Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Browser redirects


  • This topic is locked This topic is locked
17 replies to this topic

#1 m.manish

m.manish

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:31 AM

Posted 31 May 2010 - 11:36 AM

My browser randomly redirects to unknown websites, more so when I am browsing results from google. I scanned my system using Ad-Aware, Malwarebytes, Spybot and McAfee system, but that did not solve the problem. After browsing through this forum I ran the ComboFix and that has resolved the issue. However, I want to be sure that there is no more malware present on my laptop. I am attaching the DDS logs I generated after running the ComboFix. I tried to run gmer in the safe mode as well but my system kept crashing before the scan was completed. Thank you for your help.

-MM



DDS (Ver_10-03-17.01) - NTFSx86
Run by manish at 12:55:42.29 on Sun 05/30/2010
Internet Explorer: 8.0.6001.18904 BrowserJavaVersion: 1.6.0_15
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.2038.676 [GMT -5:00]

AV: McAfee VirusScan Enterprise *On-access scanning enabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\bcmwltry.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\System32\svchost.exe -k Akamai
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\CISVC.EXE
C:\Windows\System32\svchost.exe -k LPDService
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\WLTRAY.EXE
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\V0250Mon.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\sttray.exe
C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Copernic Desktop Search - Home\DesktopSearchService.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Windows\Explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\manish\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No File
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan enterprise\scriptcl.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Copernic Desktop Search - Home Toolbar: {4a1c6093-14f9-44d7-860e-5d265cfca9d9} - c:\program files\copernic desktop search - home\toolbar\ToolbarContainer101000318.dll
TB: {968631B6-4729-440D-9BF4-251F5593EC9A} - No File
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [Copernic Desktop Search - Home] "c:\program files\copernic desktop search - home\DesktopSearchService.exe" /tray
uRun: [Yahoo! Pager] "c:\progra~1\yahoo!\messen~1\YAHOOM~1.EXE" -quiet
uRun: [Google Update] "c:\users\manish\appdata\local\google\update\GoogleUpdate.exe" /c
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [ShStatEXE] "c:\program files\mcafee\virusscan enterprise\SHSTAT.EXE" /STANDALONE
mRun: [McAfeeUpdaterUI] "c:\program files\mcafee\common framework\UdaterUI.exe" /StartedFromRunKey
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [V0250Mon.exe] c:\windows\V0250Mon.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [c:\windows\system32\v0250ext.ax] c:\windows\system32\regsvr32.exe /s c:\windows\system32\V0250Ext.ax
mRun: [SigmatelSysTrayApp] sttray.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [RunTasktray] "c:\program files\hewlett-packard\hp easy printer care\hpprun.exe" --regkeypath=software\hewlett-packard\hp easy printer care\HPPRun --valuename=InstallTTM
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [OpwareSE4] "c:\program files\scansoft\omnipagese4\OpwareSE4.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
dRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\windows\installer\{53a01cc6-14b0-4512-a2e7-10d39bf83dc4}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office10\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: windowsupdate.com\download
Trusted Zone: hp.com
DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/en-US/wlscctrl2.cab
DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} - hxxp://dl.tvunetworks.com/TVUAx.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: hppfile - {C4E2084B-ED27-4893-A43D-488CA3F370E2} -
Handler: hppsam - {C4E2084B-ED27-4893-A43D-488CA3F370E2} -
Handler: hppzip - {C4E2084B-ED27-4893-A43D-488CA3F370E2} -
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\manish\appdata\roaming\mozilla\firefox\profiles\lsf4ww8f.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: c:\program files\mozilla firefox\plugins\npitifffree.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npSfAppM.dll
FF - plugin: c:\program files\picasa2\npPicasa3.dll
FF - plugin: c:\program files\veetle\player\npvlc.dll
FF - plugin: c:\program files\veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\veetle\vlcbroadcast\npvbp.dll
FF - plugin: c:\users\manish\appdata\local\google\update\1.2.183.27\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-5-29 64288]
R1 mferkdk;VSCore mferkdk;c:\program files\mcafee\virusscan enterprise\mferkdk.sys [2006-11-30 31944]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2008-9-16 21504]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-2-4 1314704]
R2 McAfeeFramework;McAfee Framework Service;c:\program files\mcafee\common framework\FrameworkService.exe [2007-4-5 104000]
R2 McShield;McAfee McShield;c:\program files\mcafee\virusscan enterprise\mcshield.exe [2006-11-30 144960]
R2 McTaskManager;McAfee Task Manager;c:\program files\mcafee\virusscan enterprise\vstskmgr.exe [2006-11-30 54872]
R2 RTWTKRNL;Real-Time Windows Target;c:\windows\system32\drivers\RTWTKRNL.sys [2007-9-10 27200]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2009-3-6 1153368]
R2 Viewpoint Service;Viewpoint Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-2-28 30152]
R3 mfeavfk;McAfee Inc.;c:\windows\system32\drivers\mfeavfk.sys [2007-4-5 72264]
R3 mfehidk;McAfee Inc.;c:\windows\system32\drivers\mfehidk.sys [2007-4-5 168776]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-9-16 21504]
S3 V0250Dev;Live! Cam Notebook Pro;c:\windows\system32\drivers\V0250Dev.sys [2007-6-16 169728]
S3 V0250Vfx;V0250Vfx;c:\windows\system32\drivers\V0250Vfx.sys [2007-7-27 6272]

============== File Associations ===============

.scr=RasWin.Script

=============== Created Last 30 ================

2010-05-30 17:21:21 0 d-sh--w- C:\$RECYCLE.BIN
2010-05-30 16:53:37 0 d-----w- C:\QUARANTINE
2010-05-30 16:36:31 98816 ----a-w- c:\windows\sed.exe
2010-05-30 16:36:31 77312 ----a-w- c:\windows\MBR.exe
2010-05-30 16:36:31 256512 ----a-w- c:\windows\PEV.exe
2010-05-30 16:36:31 161792 ----a-w- c:\windows\SWREG.exe
2010-05-30 04:27:51 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-05-30 03:47:45 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-05-30 03:47:34 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-05-30 03:42:23 0 dc-h--w- c:\programdata\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-05-30 03:41:27 0 d-----w- c:\programdata\Lavasoft
2010-05-30 03:41:27 0 d-----w- c:\program files\Lavasoft
2010-05-27 16:25:31 216247328 ----a-w- c:\windows\MEMORY.DMP
2010-05-26 19:36:59 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-26 19:36:52 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-26 19:36:51 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-25 22:52:24 2048 ----a-w- c:\windows\system32\tzres.dll
2010-05-12 17:33:19 738816 ----a-w- c:\windows\system32\inetcomm.dll
2010-05-06 19:06:01 336186 ----a-w- c:\users\manish\.recently-used.xbel
2010-05-02 08:55:28 71168 ----a-w- c:\windows\system32\telnet.exe

==================== Find3M ====================

2010-05-12 15:21:16 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-04 15:02:59 89380 ----a-w- c:\windows\fonts\browaz.ttf
2010-04-04 19:13:23 51200 ----a-w- c:\windows\inf\infpub.dat
2010-04-04 19:13:23 143360 ----a-w- c:\windows\inf\infstrng.dat
2010-04-04 19:13:23 143360 ----a-w- c:\windows\inf\infstor.dat
2010-03-05 14:01:02 420352 ----a-w- c:\windows\system32\vbscript.dll
2010-03-01 22:34:46 169385 ----a-w- c:\windows\hppins10.dat
2009-11-07 04:50:48 665600 ----a-w- c:\windows\inf\drvindex.dat
2008-11-03 23:21:02 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:39:34 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:39:34 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:39:34 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:39:34 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
2003-09-16 05:19:48 99544 ----a-w- c:\windows\inf\virprn.exe
2003-09-16 05:19:48 18950 ----a-w- c:\windows\inf\virpntd.dll
2003-09-16 05:19:48 10240 ----a-w- c:\windows\inf\virport.dll
2003-09-16 05:19:46 90624 ----a-w- c:\windows\inf\prtproc.dll
2009-05-31 05:39:15 16384 --sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\cookies\index.dat
2009-05-31 05:39:15 16384 --sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\history\history.ie5\index.dat
2009-05-31 05:39:15 32768 --sha-w- c:\windows\serviceprofiles\localservice\appdata\local\temp\temporary internet files\content.ie5\index.dat
2009-08-23 19:12:23 16384 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\history\history.ie5\index.dat
2009-08-23 19:12:43 32768 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat
2009-08-23 19:12:43 16384 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\temp\cookies\index.dat
2009-08-23 19:12:43 16384 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\temp\history\history.ie5\index.dat
2009-08-23 19:12:43 32768 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\local\temp\temporary internet files\content.ie5\index.dat
2009-08-23 19:12:23 16384 --sha-w- c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\windows\cookies\index.dat
2010-02-01 22:00:24 32768 --sha-w- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012010012520100201\index.dat
2010-02-01 22:00:24 32768 --sha-w- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012010020120100202\index.dat
2010-02-02 23:00:48 32768 --sha-w- c:\windows\system32\config\systemprofile\appdata\local\microsoft\windows\history\history.ie5\mshist012010020220100203\index.dat
2010-02-04 15:14:21 16384 --sha-w- c:\windows\system32\config\systemprofile\appdata\roaming\microsoft\windows\privacie\index.dat
2007-02-13 20:22:00 8192 --sha-w- c:\windows\users\default\NTUSER.DAT

============= FINISH: 12:58:07.26 ===============


BC AdBot (Login to Remove)

 


#2 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,252 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:02:31 PM

Posted 03 June 2010 - 05:47 AM

Hello ,
And welcome.gif to the Bleeping Computer Malware Removal Forum
. My name is Elise and I'll be glad to help you with your computer problems.


