Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan? Virus? Worm? Cant install certain AV programs


  • This topic is locked This topic is locked
5 replies to this topic

#1 t3kn33k5

t3kn33k5

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:11:48 AM

Posted 29 July 2011 - 11:54 PM

A friend gave me this older computer and it has a lot of important files that have a lot of meaning to me on it. He was a fan of P2P software so there has been virus's on the computer before (will list below) but they have been removed. Right now the computer shut down at random times, runs slow, has unknown (to me) services, and problems with system files. If i try to open control panel from the start menu it causes explorer.exe to crash so I have to open the control panel apps from the system32 folder and then I am able to open ctrl pnl from start menu just fine. I know something is up and have ran ClamAV and MalwareBytes in safe mode too but nothing is detected? I know something is up.
I would be amazed and very grateful if someone took the time to look through these logs and tell me if anything is wrong.

Computer is an old Athalon XP
Running Windows XP SP1

--
This first log is from sysinternals rootkitrevealer:

HKU\S-1-5-21-1935655697-688789844-1343024091-1004\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1002\Filename	6/24/2005 6:34 PM	11 bytes	Data mismatch between Windows API and raw hive data.
HKU\S-1-5-21-1935655697-688789844-1343024091-1004\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1002\Description	6/24/2005 6:34 PM	25 bytes	Data mismatch between Windows API and raw hive data.
HKU\S-1-5-21-1935655697-688789844-1343024091-1004\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1003\Filename	6/24/2005 6:36 PM	11 bytes	Data mismatch between Windows API and raw hive data.
HKU\S-1-5-21-1935655697-688789844-1343024091-1004\Control Panel\Microsoft Input Devices\Mouse\Exceptions\1003\Description	6/24/2005 6:36 PM	25 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SECURITY\Policy\Secrets\SAC*	3/26/2005 2:35 PM	0 bytes	Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI*	3/26/2005 2:35 PM	0 bytes	Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*	7/10/2005 10:30 PM	0 bytes	Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*	7/10/2005 10:30 PM	0 bytes	Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*	7/10/2005 10:30 PM	0 bytes	Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*	7/10/2005 10:30 PM	0 bytes	Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*	7/10/2005 10:30 PM	0 bytes	Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*	7/10/2005 10:30 PM	0 bytes	Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*	7/10/2005 10:30 PM	0 bytes	Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\CLSID\{C4B4E99F-A677-11d7-A773-00C04F68F44E}\Pins\Input\Types\{10ed2d83-f16f-0348-2000-8c26b23e9a26}\22	8/15/2010 4:43 AM	91 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*	7/10/2005 10:30 PM	0 bytes	Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*	7/10/2005 10:30 PM	0 bytes	Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*	7/10/2005 10:30 PM	0 bytes	Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*	7/10/2005 10:30 PM	0 bytes	Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*	7/10/2005 10:30 PM	0 bytes	Key name contains embedded nulls (*)
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-0002-D54A-5341-4D504C457E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-0041-5250-4152-503236307E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-0043-534D-4353-2D3830567E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-0043-5356-4353-2D3830560000}\Description	8/15/2010 3:23 AM	11 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-0043-5356-4353-2D3830560000}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-004D-324F-4D4F-4F474D4F7E31}\Description	8/15/2010 3:23 AM	21 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-004D-324F-4D4F-4F474D4F7E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-004D-494E-4D49-4E494D4F7E31}\Description	8/15/2010 3:23 AM	15 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-004D-494E-4D49-4E494D4F7E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-3132-3836-4556-450000000000}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-3132-3836-4556-452D4D557E31}\Description	8/15/2010 3:23 AM	17 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-3132-3836-4556-452D4D557E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4153-4457-4449-524543547E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4246-4461-4246-44414C4C7E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4246-4467-4246-4447524F7E31}\Description	8/15/2010 3:23 AM	15 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4246-4467-4246-4447524F7E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4246-4473-4246-445354457E31}\Description	8/15/2010 3:23 AM	15 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4246-4473-4246-445354457E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4246-4475-4246-44554C547E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-434C-416D-4142-53594E547E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4554-4831-4554-484E4F537E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4644-3130-4458-313056537E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-464C-3031-464C-535455447E32}\Description	8/15/2010 3:23 AM	19 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-464C-3031-464C-535455447E32}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-464C-3136-464C-535455447E31}\Description	8/15/2010 3:23 AM	27 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-464C-3136-464C-535455447E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4741-3464-4752-4F4F56457E31}\Description	