . 2009-08-16 16:19 -------- d-----w- C:\_OTL
2009-08-11 17:29 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-05 09:01 . 2009-08-05 09:01 204800 -c----w- c:\windows\system32\dllcache\mswebdvd.dll
2009-07-27 18:36 . 2009-07-27 18:40 1901 ----a-w- c:\windows\panose.bin

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-19 20:49 . 2009-07-07 18:04 117760 ----a-w- c:\documents and settings\Doug Whitted\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-18 23:26 . 2008-06-12 23:27 -------- d-----w- c:\documents and settings\Doug Whitted\Application Data\Online Backup
2009-08-18 19:35 . 2008-06-08 19:51 7246 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2008\qbbackup.sys
2009-08-16 18:02 . 2009-07-07 16:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-14 18:36 . 2004-08-04 12:00 574976 ----a-w- c:\windows\system32\drivers\ntfs.sys
2009-08-14 01:26 . 2008-05-29 19:39 -------- d-----w- c:\program files\Symantec
2009-08-14 01:26 . 2008-05-29 19:40 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-14 01:26 . 2008-05-29 19:40 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-08-14 01:26 . 2008-05-29 19:40 136496 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-14 01:26 . 2008-05-29 19:40 10652 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-12 16:53 . 2008-05-29 20:13 -------- d-----w- c:\program files\Microsoft Silverlight
2009-08-12 02:53 . 2008-05-29 18:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-08-11 22:43 . 2009-07-16 04:29 3942048 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-05 09:01 . 2004-08-04 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 17:36 . 2009-07-07 16:49 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 17:36 . 2009-07-07 16:49 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-27 18:33 . 2009-07-27 18:33 87135 ----a-w- c:\windows\Fonts\AdobeFnt.lst
2009-07-27 18:32 . 2009-07-27 18:32 -------- d-----w- c:\program files\Common Files\Vbox
2009-07-27 18:32 . 2008-06-07 20:21 -------- d-----w- c:\program files\Common Files\Adobe
2009-07-24 01:38 . 2008-06-01 18:18 -------- d-----w- c:\documents and settings\Doug Whitted\Application Data\LimeWire
2009-07-17 19:01 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 03:43 . 2004-08-04 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-07 18:04 . 2009-07-07 18:04 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-07-07 18:04 . 2009-07-07 18:03 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-07-07 18:03 . 2009-07-07 18:03 -------- d-----w- c:\documents and settings\Doug Whitted\Application Data\SUPERAntiSpyware.com
2009-07-07 18:03 . 2008-05-29 21:32 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-07-07 16:49 . 2009-07-07 16:49 -------- d-----w- c:\documents and settings\Doug Whitted\Application Data\Malwarebytes
2009-07-07 16:49 . 2009-07-07 16:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-02 21:14 . 2008-08-15 19:53 -------- d-----w- c:\program files\SoftPlan14-1
2009-06-29 16:12 . 2004-08-04 12:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-06-29 16:12 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-06-29 16:12 . 2004-08-04 12:00 17408 ------w- c:\windows\system32\corpol.dll
2009-06-16 14:36 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2004-08-04 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-12 12:31 . 2004-08-04 12:00 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-04 12:00 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:13 . 2004-08-04 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 13:19 . 2008-05-29 15:15 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2004-08-04 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-04 23:16 . 2009-06-04 23:16 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe
2009-06-03 19:09 . 2004-08-04 12:00 1291264 ----a-w- c:\windows\system32\quartz.dll
2009-05-29 17:36 . 2009-06-04 23:22 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-05-29 17:36 . 2008-11-17 21:50 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2008-06-23 21:32 . 2009-06-14 22:10 262144 ----a-w- c:\program files\Uninstall Ask Toolbar.dll
2008-06-01 20:38 . 2008-06-01 17:51 12 ----a-w- c:\program files\softview.cfg
2008-06-01 19:02 . 2008-06-01 19:00 475 ----a-w- c:\program files\spReView.cfg
2008-06-01 19:02 . 2008-06-01 19:00 4454 ----a-w- c:\program files\spShortcut.cfg
2008-06-01 19:02 . 2008-06-01 19:00 262380 ----a-w- c:\program files\softplan.cfg
2008-06-01 18:56 . 2008-06-01 18:46 61 ----a-w- c:\program files\softplan.spu
2008-06-01 18:02 . 2008-06-01 18:02 1841 ----a-w- c:\program files\sr-patch.log
2008-06-01 18:02 . 2008-06-01 18:02 1841 ----a-w- c:\program files\st-patch.log
2008-06-01 18:02 . 2008-06-01 18:01 7913 ----a-w- c:\program files\sp-patch.log
2008-12-17 16:09 . 2008-12-17 16:09 135680 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
1997-07-21 23:30 . 1997-07-21 23:30 1045776 --sha-w- c:\windows\system32\Msjet35.dll
1997-06-23 07:00 . 1997-06-23 07:00 123664 --sha-w- c:\windows\system32\Msjint35.dll
1997-06-23 16:06 . 1997-06-23 16:06 24848 --sha-w- c:\windows\system32\Msjter35.dll
1997-06-23 16:06 . 1997-06-23 16:06 252176 --sha-w- c:\windows\system32\Msrd2x35.dll
1997-06-23 16:06 . 1997-06-23 16:06 287504 --sha-w- c:\windows\system32\Msxbse35.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OnlineBackupScheduler"="c:\program files\QuickBooks Online Backup\OnlineBackup.exe" [2007-11-02 610304]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-06-23 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2008-07-21 169312]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-17 8491008]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2006-03-20 282624]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