I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.
  • The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  • Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  • The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.
You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications. The topics you are tracking are shown here.
-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Please download OTL from one of the following mirrors:
  • Save it to your desktop.
  • Double click on the icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Push the button.
  • Two reports will open, copy and paste them in a reply here:
    • OTListIt.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.


  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and re-enable all active protection when done.
-- If you encounter any problems, try running GMER in Safe Mode.

-------------------------------------------------------------
In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply
  • A detailed description of your problems
  • A new OTL log (don't forget extra.txt)
  • GMER log

Thanks and again sorry for the delay.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#3 m.manish

m.manish
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:31 AM

Posted 03 June 2010 - 05:22 PM

Below are the logs from OTL scan. I could not run gmer since my system crashed in safe mode as well. Is there any other way I can run gmer?

-MM


OTL logfile created on: 6/3/2010 5:05:04 PM - Run 1
OTL by OldTimer - Version 3.2.5.3 Folder = C:\Users\manish\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 41.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 60.00% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 99.74 Gb Total Space | 17.28 Gb Free Space | 17.32% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 3.96 Gb Free Space | 39.61% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MM
Current User Name: manish
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/06/03 12:25:28 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Users\manish\Desktop\OTL.exe
PRC - [2010/05/29 22:46:35 | 000,840,416 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
PRC - [2010/05/29 22:46:33 | 001,314,704 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
PRC - [2010/04/01 08:48:10 | 001,602,048 | ---- | M] (Copernic Inc.) -- C:\Program Files\Copernic Desktop Search - Home\DesktopSearchService.exe
PRC - [2010/03/19 09:49:20 | 000,144,672 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010/02/21 11:28:19 | 000,307,672 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009/12/11 00:24:24 | 000,451,072 | ---- | M] (MoRUN.net) -- C:\Program Files\MoRUN.net\StickerLite\sticker.exe
PRC - [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008/04/04 12:10:26 | 000,030,152 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2008/01/19 02:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2007/09/12 18:27:24 | 000,554,352 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2007/02/04 11:02:14 | 000,079,400 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe
PRC - [2006/12/01 16:40:44 | 000,303,104 | ---- | M] (SigmaTel, Inc.) -- C:\Windows\sttray.exe
PRC - [2006/11/30 07:50:00 | 000,144,960 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
PRC - [2006/11/30 07:50:00 | 000,112,216 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe
PRC - [2006/11/30 07:50:00 | 000,054,872 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
PRC - [2006/11/17 12:40:56 | 000,136,768 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
PRC - [2006/11/17 12:39:58 | 000,136,768 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\UdaterUI.exe
PRC - [2006/11/17 12:37:44 | 000,104,000 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\FrameworkService.exe
PRC - [2006/11/17 02:06:00 | 000,086,016 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\Common Framework\Mctray.exe
PRC - [2006/11/12 03:19:46 | 000,446,976 | ---- | M] (Gteko Ltd.) -- C:\Program Files\DellSupport\DSAgnt.exe
PRC - [2006/11/08 20:47:14 | 001,066,528 | ---- | M] (Dell Inc) -- C:\Program Files\Dell\QuickSet\quickset.exe
PRC - [2006/11/05 12:22:16 | 000,221,184 | ---- | M] (Sonic Solutions) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
PRC - [2006/11/05 11:55:48 | 000,010,752 | ---- | M] (Sonic Solutions) -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
PRC - [2006/11/03 19:02:14 | 000,050,688 | ---- | M] (Avanquest Software ) -- C:\Program Files\Digital Line Detect\DLG.exe


========== Modules (SafeList) ==========

MOD - [2010/06/03 12:25:28 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Users\manish\Desktop\OTL.exe
MOD - [2009/04/11 01:21:38 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
MOD - [2008/01/19 02:33:00 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx
MOD - [2006/12/12 09:01:48 | 000,077,824 | ---- | M] () -- C:\Windows\System32\hccutils.dll
MOD - [2006/11/08 20:47:34 | 000,091,680 | ---- | M] () -- C:\Program Files\Dell\QuickSet\dadkeyb.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (CLTNetCnService)
SRV - [2010/05/29 22:46:33 | 001,314,704 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2010/03/19 09:49:20 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009/09/24 20:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/01/26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Stopped] -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008/04/04 12:10:26 | 000,030,152 | ---- | M] (Viewpoint Corporation) [Auto | Running] -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Service)
SRV - [2008/01/19 02:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008/01/19 02:34:43 | 000,035,328 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\lpdsvc.dll -- (LPDSVC)
SRV - [2007/09/12 18:27:24 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)
SRV - [2007/09/12 18:27:24 | 000,554,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatic LiveUpdate Scheduler)
SRV - [2006/11/30 07:50:00 | 000,144,960 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe -- (McShield)
SRV - [2006/11/30 07:50:00 | 000,054,872 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe -- (McTaskManager)
SRV - [2006/11/17 12:37:44 | 000,104,000 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\Common Framework\FrameworkService.exe -- (McAfeeFramework)
SRV - [2006/11/07 14:27:02 | 000,070,656 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\DellSupport\brkrsvc.exe -- (DSBrokerService)


========== Driver Services (SafeList) ==========

DRV - [2010/02/04 10:53:02 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\Lbd.sys -- (Lbd)
DRV - [2007/12/06 17:12:48 | 000,196,400 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
DRV - [2007/04/04 03:00:00 | 000,389,432 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2007/02/13 15:21:59 | 000,017,512 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2007/02/13 15:21:59 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2007/02/13 15:21:59 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2007/02/09 14:34:16 | 000,051,768 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\drivers\drvnddm.sys -- (DRVNDDM)
DRV - [2007/02/08 22:05:30 | 000,012,856 | ---- | M] (Roxio) [File_System | System | Running] -- C:\Windows\System32\drivers\DLACDBHM.SYS -- (DLACDBHM)
DRV - [2006/12/12 09:49:56 | 001,476,608 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx)
DRV - [2006/12/01 16:40:46 | 000,647,680 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2006/11/30 07:50:00 | 000,168,776 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfehidk.sys -- (mfehidk)
DRV - [2006/11/30 07:50:00 | 000,072,264 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfeavfk.sys -- (mfeavfk)
DRV - [2006/11/30 07:50:00 | 000,064,360 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfeapfk.sys -- (mfeapfk)
DRV - [2006/11/30 07:50:00 | 000,052,136 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mfetdik.sys -- (mfetdik)
DRV - [2006/11/30 07:50:00 | 000,031,944 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys -- (mferkdk)
DRV - [2006/11/27 17:55:54 | 000,534,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\BCMWL6.SYS -- (BCM43XX)
DRV - [2006/11/20 14:13:58 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2006/11/20 14:13:58 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2006/11/20 14:13:56 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006/11/11 18:10:40 | 000,986,624 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DPV.sys -- (HSF_DPV)
DRV - [2006/11/11 18:10:40 | 000,008,192 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
DRV - [2006/11/11 18:10:38 | 000,659,968 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_CNXT.sys -- (winachsf)
DRV - [2006/11/11 18:10:38 | 000,206,848 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWAZL.sys -- (HSXHWAZL)
DRV - [2006/11/02 04:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 04:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 04:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 04:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 04:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 04:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 04:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 04:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 04:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 04:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 04:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 04:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 04:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 04:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 04:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 04:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 04:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 04:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 04:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 04:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 04:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 04:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 04:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 04:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 04:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 04:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 04:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 04:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 04:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 04:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 04:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 04:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 03:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 03:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 03:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 03:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 03:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 03:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 02:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 02:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006/11/02 02:30:55 | 000,200,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel®
DRV - [2006/11/02 02:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel®
DRV - [2006/11/02 02:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2006/10/05 17:07:28 | 000,004,736 | ---- | M] (Gteko Ltd.) [Kernel | On_Demand | Running] -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys -- (DSproct)
DRV - [2006/09/24 08:28:46 | 000,005,248 | ---- | M] (Windows ® 2000 DDK provider) [Kernel | Boot | Running] -- C:\Windows\system32\speedfan.sys -- (speedfan)
DRV - [2006/08/18 14:18:08 | 000,009,400 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLADResM.SYS -- (DLADResM)
DRV - [2006/08/18 14:17:46 | 000,035,096 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLABMFSM.SYS -- (DLABMFSM)
DRV - [2006/08/18 14:17:44 | 000,097,848 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2006/08/18 14:17:44 | 000,094,648 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2006/08/18 14:17:42 | 000,026,008 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2006/08/18 14:17:40 | 000,032,472 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2006/08/18 14:17:38 | 000,104,472 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2006/08/18 14:17:38 | 000,014,520 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\Windows\System32\DLA\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2006/08/17 16:43:52 | 000,007,424 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\Program Files\DellSupport\Drivers\dsunidrv.sys -- (dsunidrv)
DRV - [2006/08/11 11:35:16 | 000,028,184 | ---- | M] (Roxio) [File_System | System | Running] -- C:\Windows\System32\drivers\DLARTL_M.SYS -- (DLARTL_M)
DRV - [2006/07/21 12:21:26 | 000,099,176 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\DRVMCDB.SYS -- (DRVMCDB)
DRV - [2005/07/27 08:40:08 | 000,027,200 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\RTWTKRNL.sys -- (RTWTKRNL)
DRV - [1996/04/03 14:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\system32\giveio.sys -- (giveio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=localhost:7171