8/15/2010 3:23 AM	17 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4741-3464-4752-4F4F56457E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4834-4D39-416C-62696E6F0000}\Description	8/15/2010 3:23 AM	11 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4834-4D39-416C-62696E6F0000}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4974-4B74-494E-54414B547E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4B4C-4356-4C45-474143597E31}\Description	8/15/2010 3:23 AM	15 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4B4C-4356-4C45-474143597E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4B4C-4D56-4D53-2D3230000000}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4B4C-5056-506F-6C7973697800}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4B4C-5756-5741-564553547E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4E52-3473-5265-616B746F7234}\Description	8/15/2010 3:23 AM	13 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4E52-3473-5265-616B746F7234}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4E69-3453-4234-000000000000}\Description	8/15/2010 3:23 AM	7 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4E69-3453-4234-000000000000}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4E69-4274-4261-747465727900}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4E69-5353-4B6F-6E74616B7400}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4E69-566B-564F-4B41544F7E32}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-4E69-6644-464D-370000000000}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-5033-5346-5072-6F2D35330000}\Description	8/15/2010 3:23 AM	11 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-5033-5346-5072-6F2D35330000}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-5241-4A58-4A75-6E6F58320000}\Description	8/15/2010 3:23 AM	11 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-5241-4A58-4A75-6E6F58320000}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-534C-5932-536C-617965723200}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-5356-454E-5649-525455417E32}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-5361-5752-5361-776572000000}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-5361-6B52-5361-6B7572610000}\Description	8/15/2010 3:23 AM	11 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-5361-6B52-5361-6B7572610000}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-5361-7757-506F-695A6F6E6500}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-5369-5379-5349-4D53594E7E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-5379-7472-5359-545255537E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-5442-4C31-5442-4C0000000000}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-546F-7833-546F-786963494949}\Description	8/15/2010 3:23 AM	13 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-546F-7833-546F-786963494949}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-546F-7834-544F-584943427E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-554E-4B4E-4B4F-4D50414B7E31}\Description	8/15/2010 3:23 AM	15 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-554E-4B4E-4B4F-4D50414B7E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-5673-5372-4841-4C696F6E0000}\Description	8/15/2010 3:23 AM	11 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-5673-5372-4841-4C696F6E0000}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-5761-7370-5741-535056537E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-6775-7275-4755-525500000000}\Description	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-6775-7275-4755-525500000000}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-7273-667A-7366-7A0000000000}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-7362-3031-4252-4F4F4D537E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Classes\MfxSoftSynths\{141AC902-7376-656E-5649-525455417E31}\HelpFilePath	8/15/2010 3:23 AM	9 bytes	Data mismatch between Windows API and raw hive data.
HKLM\SYSTEM\ControlSet001\Services\d347prt\Cfg\0Jf40	7/29/2011 8:00 PM	0 bytes	Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\d347prt\Cfg\0Jf41	10/7/2005 9:50 AM	0 bytes	Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\d347prt\Cfg\0Jf42	10/7/2005 9:50 AM	0 bytes	Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\d347prt\Cfg\0Jf43	7/3/2005 3:26 AM	0 bytes	Hidden from Windows API.
C:\Documents and Settings\t3kn33k5\Local Settings\Application Data\Mozilla\Firefox\Profiles\x1420b4r.default\Cache\00AF533Ed01	7/29/2011 9:20 PM	16.87 KB	Hidden from Windows API.
C:\Documents and Settings\t3kn33k5\Local Settings\Application Data\Mozilla\Firefox\Profiles\x1420b4r.default\Cache\0E3F0913d01	7/29/2011 9:20 PM	23.05 KB	Hidden from Windows API.
C:\Documents and Settings\t3kn33k5\Local Settings\Application Data\Mozilla\Firefox\Profiles\x1420b4r.default\Cache\C795BBD9d01	7/29/2011 9:20 PM	99.30 KB	Hidden from Windows API.
C:\Documents and Settings\t3kn33k5\Local Settings\Application Data\Mozilla\Firefox\Profiles\x1420b4r.default\Cache\CB3B970Dd01	7/29/2011 9:22 PM	27.16 KB	Hidden from Windows API.
C:\Documents and Settings\t3kn33k5\Local Settings\Temp\ClamWin2.log	7/29/2011 7:50 AM	957 bytes	Visible in Windows API, MFT, but not in directory index.
C:\Documents and Settings\t3kn33k5\Local Settings\Temp\tmpd7ussc	7/29/2011 9:24 PM	362 bytes	Visible in directory index, but not Windows API or MFT.
C:\WINDOWS\Prefetch\CLAMSCAN.EXE-14E6E43C.pf	7/29/2011 9:23 PM	56.43 KB	Visible in directory index, but not Windows API or MFT.
C:\WINDOWS\Prefetch\CLAMWIN.EXE-39E79A76.pf	7/29/2011 9:23 PM	58.80 KB	Visible in directory index, but not Windows API or MFT.
J:	 	0 bytes	Error mounting volume
---