c:\documents and settings\Doug Whitted\Start Menu\Programs\Startup\
On-Screen Keyboard.lnk - c:\windows\system32\osk.exe [2004-8-4 215552]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Online Backup Scheduler.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Online Backup Scheduler.lnk
backup=c:\windows\pss\Online Backup Scheduler.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Doug Whitted^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=c:\documents and settings\Doug Whitted\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Doug Whitted^Start Menu^Programs^Startup^Narrator.lnk]
path=c:\documents and settings\Doug Whitted\Start Menu\Programs\Startup\Narrator.lnk
backup=c:\windows\pss\Narrator.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Doug Whitted^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\Doug Whitted\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"mW[־`=v%S8>grl>\=۱"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"=
"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"=
"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=
"c:\\Program Files\\MusicBrainz Picard\\picard.exe"=

R1 NmPar;MosChip PCI Parallel Port;c:\windows\system32\drivers\NmPar.sys [7/19/2008 1:47 PM 76416]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [6/23/2009 11:01 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [6/23/2009 11:01 AM 72944]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2/27/2009 2:40 PM 101936]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [6/23/2009 11:01 AM 7408]
S2 SSIPDDP;SSIPDDP Parallel port device driver;c:\windows\system32\drivers\SSIPDDP.SYS [8/15/2008 3:54 PM 55296]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [5/29/2007 1:55 PM 23888]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;"c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" --> c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [?]
.
Contents of the 'Scheduled Tasks' folder

2009-08-13 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-Symantec Antvirus


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.waycrosslocal.com/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: musicmatch.com\online
DPF: {6F714D46-E4EF-11D4-93EF-00D0D7032099} - hxxp://www.christianrock2.net/amp3dj.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
FF - ProfilePath - c:\documents and settings\Doug Whitted\Application Data\Mozilla\Firefox\Profiles\xvt5eq9k.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.waycrosslocal.com/
FF - component: c:\documents and settings\Doug Whitted\Application Data\Mozilla\Firefox\Profiles\xvt5eq9k.default\extensions\{D02B1E87-A8C6-433f-9B5C-2CEC4A072736}\components\susfox3.dll
FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll

---- FIREFOX POLICIES ----
FF - user.js: google.toolbar.linkdoctor.enabled - false
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-19 16:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]
"ImagePath"="a"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1659004503-776561741-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6156A32A-C512-4E23-AA9A-2315F4265681}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Flags"=dword:00000000
"Count"=dword:00000005
"Time"=hex:d8,07,04,00,01,00,15,00,02,00,13,00,10,00,b2,02

[HKEY_USERS\S-1-5-21-1659004503-776561741-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{994B5FB4-0103-44A6-B6B3-C73572B362BC}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Flags"=dword:00000000
"Count"=dword:0000002a
"Time"=hex:d8,07,05,00,02,00,14,00,0e,00,34,00,11,00,0d,03

[HKEY_USERS\S-1-5-21-1659004503-776561741-725345543-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BCA95E31-1FBF-4F84-8F23-1BA653007A1E}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Flags"=dword:00000000
"Count"=dword:00000001
"Time"=hex:d8,07,04,00,01,00,15,00,02,00,0e,00,1f,00,5a,01
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(708)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3612)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Nero\Nero 7\InCD\InCDsrv.exe
c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe
c:\program files\Common Files\Symantec Shared\ccSvcHst.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Maxtor\Sync\SyncServices.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\program files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
c:\program files\Symantec\Symantec Endpoint Protection\SmcGui.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\msswchx.exe
.
**************************************************************************
.
Completion time: 2009-08-19 16:54 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-19 20:53

Pre-Run: 129,913,311,232 bytes free
Post-Run: 129,810,505,728 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

264 --- E O F --- 2009-08-12 02:54




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users