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&cl...amp;ibd=3070213
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&cl...amp;ibd=3070213
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.google.com"
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: privatebrowsing@froilson.com:1.2.9
FF - prefs.js..extensions.enabledItems: {4776510a-a1f4-41f3-a3c8-35b474ecef23}:1.0.8
FF - prefs.js..network.proxy.http: "localhost"
FF - prefs.js..network.proxy.http_port: 7171

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.18\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/04/04 14:29:44 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.18\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/16 12:58:37 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/05/01 18:28:16 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2010/05/01 18:28:18 | 000,000,000 | ---D | M] -- C:\Users\manish\AppData\Roaming\Mozilla\Extensions
[2010/05/01 18:28:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\manish\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010/06/01 19:25:07 | 000,000,000 | ---D | M] -- C:\Users\manish\AppData\Roaming\Mozilla\Firefox\Profiles\lsf4ww8f.default\extensions
[2007/12/18 23:57:22 | 000,000,000 | ---D | M] (Adblock) -- C:\Users\manish\AppData\Roaming\Mozilla\Firefox\Profiles\lsf4ww8f.default\extensions\{34274bf4-1d97-a289-e984-17e546307e4f}
[2010/02/21 19:24:16 | 000,000,000 | ---D | M] (Stealther) -- C:\Users\manish\AppData\Roaming\Mozilla\Firefox\Profiles\lsf4ww8f.default\extensions\{4776510a-a1f4-41f3-a3c8-35b474ecef23}
[2010/04/13 21:30:00 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\manish\AppData\Roaming\Mozilla\Firefox\Profiles\lsf4ww8f.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2009/12/08 18:15:52 | 000,000,000 | ---D | M] -- C:\Users\manish\AppData\Roaming\Mozilla\Firefox\Profiles\lsf4ww8f.default\extensions\firefox@tvunetworks.com
[2009/03/11 03:09:04 | 000,000,000 | ---D | M] -- C:\Users\manish\AppData\Roaming\Mozilla\Firefox\Profiles\lsf4ww8f.default\extensions\moveplayer@movenetworks.com
[2010/02/21 11:28:57 | 000,000,000 | ---D | M] -- C:\Users\manish\AppData\Roaming\Mozilla\Firefox\Profiles\lsf4ww8f.default\extensions\privatebrowsing@froilson.com
[2010/06/01 19:25:07 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009/08/26 09:36:06 | 000,552,960 | ---- | M] (Innomage Enterprises, Inc) -- C:\Program Files\Mozilla Firefox\plugins\npitifffree.dll
[2005/08/17 10:49:08 | 000,036,864 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npSfAppM.dll