Next Log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:56:29 AM, on 7/29/2011
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Creative Professional\E-MU PatchMix DSP\EmuPatchMixDSP.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\jv16 PowerTools\jv16 PowerTools.exe
C:\rootkitbuster\RootkitBuster.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\BillP Studios\WinPatrol\WinPatrolEx.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\hh\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon
O4 - HKUS\S-1-5-21-1935655697-688789844-1343024091-1004\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe" (User '?')
O4 - HKUS\S-1-5-21-1935655697-688789844-1343024091-1004\..\Run: [SetDefaultMIDI] MIDIDef.exe (User '?')
O4 - HKUS\S-1-5-21-1935655697-688789844-1343024091-1004\..\Run: [ClamWin] "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon (User '?')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{0D34E708-5AAE-4471-8D49-DB96F3133591}: NameServer = 112.113.114.115,112.113.114.116
O17 - HKLM\System\CS1\Services\Tcpip\..\{0D34E708-5AAE-4471-8D49-DB96F3133591}: NameServer = 112.113.114.115,112.113.114.116
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Bwsvc - BUFFALO INC. - C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--
End of file - 5459 bytes
---

Next Log:
<code>
StartupList report, 7/28/2011, 5:16:02 AM
StartupList version: 1.52.2
Started from : C:\Program Files\hh\Trend Micro\HiJackThis\HiJackThis.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
* Including empty and uninteresting sections
* Showing rarely important sections
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ThreatFire\TFService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\Creative Professional\E-MU PatchMix DSP\EmuPatchMixDSP.exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\ThreatFire\TFTray.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\ClamWin\bin\ClamTray.exe
C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\t3kn33k5\ProcessExplorer\procexp.exe
C:\Program Files\hh\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\BillP Studios\WinPatrol\WinPatrolEx.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\t3kn33k5\Start Menu\Programs\Startup]
*No files*

Shell folders AltStartup:
*Folder not found*

User shell folders Startup:
*Folder not found*

User shell folders AltStartup:
*Folder not found*

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
ClientManager3.lnk = C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe

Shell folders Common AltStartup:
*Folder not found*

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

[HKLM\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

[HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
*Registry value not found*

[HKCU\Software\Microsoft\Windows\CurrentVersion\Winlogon]
*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe
WINDVDPatch = CTHELPER.EXE
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
gcasServ = "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
SunJavaUpdateSched = C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
CTHelper = CTHELPER.EXE
NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
H2O = C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe
WinPatrol = C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
ThreatFire = C:\Program Files\ThreatFire\TFTray.exe
Malwarebytes' Anti-Malware = "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

NBJ = "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
SetDefaultMIDI = MIDIDef.exe
ClamWin = "C:\Program Files\ClamWin\bin\ClamTray.exe" --logon

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No values found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run

*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
*No subkeys found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Run
*Registry key not found*

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" %*

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\System32\mshta.exe "%1" %*

--------------------------------------------------

File association entry for .TXT:
HKEY_CLASSES_ROOT\txtfile\shell\open\command

(Default) = %SystemRoot%\system32\NOTEPAD.EXE %1

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
StubPath = C:\WINDOWS\INF\unregmp2.exe /ShowWMP

[>{26923b43-4d38-484f-9b9e-de460746276c}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *
StubPath = %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE

[{2C7339CF-2B09-4501-B3F3-F3508C9228ED}] *
StubPath = %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

[{44BBA842-CC51-11CF-AAFA-00AA00B6015B}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT

[{4b218e3e-bc98-4770-93d3-2731b9329278}] *
StubPath = %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection MarketplaceLinkInstall 896 %systemroot%\inf\ie.inf

[{5945c046-1e7d-11d1-bc44-00c04fd912be}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.Install.PerUser

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp10.inf,PerUserStub

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = %SystemRoot%\system32\ie4uinit.exe

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *
StubPath = C:\WINDOWS\System32\Rundll32.exe C:\WINDOWS\System32\mscories.dll,Install

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=*INI section not found*
run=*INI section not found*

Load/Run keys from Registry:

HKLM\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKLM\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKLM\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: load=*Registry value not found*
HKCU\..\Windows NT\CurrentVersion\WinLogon: run=*Registry value not found*
HKCU\..\Windows\CurrentVersion\WinLogon: load=*Registry key not found*
HKCU\..\Windows\CurrentVersion\WinLogon: run=*Registry key not found*
HKCU\..\Windows NT\CurrentVersion\Windows: load=
HKCU\..\Windows NT\CurrentVersion\Windows: run=
HKLM\..\Windows NT\CurrentVersion\Windows: load=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: run=*Registry value not found*
HKLM\..\Windows NT\CurrentVersion\Windows: AppInit_DLLs=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present
C:\WINDOWS\Fonts\Explorer.exe: not present

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\WINDOWS\System32\PxSecure.dll - {69D72956-317C-44bd-B369-8E44D4EF9801}
(no name) - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll - {9394EDE7-C8B5-483E-8773-474BF36AF6E4}
(no name) - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}

--------------------------------------------------

Enumerating Task Scheduler jobs:

*No jobs found*

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\System32\mswsock.dll
NameSpace #2: C:\WINDOWS\System32\winrnr.dll
NameSpace #3: C:\WINDOWS\System32\mswsock.dll
Protocol #1: C:\WINDOWS\system32\mswsock.dll
Protocol #2: C:\WINDOWS\system32\mswsock.dll
Protocol #3: C:\WINDOWS\system32\mswsock.dll
Protocol #4: C:\WINDOWS\system32\rsvpsp.dll
Protocol #5: C:\WINDOWS\system32\rsvpsp.dll
Protocol #6: C:\WINDOWS\system32\mswsock.dll
Protocol #7: C:\WINDOWS\system32\mswsock.dll
Protocol #8: C:\WINDOWS\system32\mswsock.dll
Protocol #9: C:\WINDOWS\system32\mswsock.dll
Protocol #10: C:\WINDOWS\system32\mswsock.dll
Protocol #11: C:\WINDOWS\system32\mswsock.dll
Protocol #12: C:\WINDOWS\system32\mswsock.dll
Protocol #13: C:\WINDOWS\system32\mswsock.dll
Protocol #14: C:\WINDOWS\system32\mswsock.dll
Protocol #15: C:\WINDOWS\system32\mswsock.dll