O1 HOSTS File: ([2010/05/30 12:21:00 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found.
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Copernic Desktop Search - Home Toolbar) - {4A1C6093-14F9-44D7-860E-5D265CFCA9D9} - C:\Program Files\Copernic Desktop Search - Home\Toolbar\ToolbarContainer101000318.dll (Copernic Inc.)
O3 - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001\..\Toolbar\WebBrowser: (no name) - {968631B6-4729-440D-9BF4-251F5593EC9A} - No CLSID value found.
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Program Files\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [OpwareSE4] C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [RunTasktray] File not found
O4 - HKLM..\Run: [ShStatEXE] C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE (McAfee, Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Windows\sttray.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\.DEFAULT..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - HKU\S-1-5-18..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001..\Run: [Copernic Desktop Search - Home] C:\Program Files\Copernic Desktop Search - Home\DesktopSearchService.exe (Copernic Inc.)
O4 - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: hp.com ([]http in Trusted sites)
O15 - HKLM\..Trusted Domains: hp.com ([]https in Trusted sites)
O15 - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001\..Trusted Domains: microsoft.com ([*.update] http in Trusted sites)
O15 - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001\..Trusted Domains: microsoft.com ([*.update] https in Trusted sites)
O15 - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001\..Trusted Domains: microsoft.com ([update] http in Trusted sites)
O15 - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001\..Trusted Domains: microsoft.com ([windowsupdate] http in Trusted sites)
O15 - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001\..Trusted Domains: windowsupdate.com ([download] http in Trusted sites)
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} http://cdn.scan.onecare.live.com/resource/...S/wlscctrl2.cab (Windows Live OneCare safety scanner control)
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} http://dl.tvunetworks.com/TVUAx.cab (CTVUAxCtrl Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash...r/ultrashim.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA} Reg Error: Value error. (Java Plug-in 1.4.1_07)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} Reg Error: Value error. (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} Reg Error: Value error. (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} Reg Error: Value error. (Java Plug-in 1.6.0_02)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} Reg Error: Value error. (Java Plug-in 1.6.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} Reg Error: Value error. (Java Plug-in 1.6.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} Reg Error: Value error. (Java Plug-in 1.6.0_05)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} Reg Error: Value error. (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} Reg Error: Value error. (Java Plug-in 1.6.0_10)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\hppfile {C4E2084B-ED27-4893-A43D-488CA3F370E2} - C:\Program Files\Hewlett-Packard\HP Easy Printer Care\HPPCtrls.dll File not found
O18 - Protocol\Handler\hppsam {C4E2084B-ED27-4893-A43D-488CA3F370E2} - C:\Program Files\Hewlett-Packard\HP Easy Printer Care\HPPCtrls.dll File not found
O18 - Protocol\Handler\hppzip {C4E2084B-ED27-4893-A43D-488CA3F370E2} - C:\Program Files\Hewlett-Packard\HP Easy Printer Care\HPPCtrls.dll File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\dellwall1.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\dellwall1.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001\...com [@ = ComFile] -- Reg Error: Key error. File not found
O37 - HKU\S-1-5-21-2298704923-4124134256-1251285377-1001\...exe [@ = exefile] -- Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/06/03 12:25:19 | 000,571,904 | ---- | C] (OldTimer Tools) -- C:\Users\manish\Desktop\OTL.exe
[2010/06/01 00:19:02 | 000,000,000 | ---D | C] -- C:\Users\manish\Desktop\malware removal logs
[2010/05/31 00:32:47 | 000,093,056 | ---- | C] (GMER) -- C:\fxldypow.sys
[2010/05/30 12:46:15 | 000,000,000 | ---D | C] -- C:\Users\manish\AppData\Local\temp
[2010/05/30 12:21:21 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010/05/30 11:53:37 | 000,000,000 | ---D | C] -- C:\QUARANTINE
[2010/05/30 11:36:31 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010/05/30 11:36:31 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010/05/30 11:36:31 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010/05/30 11:36:08 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/05/30 11:35:40 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/05/30 11:35:15 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010/05/29 22:47:45 | 000,064,288 | ---- | C] (Lavasoft AB) -- C:\Windows\System32\drivers\Lbd.sys
[2010/05/29 22:47:34 | 000,095,024 | ---- | C] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys
[2010/05/29 22:42:23 | 000,000,000 | -H-D | C] -- C:\ProgramData\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
[2010/05/29 22:41:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2010/05/29 22:41:27 | 000,000,000 | ---D | C] -- C:\Program Files\Lavasoft
[2010/05/29 21:52:51 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live Safety Center
[2010/05/26 14:36:59 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/05/26 14:36:52 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/05/26 14:36:51 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/05/25 17:52:24 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll
[2010/05/17 09:31:34 | 000,000,000 | ---D | C] -- C:\Users\manish\AppData\Roaming\Leadertech
[4 C:\Users\manish\Desktop\*.tmp files -> C:\Users\manish\Desktop\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/06/03 17:09:00 | 011,010,048 | -HS- | M] () -- C:\Users\manish\NTUSER.DAT
[2010/06/03 16:58:00 | 000,000,912 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2298704923-4124134256-1251285377-1001UA.job
[2010/06/03 16:47:53 | 000,003,680 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/06/03 16:47:53 | 000,003,680 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/06/03 16:38:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/06/03 13:03:07 | 000,699,422 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/06/03 13:03:07 | 000,601,098 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/06/03 13:03:07 | 000,103,464 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/06/03 12:25:28 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Users\manish\Desktop\OTL.exe
[2010/06/02 23:12:47 | 000,082,432 | ---- | M] () -- C:\Users\manish\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/02 20:43:43 | 000,000,860 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2298704923-4124134256-1251285377-1001Core.job
[2010/06/01 01:14:17 | 000,002,485 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickSet.lnk
[2010/06/01 01:13:38 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/06/01 01:11:33 | 000,524,288 | -HS- | M] () -- C:\Users\manish\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TMContainer00000000000000000001.regtrans-ms
[2010/06/01 01:11:33 | 000,065,536 | -HS- | M] () -- C:\Users\manish\NTUSER.DAT{d8932e6d-6a6f-11db-b6ab-a038f15a5785}.TM.blf
[2010/06/01 01:10:51 | 003,265,501 | -H-- | M] () -- C:\Users\manish\AppData\Local\IconCache.db
[2010/05/31 00:32:47 | 000,093,056 | ---- | M] (GMER) -- C:\fxldypow.sys
[2010/05/30 12:21:17 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini
[2010/05/30 12:21:00 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010/05/29 22:47:31 | 000,095,024 | ---- | M] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys
[2010/05/29 22:47:28 | 000,015,880 | ---- | M] () -- C:\Windows\System32\lsdelete.exe
[2010/05/29 11:38:45 | 000,000,887 | ---- | M] () -- C:\net_save.dna
[2010/05/18 22:25:05 | 000,000,283 | ---- | M] () -- C:\Windows\matlab.ini
[2010/05/14 23:24:06 | 000,394,502 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20100525-215523.backup
[2010/05/12 10:21:16 | 000,221,568 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2010/05/10 11:29:29 | 000,454,072 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/05/06 14:06:01 | 000,336,186 | ---- | M] () -- C:\Users\manish\.recently-used.xbel
[2010/05/06 13:56:01 | 000,008,987 | ---- | M] () -- C:\Users\manish\gsview32.ini
[4 C:\Users\manish\Desktop\*.tmp files -> C:\Users\manish\Desktop\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/05/30 11:36:31 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010/05/30 11:36:31 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010/05/30 11:36:31 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010/05/30 11:36:31 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010/05/30 11:36:31 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010/05/29 23:27:51 | 000,015,880 | ---- | C] () -- C:\Windows\System32\lsdelete.exe
[2010/05/26 22:33:13 | 000,001,923 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
[2010/05/06 14:06:01 | 000,336,186 | ---- | C] () -- C:\Users\manish\.recently-used.xbel
[2010/04/10 18:53:57 | 000,000,043 | ---- | C] () -- C:\Windows\gswin32.ini
[2010/03/01 17:32:49 | 000,000,129 | ---- | C] () -- C:\Windows\System32\AddPort.ini
[2010/02/01 16:44:29 | 000,000,880 | ---- | C] () -- C:\Windows\hpntwksetup.ini
[2010/01/07 06:38:43 | 000,000,510 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2009/09/22 15:32:36 | 000,503,808 | ---- | C] () -- C:\Windows\System32\tiff2pdf.dll
[2009/08/26 16:05:22 | 000,015,912 | ---- | C] () -- C:\Windows\System32\drivers\DiNs56K.sys
[2009/06/04 10:09:55 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/05/08 21:09:45 | 000,087,552 | ---- | C] () -- C:\Windows\System32\cpwmon2k.dll
[2009/05/08 20:37:12 | 000,010,240 | ---- | C] () -- C:\Windows\System32\virport.dll
[2009/02/10 14:33:16 | 000,181,248 | ---- | C] () -- C:\Windows\System32\HPEPCEnm.dll
[2009/02/10 14:33:02 | 000,163,840 | ---- | C] () -- C:\Windows\System32\hppatusg01.dll
[2008/11/21 16:47:52 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008/11/21 16:45:16 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dtu100.dll.manifest
[2008/11/21 16:45:16 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dpl100.dll.manifest
[2008/11/21 16:44:16 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2008/10/30 19:07:07 | 000,000,059 | ---- | C] () -- C:\Windows\LTDLGFILE14N.INI
[2008/10/21 00:58:30 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008/10/15 15:00:52 | 000,000,019 | ---- | C] () -- C:\Windows\wincrys.ini
[2008/09/04 12:10:48 | 000,011,776 | ---- | C] () -- C:\Windows\System32\pmsbfn32.dll
[2008/09/04 12:08:46 | 000,000,412 | ---- | C] () -- C:\Windows\MAXLINK.INI
[2008/07/11 14:44:44 | 000,065,536 | ---- | C] () -- C:\Windows\System32\ltserial.dll
[2008/03/03 01:14:43 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfmonnt.dll
[2007/11/19 18:59:27 | 000,000,051 | ---- | C] () -- C:\Windows\pdf2rtf.INI
[2007/09/10 14:00:11 | 000,027,200 | ---- | C] () -- C:\Windows\System32\drivers\RTWTKRNL.sys
[2007/05/28 18:35:43 | 000,598,016 | ---- | C] () -- C:\Windows\System32\viscomqtde.dll
[2007/05/28 18:35:43 | 000,262,144 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2007/04/05 01:20:34 | 000,000,280 | ---- | C] () -- C:\Windows\System32\epoPGPsdk.dll.sig
[2007/03/16 17:00:00 | 000,003,403 | ---- | C] () -- C:\Windows\System32\hptcpmon.ini
[2007/03/10 17:27:01 | 000,000,283 | ---- | C] () -- C:\Windows\matlab.ini
[2007/03/06 12:06:19 | 000,008,138 | ---- | C] () -- C:\Windows\Accord50.Ini
[2007/03/04 12:28:09 | 000,012,320 | ---- | C] () -- C:\Windows\SETUPDLG.DLL
[2007/02/13 15:22:31 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1114.dll
[2007/02/13 15:22:30 | 000,077,824 | ---- | C] () -- C:\Windows\System32\hccutils.dll
[2007/02/13 15:22:30 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2007/02/13 15:22:28 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2007/02/13 08:02:52 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2007/02/13 07:49:17 | 000,056,056 | ---- | C] () -- C:\Windows\System32\DLAAPI_W.DLL
[2007/02/13 07:49:17 | 000,000,307 | ---- | C] () -- C:\Windows\wininit.ini
[2007/02/13 07:38:34 | 000,065,536 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll
[2006/12/12 10:13:50 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1147.dll
[2006/12/12 09:02:50 | 000,053,248 | ---- | C] () -- C:\Windows\System32\oemdspif.dll
[2006/11/07 14:25:58 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006/11/02 05:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/09/17 00:36:50 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/09/17 00:36:50 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2003/01/07 04:35:08 | 000,002,695 | ---- | C] () -- C:\Windows\System32\OUTLPERF.INI
[2001/10/28 16:42:30 | 000,116,224 | ---- | C] () -- C:\Windows\System32\prnmnt.dll
[1999/01/22 13:46:56 | 000,065,536 | ---- | C] () -- C:\Windows\System32\MSRTEDIT.DLL
[1996/04/03 14:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:5C321E34
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:DFC5A2B2
< End of report >



OTL Extras logfile created on: 6/3/2010 5:05:04 PM - Run 1
OTL by OldTimer - Version 3.2.5.3 Folder = C:\Users\manish\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 41.00% Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 60.00% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 99.74 Gb Total Space | 17.28 Gb Free Space | 17.32% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 3.96 Gb Free Space | 39.61% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: MM
Current User Name: manish
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-2298704923-4124134256-1251285377-1001\SOFTWARE\Classes\<extension>]
.bat [@ = batfile] -- Reg Error: Key error. File not found
.cmd [@ = cmdfile] -- Reg Error: Key error. File not found
.com [@ = ComFile] -- Reg Error: Key error. File not found
.exe [@ = exefile] -- Reg Error: Key error. File not found
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.pif [@ = piffile] -- Reg Error: Key error. File not found
.vbs [@ = VBSFile] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UpdatesDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Hewlett-Packard\HP Easy Printer Care\HPPRun.exe" = C:\Program Files\Hewlett-Packard\HP Easy Printer Care\HPPRun.exe:*:Enabled:HP Easy Printer Care HPPRun -- File not found

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Hewlett-Packard\HP Easy Printer Care\HPPRun.exe" = C:\Program Files\Hewlett-Packard\HP Easy Printer Care\HPPRun.exe:*:Enabled:HP Easy Printer Care HPPRun -- File not found


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1B8281B2-06CB-4E50-AC57-5178CAB6EF44}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{572319F9-D5F4-4EF7-877C-958D0A52844A}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{91CE2644-D685-4DE7-A900-F5A97C16D47A}" = lport=49159 | protocol=6 | dir=in | name=akamai netsession interface |
"{F6E97B0F-A2F1-4A40-9328-11285EC8BCF1}" = lport=52348 | protocol=6 | dir=in | name=akamai netsession interface |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09E28325-1742-4C41-8C53-1A7136421A67}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{0E81AC4C-82D1-4500-893D-495C87D42F7F}" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"{11FABDA3-07CD-47E2-AD22-EE98914D5304}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{16BDC804-A1E9-4597-898C-C83F62883E19}" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"{186DA4BC-65C6-4380-8ADB-2205A7C938BB}" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"{1B51362C-ECD4-43D1-A87B-E42AECBE5F14}" = protocol=6 | dir=in | app=c:\program files\mcafee\virusscan enterprise\scan32.exe |
"{202B9659-D23D-4E30-B9A3-28BD6CA4F07D}" = protocol=6 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{264772C3-4481-44F2-BCC7-EF18DE4CAA16}" = protocol=6 | dir=in | app=c:\windows\system32\werfault.exe |
"{27F2ACA4-0B4F-4EAE-BA9B-B3E53AF2B299}" = protocol=17 | dir=in | app=c:\program files\sightspeed\sightspeed.exe |
"{2A73E16D-57ED-478E-B48B-35E0EEE1705E}" = protocol=6 | dir=in | app=c:\program files\mcafee\virusscan enterprise\scan32.exe |
"{3210B4BB-617A-4C64-9E82-93877A0BF118}" = protocol=17 | dir=in | app=c:\program files\mcafee\virusscan enterprise\scan32.exe |
"{32B53A3B-42A2-4A43-87E2-F983F621675D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3A579ABE-0851-44EC-AC85-0A46A2907566}" = protocol=17 | dir=in | app=c:\windows\v0250mon.exe |
"{3C6F9009-36E9-4CA6-93E4-2EF6BA006E17}" = protocol=17 | dir=in | app=c:\program files\mcafee\common framework\frameworkservice.exe |
"{48D89ACF-6A0E-473B-AC09-4C10FFD29E33}" = protocol=17 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\mathematica.exe |
"{4FABF97C-938C-4358-BEB7-A742CD3394B3}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{546C7C31-A7EB-4B7E-90F9-D13965D0244C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{600BC57C-324B-4B21-8243-A3633432D403}" = protocol=6 | dir=in | app=c:\windows\system32\logonui.exe |
"{6E59C82C-D68A-4227-9CDB-FECCED1103CD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6F8EF3B8-E12A-407B-8CD4-F4996D57BD73}" = protocol=6 | dir=in | app=c:\program files\sightspeed\sightspeed.exe |
"{70C0DFAE-6173-457B-8FA7-104A756F6350}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{71B0B651-DDF2-4B25-8D18-2BCCE9A76567}" = protocol=17 | dir=in | app=e:\setup\hppnet01.exe |
"{76D0E10A-A2A1-47DA-A96D-388DA7AC5FCE}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{777FDDC2-5C4E-4047-8154-BF22EEAFEED6}" = protocol=17 | dir=in | app=c:\windows\system32\winlogon.exe |
"{7BCC239F-8CEA-4283-AD82-1BC236278052}" = protocol=17 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\math.exe |
"{8C44D323-4CD2-499C-8AC7-A76E15CC4473}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{8DE4B171-D64B-44F4-A5B3-FB50F8B686F0}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{8E85AFF3-55B6-4D07-8021-6A4D62DE387F}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{9255371A-CF2E-475C-A712-9F3BB052E3B9}" = protocol=6 | dir=in | app=c:\windows\v0250mon.exe |
"{9D583779-2709-4EDB-9341-170055859C2E}" = protocol=17 | dir=in | app=c:\windows\system32\logonui.exe |
"{9F3B0562-6D1B-44E8-9818-630D0555D7C4}" = protocol=6 | dir=in | app=c:\windows\system32\winlogon.exe |
"{9F65111D-917E-488B-836E-AA1F7000B3A2}" = protocol=6 | dir=in | app=c:\windows\system32\winlogon.exe |
"{A244BBD0-7B65-4585-BF5D-0139EA186A34}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A72679AD-974A-43D3-AB7B-6682418A9C5A}" = protocol=6 | dir=in | app=c:\windows\system32\winlogon.exe |
"{A808BCC4-0D6E-4ACE-9768-C6C63A5F05B5}" = protocol=6 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\math.exe |
"{B121F1FC-D9E3-47AC-8FFF-34C2111A1A98}" = protocol=6 | dir=in | app=c:\program files\mcafee\common framework\frameworkservice.exe |
"{B38CC6DB-4556-4E10-B262-56EA00BA25A0}" = protocol=6 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\mathkernel.exe |
"{B95CB942-8A46-46FD-A7EB-1F220D085BE9}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{BE7DAEC4-BC79-42B7-BC73-FBE6E4B2FFE0}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{CA7E5035-D56C-400F-81F3-C98FA8963641}" = protocol=17 | dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{CDA22407-9E48-490B-82D7-5E24B7325A20}" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"{CEC50A13-0A2F-4FCA-BECE-F1B5B13B622F}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{D0201468-5250-4E64-9CE8-2C4F6E0DD240}" = protocol=6 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\mathematica.exe |
"{D2941ED8-3587-4D7E-96B4-AF964B293B4A}" = protocol=17 | dir=in | app=c:\program files\mcafee\virusscan enterprise\scan32.exe |
"{D7200443-E3A2-4E2F-A50E-DAA459FF6DBD}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{E7EF5B1E-0BCA-49B8-BEA2-E63970C9C7D1}" = protocol=17 | dir=in | app=c:\program files\wolfram research\mathematica\7.0\mathkernel.exe |
"{EB16FB44-A4B4-4FFD-9976-4EC916C33560}" = protocol=17 | dir=in | app=c:\windows\system32\werfault.exe |
"{FBA9567C-CC74-4912-89F4-23D24DFA275A}" = protocol=6 | dir=in | app=e:\setup\hppnet01.exe |
"{FF22F381-AF3D-4978-B85F-E536298191B3}" = protocol=17 | dir=in | app=c:\windows\system32\winlogon.exe |
"{FF365C62-DF0E-4F8D-97A6-A1DC329B5CCB}" = protocol=17 | dir=in | app=c:\windows\system32\winlogon.exe |
"TCP Query User{00B3C2F1-D60F-4B2C-AFEA-525214718DC4}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"TCP Query User{039ADD12-9DCE-4F79-A93F-211A52480429}C:\program files\morun.net\stickerlite\sticker.exe" = protocol=6 | dir=in | app=c:\program files\morun.net\stickerlite\sticker.exe |
"TCP Query User{245D1A16-17C0-4ADC-999C-062240D27995}C:\program files\morun.net\stickerlite\sticker.exe" = protocol=6 | dir=in | app=c:\program files\morun.net\stickerlite\sticker.exe |
"TCP Query User{316F17F2-DD05-45E5-A55C-A2A018EA57E3}C:\program files\imagej\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\imagej\jre\bin\javaw.exe |
"TCP Query User{5A855BD0-F76D-4C11-AFAC-E1FEE4452C55}C:\program files\matlab\r2006b\bin\win32\matlab.exe" = protocol=6 | dir=in | app=c:\program files\matlab\r2006b\bin\win32\matlab.exe |
"TCP Query User{6E4FA861-013D-443A-9337-4C2EDA304B71}C:\program files\java\jre1.6.0_01\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_01\bin\javaw.exe |
"TCP Query User{6F345E27-105A-471F-B7E2-A47F6F3F19B4}C:\program files\tvants\tvants.exe" = protocol=6 | dir=in | app=c:\program files\tvants\tvants.exe |
"TCP Query User{7039822B-760F-4AEB-BBA2-B5A8C05C947E}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"TCP Query User{709594DF-9F27-4571-A5F4-E37FA0339EED}C:\windows\system32\java.exe" = protocol=6 | dir=in | app=c:\windows\system32\java.exe |
"TCP Query User{7E72816B-5F52-4888-A728-2A303CA1DDCB}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"TCP Query User{7F06FFD1-AF6F-45E9-BF39-2ED3C05D6F90}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{96ADB0BF-0C6E-426D-8290-47150161306B}C:\program files\morun.net\sticker lite\sticker.exe" = protocol=6 | dir=in | app=c:\program files\morun.net\sticker lite\sticker.exe |
"TCP Query User{A54845B5-F294-4BDE-9DA3-23847CF70E02}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{B2338DEC-9085-44AD-A4F9-A81F24DBA448}C:\matlab7\bin\win32\matlab.exe" = protocol=6 | dir=in | app=c:\matlab7\bin\win32\matlab.exe |
"TCP Query User{B804CD0B-A23B-4560-8659-079272A0703C}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{BEC899CC-EDC3-44F0-88CD-E53B703DA628}C:\program files\java\jre1.6.0_01\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_01\bin\javaw.exe |
"TCP Query User{DA54C846-B534-43B1-A9FD-DD3F3ED536CC}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"TCP Query User{DA574320-0B7D-44AC-819D-20AA24E36BF1}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{DF281F80-CA10-4F2C-9484-28BAD5580967}C:\program files\imagej\jre\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\imagej\jre\bin\javaw.exe |
"TCP Query User{FDBE4DF6-FFFB-4306-907D-C9D3BCCF7232}C:\program files\matlab\r2006b\bin\win32\matlab.exe" = protocol=6 | dir=in | app=c:\program files\matlab\r2006b\bin\win32\matlab.exe |
"UDP Query User{24372E46-101F-4015-A4D0-E2B85864340E}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{27F8545C-0550-4F3A-A221-61B741136BFC}C:\program files\matlab\r2006b\bin\win32\matlab.exe" = protocol=17 | dir=in | app=c:\program files\matlab\r2006b\bin\win32\matlab.exe |
"UDP Query User{2C44EE5C-E378-486B-9ACE-07006FD45D47}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{45AD4D25-48BA-4955-87E5-074F15C735E8}C:\program files\morun.net\stickerlite\sticker.exe" = protocol=17 | dir=in | app=c:\program files\morun.net\stickerlite\sticker.exe |
"UDP Query User{55CBD133-8C5E-4A2B-BB3D-3B5CF5F561AC}C:\program files\imagej\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\imagej\jre\bin\javaw.exe |
"UDP Query User{5C4DC5E2-3C7F-4D59-9F96-BD509A616412}C:\program files\morun.net\stickerlite\sticker.exe" = protocol=17 | dir=in | app=c:\program files\morun.net\stickerlite\sticker.exe |
"UDP Query User{67FC6438-4360-4E35-9D12-CE47F7BA551E}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"UDP Query User{690445C6-A47F-42B2-9D9D-8286A04A0A51}C:\program files\java\jre1.6.0_01\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_01\bin\javaw.exe |
"UDP Query User{749127B4-A740-471D-8258-5D9DC903C7E1}C:\program files\imagej\jre\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\imagej\jre\bin\javaw.exe |
"UDP Query User{81E7EF67-421B-4AE7-B340-94F1ADFEB47C}C:\program files\matlab\r2006b\bin\win32\matlab.exe" = protocol=17 | dir=in | app=c:\program files\matlab\r2006b\bin\win32\matlab.exe |
"UDP Query User{92B372D7-999E-42DF-A6BE-DA4D2016A7CA}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{B334A3E8-A06B-4846-BED3-A4893A17F812}C:\windows\system32\java.exe" = protocol=17 | dir=in | app=c:\windows\system32\java.exe |
"UDP Query User{C65576A2-CD3C-4B8A-9061-ABCB55348213}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{CA2FEAF6-E62E-4FA5-95CD-9A601568EA0B}C:\program files\tvants\tvants.exe" = protocol=17 | dir=in | app=c:\program files\tvants\tvants.exe |
"UDP Query User{DBBDF70A-3F62-4435-9F08-ABB884978F06}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"UDP Query User{E26133A5-BC92-4975-939D-BF2633974F9D}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"UDP Query User{E633B14B-543E-49B1-A234-51ECE4F0CAC7}C:\program files\morun.net\sticker lite\sticker.exe" = protocol=17 | dir=in | app=c:\program files\morun.net\sticker lite\sticker.exe |
"UDP Query User{F11A970C-AF1E-499B-8258-09A9E83C46DF}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"UDP Query User{F14C0457-0533-4269-9D2A-99CA2BDBF5A5}C:\matlab7\bin\win32\matlab.exe" = protocol=17 | dir=in | app=c:\matlab7\bin\win32\matlab.exe |
"UDP Query User{F165F679-E1D1-4BAF-8213-312A8EBA5FEF}C:\program files\java\jre1.6.0_01\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_01\bin\javaw.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{13BA7B44-B712-4DEE-A7B8-1DD564F37AE5}" = Dell System Customization Wizard
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1DF91E52-9A42-4BC1-80DC-059ECF9F4DAA}" = Origin8
"{21053EC0-58A7-4CC4-A0A0-6E3C82449131}" = Poisson Superfish v7
"{21873256-A9DF-4F6B-8F37-6515B4A1989B}" = interneTIFF 8.0-FREE (IE Browser)
"{253137F7-509E-4C6D-ABE4-C3DA1CDA275C}" = interneTIFF 8.0-Free (FireFox)
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 15
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{338F08AB-C262-42C7-B000-34DE1A475273}" = Ad-Aware Email Scanner for Outlook
"{35C03C04-3F1F-42C2-A989-A757EE691F65}" = McAfee VirusScan Enterprise
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{47E02CC8-80EB-4908-BBFA-6428A6B77018}" = V613B22
"{49782B2F-49AE-423D-85D6-4EE7019CEA13}" = HP Easy Printer Care
"{53A01CC6-14B0-4512-A2E7-10D39BF83DC4}" = QuickSet
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{620797B0-A022-4B57-A95E-CD7DD0325012}" = MoRUN.net Sticker Lite
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{74E2CD0C-D4A2-11D3-95A6-0000E86CFDE5}" = SSH Secure Shell
"{76BC2442-0002-47FA-9617-43BAD82BEF4C}" = Bonjour
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{89B6F63A-7E0C-424A-9D39-C4EF59E96D78}" = hppQFolderCP2020
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{996A2FAA-7514-4628-9D12-A8FC34A0016E}" = iTunes
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A5F39441-3414-4db2-9A71-0BA8AB3CB16A}" = HP Color LaserJet CP2020 Series 1.0
"{A912021A-FEDD-4DA3-8DB4-245EBDA84778}" = Origin 8
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3.2
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B5C3B892-0849-476C-9F46-B12F84819D57}" = Apple Mobile Device Support
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C0A8F64F-36C8-489F-B813-90D60B541D1E}" = Device Data Communication Components
"{C260343B-6282-42A2-939F-1FF7E503F608}" = Wolfram Notebook Indexer 2.0
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0CE053E-0E5E-4C12-9BAE-D0F36021E911}" = POV-Ray for Windows v3.62
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D2D6B9EB-C6DC-4DAA-B4DE-BB7D9735E7DA}" = Presto! PageManager 7.15.16
"{D5842AC3-59C7-4DDD-BB33-54FE544DB3DA}" = Operating System Communication Components
"{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{DEE88727-779B-47A9-ACEF-F87CA5F92A65}" = ScanSoft OmniPage SE 4
"{E209F988-EF49-4B3D-84A6-3CBB67F058AC}" = Google SketchUp 7
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F7B0E599-C114-4493-BC4D-D8FC7CBBABBB}" = 32 Bit HP CIO Components Installer
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"AccelrysAccordSDK51RT" = Accord SDK 5.1 Runtime
"Ad-Aware" = Ad-Aware
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.3
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"CopernicDesktopSearch2" = Copernic Desktop Search - Home
"CutePDF Writer Installation" = CutePDF Writer 2.7
"DSMT5" = MathType 5
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"FLV-Media Player" = FLV-Media Player 1.6
"Foxit PDF Editor" = Foxit PDF Editor
"Foxit Reader" = Foxit Reader
"GPL Ghostscript 8.60" = GPL Ghostscript 8.60
"GPL Ghostscript Fonts" = GPL Ghostscript Fonts
"GSview 4.8" = GSview 4.8
"HDMI" = Intel® Graphics Media Accelerator Driver
"ImageJ_is1" = ImageJ 1.40g
"ImageMagick 6.5.3 Q16_is1" = ImageMagick 6.5.3-10 Q16 (2009-07-01)
"ImTOO MOV Converter" = ImTOO MOV Converter
"Inkscape" = Inkscape 0.46
"InstallShield_{21053EC0-58A7-4CC4-A0A0-6E3C82449131}" = Poisson Superfish v7
"latex2rtf" = LaTeX2RTF
"LEd_is1" = LEd Beta 0.51
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MatlabR2006b" = MATLAB R2006b
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MiKTeX 2.6" = MiKTeX 2.6
"MiniLyrics" = Minilyrics(remove only)
"Mozilla Firefox (3.0.18)" = Mozilla Firefox (3.0.18)
"Mozilla Thunderbird (3.0.4)" = Mozilla Thunderbird (3.0.4)
"M-WIN-G 7.0.0 1148361_is1" = Wolfram Mathematica 7 for Students (M-WIN-G 7.0.0 1148361)
"Picasa 3" = Picasa 3
"RealPlayer 6.0" = RealPlayer
"SopCast" = SopCast 2.0.4
"SpeedFan" = SpeedFan (remove only)
"SpywareBlaster_is1" = SpywareBlaster 4.3
"StreamTorrent 1.0" = Stream Torrent 1.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TVAnts 1.0" = TVAnts 1.0
"TVUPlayer" = TVUPlayer 2.4.5.3
"Universal Document Converter_is1" = Universal Document Converter
"VLC media player" = VLC media player 1.0.3
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"WinGimp-2.0_is1" = GIMP 2.4.2
"WinRAR archiver" = WinRAR archiver
"Yahoo! Messenger" = Yahoo! Messenger

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2298704923-4124134256-1251285377-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/3/2010 5:02:10 PM | Computer Name = MM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 6505

Error - 6/3/2010 5:38:07 PM | Computer Name = MM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 6/3/2010 5:38:07 PM | Computer Name = MM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2163594

Error - 6/3/2010 5:38:07 PM | Computer Name = MM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2163594

Error - 6/3/2010 5:38:10 PM | Computer Name = MM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 6/3/2010 5:38:10 PM | Computer Name = MM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2165747

Error - 6/3/2010 5:38:10 PM | Computer Name = MM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2165747

Error - 6/3/2010 5:38:12 PM | Computer Name = MM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 6/3/2010 5:38:12 PM | Computer Name = MM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2168445

Error - 6/3/2010 5:38:12 PM | Computer Name = MM | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2168445

[ Broadcom Wireless LAN Events ]
Error - 5/27/2010 12:30:27 PM | Computer Name = MM | Source = WLAN-Tray | ID = 0
Description = 11:30:27, Thu, May 27, 10 Error - Unable to switch user context, error
87

Error - 5/27/2010 12:36:17 PM | Computer Name = MM | Source = WLAN-Tray | ID = 0
Description = 11:36:17, Thu, May 27, 10 Error - Unable to switch user context, error
87

Error - 5/27/2010 12:38:40 PM | Computer Name = MM | Source = WLAN-Tray | ID = 0
Description = 11:38:40, Thu, May 27, 10 Error - Unable to gain access to user store


Error - 5/27/2010 12:40:47 PM | Computer Name = MM | Source = WLAN-Tray | ID = 0
Description = 11:40:47, Thu, May 27, 10 Error - Unable to gain access to user store


Error - 5/27/2010 12:42:32 PM | Computer Name = MM | Source = WLAN-Tray | ID = 0
Description = 11:42:32, Thu, May 27, 10 Error - Unable to switch user context, error
87

Error - 5/27/2010 12:47:26 PM | Computer Name = MM | Source = WLAN-Tray | ID = 0
Description = 11:47:26, Thu, May 27, 10 Error - Unable to gain access to user store


Error - 5/30/2010 1:20:43 PM | Computer Name = MM | Source = WLAN-Tray | ID = 0
Description = 12:20:37, Sun, May 30, 10 Error - Unable to gain access to user store


Error - 5/30/2010 4:03:22 PM | Computer Name = MM | Source = WLAN-Tray | ID = 0
Description = 15:03:18, Sun, May 30, 10 Error - Unable to gain access to user store


Error - 5/31/2010 1:26:13 AM | Computer Name = MM | Source = WLAN-Tray | ID = 0
Description = 00:26:12, Mon, May 31, 10 Error - Unable to gain access to user store


Error - 5/31/2010 2:35:27 AM | Computer Name = MM | Source = WLAN-Tray | ID = 0
Description = 01:35:26, Mon, May 31, 10 Error - Unable to gain access to user store


[ System Events ]
Error - 6/2/2010 9:30:19 PM | Computer Name = MM | Source = Dhcp | ID = 1001
Description = Your computer was not assigned an address from the network (by the
DHCP Server) for the Network Card with network address 00197D79E86A. The following
error occurred: %%258. Your computer will continue to try and obtain an address
on its own from the network address (DHCP) server.

Error - 6/3/2010 1:22:00 PM | Computer Name = MM | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.2.3 for the Network Card with network
address 00197D79E86A has been denied by the DHCP server 172.16.80.1 (The DHCP Server
sent a DHCPNACK message).

Error - 6/3/2010 1:22:31 PM | Computer Name = MM | Source = DCOM | ID = 10005
Description =

Error - 6/3/2010 1:22:31 PM | Computer Name = MM | Source = Service Control Manager | ID = 7009
Description =

Error - 6/3/2010 1:22:32 PM | Computer Name = MM | Source = Service Control Manager | ID = 7000
Description =

Error - 6/3/2010 1:41:42 PM | Computer Name = MM | Source = Server | ID = 2505
Description = The server could not bind to the transport \Device\NetBT_Tcpip_{933FC7CA-583C-4122-80E0-D7EFE4FBAF14}
because another computer on the network has the same name. The server could not
start.

Error - 6/3/2010 4:15:51 PM | Computer Name = MM | Source = Service Control Manager | ID = 7011
Description =

Error - 6/3/2010 5:38:12 PM | Computer Name = MM | Source = Service Control Manager | ID = 7011
Description =


< End of report >

Edited by m.manish, 03 June 2010 - 05:29 PM.


#4 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,252 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:02:31 PM

Posted 04 June 2010 - 03:12 AM

Hello, please try to run GMER with only the Sections option checked.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#5 m.manish

m.manish
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:31 AM

Posted 05 June 2010 - 11:59 AM

Below is the log file for GMER with only the sections option checked.

-MM

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-06-05 11:57:42
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\manish\AppData\Local\Temp\fxldypow.sys


---- Kernel code sections - GMER 1.0.15 ----

PAGE ntkrnlpa.exe!ZwTerminateProcess 84237DA3 5 Bytes JMP B03512CB \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

---- EOF - GMER 1.0.15 ----


#6 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,252 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:02:31 PM

Posted 05 June 2010 - 12:07 PM

Hello again,

COMBOFIX
---------------
Please download ComboFix from one of these locations:
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Double click on Combofix.exe and follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#7 m.manish

m.manish
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:31 AM

Posted 05 June 2010 - 01:07 PM

I had run ComboFix a few days back as well and that time it had removed some files. The log below are the results from the latest run.

-MM

ComboFix 10-06-03.01 - manish 06/05/2010 12:20:48.2.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.2038.808 [GMT -5:00]
Running from: c:\users\manish\Desktop\ComboFix.exe
AV: McAfee VirusScan Enterprise *On-access scanning enabled* (Updated) {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-05-05 to 2010-06-05 )))))))))))))))))))))))))))))))
.

2010-06-05 17:45 . 2010-06-05 17:45 -------- d-----w- c:\users\manish\AppData\Local\temp
2010-06-05 17:45 . 2010-06-05 17:45 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2010-06-05 17:45 . 2010-06-05 17:45 -------- d-----w- c:\users\temp\AppData\Local\temp
2010-06-05 17:45 . 2010-06-05 17:45 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-06-05 17:45 . 2010-06-05 17:45 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-06-02 03:49 . 2010-06-02 03:49 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\Sunbelt Software
2010-05-31 05:32 . 2010-05-31 05:32 93056 ----a-w- C:\fxldypow.sys
2010-05-30 16:53 . 2010-06-04 18:11 -------- d-----w- C:\QUARANTINE
2010-05-30 04:27 . 2010-05-30 03:47 15880 ----a-w- c:\windows\system32\lsdelete.exe
2010-05-30 03:47 . 2010-02-04 15:53 64288 ----a-w- c:\windows\system32\drivers\Lbd.sys
2010-05-30 03:47 . 2010-05-30 03:47 95024 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-05-30 03:42 . 2010-05-30 03:42 -------- dc-h--w- c:\programdata\{74D08EB8-01D1-4BAE-91E3-F30C1B031AC6}
2010-05-30 03:41 . 2010-05-30 03:47 -------- d-----w- c:\programdata\Lavasoft
2010-05-30 03:41 . 2010-05-30 03:42 -------- d-----w- c:\program files\Lavasoft
2010-05-30 02:52 . 2010-05-30 03:17 -------- d-----w- c:\program files\Windows Live Safety Center
2010-05-27 16:52 . 2010-05-27 17:01 -------- d-----w- c:\users\temp\AppData\Local\Microsoft
2010-05-27 16:52 . 2010-05-27 17:01 -------- d-----w- c:\users\temp
2010-05-27 03:40 . 2010-05-27 03:40 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\DivX
2010-05-27 03:38 . 2010-05-27 03:38 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\Apple Computer
2010-05-27 03:06 . 2010-05-27 03:06 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\Malwarebytes
2010-05-27 03:06 . 2010-05-27 03:06 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\Copernic
2010-05-27 03:05 . 2010-05-27 03:05 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\GTek
2010-05-26 19:36 . 2010-04-29 20:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-26 19:36 . 2010-04-29 20:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-26 19:36 . 2010-05-26 19:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-25 22:52 . 2010-04-23 14:13 2048 ----a-w- c:\windows\system32\tzres.dll
2010-05-17 14:31 . 2010-05-17 14:31 -------- d-----w- c:\users\manish\AppData\Roaming\Leadertech
2010-05-12 17:33 . 2010-01-29 15:40 738816 ----a-w- c:\windows\system32\inetcomm.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-05 05:30 . 2010-01-18 03:52 -------- d-----w- c:\users\manish\AppData\Roaming\vlc
2010-06-04 02:14 . 2008-01-18 04:01 -------- d-----w- c:\program files\SpeedFan
2010-06-01 05:30 . 2010-01-24 15:40 -------- d-----w- c:\program files\Common Files\Akamai
2010-06-01 05:26 . 2008-09-04 17:36 -------- d-----w- c:\users\manish\AppData\Roaming\Canon
2010-05-31 02:23 . 2007-05-08 01:01 -------- d-----w- c:\users\manish\AppData\Roaming\dvdcss
2010-05-29 20:48 . 2009-03-07 03:50 -------- d-----w- c:\program files\SpywareBlaster
2010-05-29 16:38 . 2008-02-02 18:43 -------- d-----w- c:\program files\support.com
2010-05-28 18:04 . 2010-05-01 23:27 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-05-27 03:22 . 2007-03-02 06:11 127456 ----a-w- c:\windows\system32\config\systemprofile\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-27 03:06 . 2007-02-13 12:49 -------- d-----w- c:\program files\DellSupport
2010-05-27 00:14 . 2009-08-27 19:25 -------- d-----w- c:\program files\Minilyrics
2010-05-15 04:37 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-05-12 15:21 . 2009-10-03 13:52 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-06 19:06 . 2008-01-11 23:32 -------- d-----w- c:\users\manish\AppData\Roaming\gtk-2.0
2010-05-01 23:28 . 2010-05-01 23:28 -------- d-----w- c:\users\manish\AppData\Roaming\Thunderbird
2010-04-21 02:13 . 2008-12-11 22:05 -------- d-----w- c:\program files\Copernic Desktop Search - Home
2010-04-19 20:29 . 2010-04-14 21:50 -------- d-----w- c:\users\manish\AppData\Roaming\Skype
2010-04-19 20:03 . 2010-04-14 21:52 -------- d-----w- c:\users\manish\AppData\Roaming\skypePM
2010-04-17 15:59 . 2010-04-17 15:59 159744 ----a-r- c:\users\manish\AppData\Roaming\Microsoft\Installer\{D0CE053E-0E5E-4C12-9BAE-D0F36021E911}\PVEngine.ProgramMe_D0CE053E0E5E4C129BAED0F36021E911.exe
2010-04-17 15:59 . 2010-04-17 15:59 159744 ----a-r- c:\users\manish\AppData\Roaming\Microsoft\Installer\{D0CE053E-0E5E-4C12-9BAE-D0F36021E911}\NewShortcut2_D0CE053E0E5E4C129BAED0F36021E911.exe
2010-04-17 15:59 . 2010-04-17 15:59 121334 ----a-r- c:\users\manish\AppData\Roaming\Microsoft\Installer\{D0CE053E-0E5E-4C12-9BAE-D0F36021E911}\ARPPRODUCTICON.exe
2010-04-17 15:58 . 2010-04-17 15:58 -------- d-----w- c:\program files\POV-Ray
2010-04-16 23:16 . 2010-04-14 21:46 -------- d-----r- c:\program files\Skype
2010-04-14 21:52 . 2010-04-14 21:52 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-04-14 21:46 . 2010-04-14 21:46 -------- d-----w- c:\program files\Common Files\Skype
2010-04-14 21:46 . 2010-04-14 21:45 -------- d-----w- c:\programdata\Skype
2010-04-03 23:02 . 2007-03-02 06:13 127456 ----a-w- c:\users\manish\AppData\Local\GDIPFONTCACHEV1.DAT
2007-02-13 20:22 . 2007-02-13 20:21 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2006-11-12 446976]
"Copernic Desktop Search - Home"="c:\program files\Copernic Desktop Search - Home\DesktopSearchService.exe" [2010-04-01 1602048]
"Google Update"="c:\users\manish\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-09-03 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RunTasktray"="c:\program files\Hewlett-Packard\HP Easy Printer Care\HPPRun.exe --regkeypath=Software\Hewlett-Packard\HP Easy Printer Care\HPPRun --valuename=InstallTTM" [X]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-11-27 1540096]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2006-11-30 112216]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 136768]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-12-12 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-12-12 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-12-12 81920]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1029416]
"SigmatelSysTrayApp"="sttray.exe" [2006-12-01 303104]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22 3739648 ----a-w- c:\users\manish\AppData\Roaming\Google\Google Talk\googletalk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-03-26 05:10 142120 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2006-08-17 15:00 1116920 ----a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 20:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
2006-10-25 13:03 210472 ----a-w- c:\program files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WrtMon.exe]
2006-09-20 12:35 20480 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\WrtMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(cool.gif:77,e5,e9,c5,30,e5,c9,01

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-05-30 1314704]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-02-04 64288]
S2 RTWTKRNL;Real-Time Windows Target;c:\windows\system32\drivers\RTWTKRNL.sys [2005-07-27 27200]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 Viewpoint Service;Viewpoint Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-04-04 30152]


--- Other Services/Drivers In Memory ---

*Deregistered* - fxldypow

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LPDService REG_MULTI_SZ LPDSVC
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-06-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2298704923-4124134256-1251285377-1001Core.job
- c:\users\manish\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-03 14:16]

2010-06-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2298704923-4124134256-1251285377-1001UA.job
- c:\users\manish\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-03 14:16]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\update
Trusted Zone: microsoft.com\windowsupdate
Trusted Zone: windowsupdate.com\download
Trusted Zone: hp.com
Handler: hppfile - {C4E2084B-ED27-4893-A43D-488CA3F370E2} -
Handler: hppsam - {C4E2084B-ED27-4893-A43D-488CA3F370E2} -
Handler: hppzip - {C4E2084B-ED27-4893-A43D-488CA3F370E2} -
FF - ProfilePath - c:\users\manish\AppData\Roaming\Mozilla\Firefox\Profiles\lsf4ww8f.default\
FF - prefs.js: browser.startup.homepage - www.google.com
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npitifffree.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npSfAppM.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - plugin: c:\users\manish\AppData\Local\Google\Update\1.2.183.27\npGoogleOneClick8.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-05 12:45
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(2888)
c:\progra~1\SPYBOT~1\SDHelper.dll
c:\program files\McAfee\VirusScan Enterprise\scriptcl.dll
.
Completion time: 2010-06-05 12:56:05
ComboFix-quarantined-files.txt 2010-06-05 17:56
ComboFix2.txt 2010-05-30 17:46

Pre-Run: 17,089,826,816 bytes free
Post-Run: 17,265,348,608 bytes free

- - End Of File - - C71E47A5B23BF06729312722D88179D3


#8 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,252 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:02:31 PM

Posted 05 June 2010 - 02:01 PM

I take it you are still experiencing the redirects? If so, please follow the steps below.
  • Please download TDSSKiller.zip and save it to your desktop.
  • Extract the zip file to your desktop (important, before continuing, make sure the file is located on your desktop, otherwise the following steps will not work!). Do NOT run the file yet!
  • Click Start > Run and copy paste the following bolded text in the run box
    "%userprofile%\desktop\tdsskiller.exe" -l report.txt
  • When it finished press any key to continue.
  • If needed reboot the computer.
A logfile (report.txt) will be created on your desktop. Please post its contents in your next reply.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#9 m.manish

m.manish
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:31 AM

Posted 05 June 2010 - 02:06 PM

No I am not experiencing redirects anymore. As I had mentioned in my first post, I want to be sure that there are no more malwares present on my computer. Should I still go ahead and run the TDSkillers tool. Thanks.

-MM

#10 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,252 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:02:31 PM

Posted 05 June 2010 - 02:15 PM

Sorry, my bad ohmy.gif I only read as far as the first two lines apparently...

No need for TDSSkiller in that case.

UPDATE JAVA
------------------
Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "JDK 6 Update 20 (JDK or JRE)".
  • Click the "Download JRE" button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u20-windows-i586.exe to install the newest version.
  • If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
  • When the Java Setup - Welcome window opens, click the Install > button.
  • If offered to install a Toolbar, just uncheck the box before continuing unless you want it.
-- Starting with Java 6u10, the uninstaller incorporated in each new release uses Enhanced Auto update to automatically remove the previous version when updating to a later update release. It will not remove older versions, so they will need to be removed manually.
-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.


Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.



MALWAREBYTES ANTIMALWARE
-------------------------------------------
Please launch MBAM and update the program before performing a scan.
  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Full Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.
Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#11 m.manish

m.manish
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:31 AM

Posted 05 June 2010 - 03:12 PM

Alright thanks a lot. My problem has been resolved. I will update programs on my computer.

-MM

#12 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,252 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:02:31 PM

Posted 05 June 2010 - 03:20 PM

Please post me also the MBAM scan results. Who knows what leftovers are still there, lack of symptoms doesn't always mean the patient is healthy (although, lets hope it) smile.gif

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#13 m.manish

m.manish
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:31 AM

Posted 06 June 2010 - 02:05 AM

Below is the MBAM scan log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4170

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

6/6/2010 1:13:49 AM
mbam-log-2010-06-06 (01-13-49).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 500375
Time elapsed: 9 hour(s), 17 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


#14 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,252 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:02:31 PM

Posted 06 June 2010 - 03:28 AM

Looks excellent. Since this was an antispyware scan, lets do also an antivirus scan before we are done.

ESET ONLINE SCANNER
----------------------------
I'd like us to scan your machine with ESET OnlineScan
  1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  2. Click the button.
  3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    1. Click on to download the ESET Smart Installer. Save it to your desktop.
    2. Double click on the icon on your desktop.
  4. Check
  5. Click the button.
  6. Accept any security warnings from your browser.
  7. Check
  8. Push the Start button.
  9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  10. When the scan completes, push
  11. Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    Note - when ESET doesn't find any threats, no report will be created.
  12. Push the button.
  13. Push

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#15 m.manish

m.manish
  • Topic Starter

  • Members
  • 13 posts
  • OFFLINE
  •  
  • Local time:06:31 AM

Posted 08 June 2010 - 12:06 PM

The results from ESET Scan are copied below:

C:\ProgramData\Spybot - Search & Destroy\Recovery\SmitfraudC.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined
C:\ProgramData\Spybot - Search & Destroy\Recovery\SmitfraudC1.zip Win32/Bagle.gen.zip worm cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Windows\system32\Drivers\tdx.sys.vir Win32/Olmarik.ZC trojan cleaned - quarantined
C:\Users\manish\AppData\Local\Mozilla\Firefox\Profiles\lsf4ww8f.default\Cache\7A8356B1d01 JS/Exploit.Pdfka.OAL trojan cleaned by deleting - quarantined
C:\Users\manish\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\7845b2d2-55642e4b a variant of Java/TrojanDownloader.Agent.NAN trojan deleted - quarantined
C:\Users\manish\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19\79571f53-114d1bde probably a variant of Win32/Agent trojan deleted - quarantined
C:\Users\manish\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32\38efbaa0-1777f8a3 a variant of Java/Exploit.Agent.F trojan deleted - quarantined
C:\Users\manish\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\77c3a532-4c8b17a9 multiple threats deleted - quarantined
C:\Users\manish\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\75a46a75-1e1344d2 multiple threats deleted - quarantined
C:\Users\manish\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6\5b3d5486-5917217f a variant of Java/TrojanDownloader.Agent.NAN trojan deleted - quarantined
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0\59b86c0-5c12ca9f a variant of Java/TrojanDownloader.Agent.NBA trojan deleted - quarantined
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\4b22c76d-69aa2660 a variant of Java/Exploit.Agent.F trojan deleted - quarantined
C:\Windows\winsxs\x86_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.0.6002.18005_none_ec294157d9377403\tdx.sys Win32/Olmarik.ZC trojan error while cleaning





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users