--------------------------------------------------

Enumerating Windows NT/2000/XP services

Microsoft ACPI Driver: System32\DRIVERS\ACPI.sys (system)
Adobe LM Service: "C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe" (manual start)
Microsoft Kernel Acoustic Echo Canceller: system32\drivers\aec.sys (manual start)
AEGIS Protocol (IEEE 802.1x) v3.4.10.0: System32\DRIVERS\AegisP.sys (autostart)
AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (system)
Alerter: %SystemRoot%\System32\svchost.exe -k LocalService (disabled)
Application Layer Gateway Service: %SystemRoot%\System32\alg.exe (manual start)
AMD K7 Processor Driver: System32\DRIVERS\amdk7.sys (system)
Application Management: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
1394 ARP Client Protocol: System32\DRIVERS\arp1394.sys (manual start)
ASP.NET State Service: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe (manual start)
RAS Asynchronous Media Driver: System32\DRIVERS\asyncmac.sys (manual start)
Standard IDE/ESDI Hard Disk Controller: System32\DRIVERS\atapi.sys (system)
ATM ARP Client Protocol: System32\DRIVERS\atmarpc.sys (manual start)
Windows Audio: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Audio Stub Driver: System32\DRIVERS\audstub.sys (manual start)
BCM 802.11b Network Adapter Driver: System32\DRIVERS\bcmwl5.sys (manual start)
Background Intelligent Transfer Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Computer Browser: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
BUFADPT: \??\C:\WINDOWS\System32\BUFADPT.SYS (system)
Bwsvc: C:\Program Files\BUFFALO\Client Manager3\bwsvc\bwsvc.exe -Service (autostart)
BUFFALO WLI-CB-XXX Series Wireless LAN Adapter: System32\DRIVERS\CBG54.sys (manual start)
CD-ROM Driver: System32\DRIVERS\cdrom.sys (system)
Indexing Service: %SystemRoot%\system32\cisvc.exe (manual start)
Team H2O CLEDX service: System32\DRIVERS\cledx.sys (manual start)
ClipBook: %SystemRoot%\system32\clipsrv.exe (disabled)
COM+ System Application: C:\WINDOWS\System32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235} (manual start)
cpuz134: \??\C:\DOCUME~1\t3kn33k5\LOCALS~1\Temp\cpuz134\cpuz134_x32.sys (manual start)
Creative Service for CDROM Access: C:\WINDOWS\System32\CTsvcCDA.exe (autostart)
Cryptographic Services: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
CSIScanner: "C:\Program Files\Prevx\prevx.exe" /service (disabled)
Creative AC3 Software Decoder: System32\drivers\ctac32k.sys (manual start)
Creative Audio Driver (WDM): system32\drivers\ctaud2k.sys (manual start)
Creative DVD-Audio Device Driver: system32\drivers\ctdvda2k.sys (manual start)
Creative Proxy Driver: System32\drivers\ctprxy2k.sys (manual start)
Creative SoundFont Management Device Driver: System32\drivers\ctsfm2k.sys (manual start)
d347bus: System32\DRIVERS\d347bus.sys (system)
d347prt: System32\Drivers\d347prt.sys (system)
DCOM Server Process Launcher: %SystemRoot%\system32\svchost -k DcomLaunch (autostart)
DHCP Client: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Disk Driver: System32\DRIVERS\disk.sys (system)
Logical Disk Manager Administrative Service: %SystemRoot%\System32\dmadmin.exe /com (manual start)
dmboot: System32\drivers\dmboot.sys (disabled)
Logical Disk Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Microsoft Kernel DLS Syntheiszer: system32\drivers\DMusic.sys (manual start)
DNS Client: %SystemRoot%\System32\svchost.exe -k NetworkService (autostart)
Microsoft Kernel DRM Audio Descrambler: system32\drivers\drmkaud.sys (manual start)
E-mu Plug-in Architecture Driver: System32\drivers\emupia2k.sys (manual start)
Error Reporting Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Event Log: %SystemRoot%\system32\services.exe (autostart)
COM+ Event System: C:\WINDOWS\System32\svchost.exe -k netsvcs (manual start)
Fast User Switching Compatibility: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Floppy Disk Controller Driver: System32\DRIVERS\fdc.sys (manual start)
VIA Rhine-Family Fast Ethernet Adapter Driver Service: System32\DRIVERS\fetnd5bv.sys (manual start)
VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver: System32\DRIVERS\fetnd5.sys (manual start)
Floppy Disk Driver: System32\DRIVERS\flpydisk.sys (manual start)
FltMgr: system32\drivers\fltmgr.sys (system)
Volume Manager Driver: System32\DRIVERS\ftdisk.sys (system)
Game Port Enumerator: System32\DRIVERS\gameenum.sys (manual start)
GearAspiWDM: SYSTEM32\DRIVERS\GEARAspiWDM.sys (system)
Generic Packet Classifier: System32\DRIVERS\msgpc.sys (manual start)
Creative Hardware Abstract Layer Driver: System32\drivers\ha10kx2k.sys (manual start)
Creative P16V HAL Driver: system32\drivers\hap16v2k.sys (manual start)
Help and Support: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Human Interface Device Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Microsoft HID Class Driver: System32\DRIVERS\hidusb.sys (manual start)
HTTP SSL: %SystemRoot%\System32\svchost.exe -k HTTPFilter (manual start)
i8042 Keyboard and PS/2 Mouse Port Driver: System32\DRIVERS\i8042prt.sys (system)
CD-Burning Filter Driver: System32\DRIVERS\imapi.sys (system)
IMAPI CD-Burning COM Service: C:\WINDOWS\System32\imapi.exe (manual start)
InCDPass: System32\DRIVERS\InCDPass.sys (system)
InCD Helper (read only): C:\Program Files\Ahead\InCD\InCDsrv.exe -r (autostart)
IPv6 Windows Firewall Driver: system32\drivers\ip6fw.sys (manual start)
IP Traffic Filter Driver: System32\DRIVERS\ipfltdrv.sys (manual start)
IP in IP Tunnel Driver: System32\DRIVERS\ipinip.sys (manual start)
IP Network Address Translator: System32\DRIVERS\ipnat.sys (manual start)
iPod Service: C:\Program Files\iPod\bin\iPodService.exe (manual start)
IPSEC driver: System32\DRIVERS\ipsec.sys (system)
IR Enumerator Service: System32\DRIVERS\irenum.sys (manual start)
PnP ISA/EISA Bus Driver: System32\DRIVERS\isapnp.sys (system)
Keyboard Class Driver: System32\DRIVERS\kbdclass.sys (system)
KJUKZSKN: C:\DOCUME~1\t3kn33k5\LOCALS~1\Temp\KJUKZSKN.exe (disabled)
Microsoft Kernel Wave Audio Mixer: system32\drivers\kmixer.sys (manual start)
Server: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Workstation: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
TCP/IP NetBIOS Helper: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
MBAMProtector: \??\C:\WINDOWS\System32\drivers\mbam.sys (manual start)
MBAMService: "C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" (autostart)
MEMSWEEP2: \??\C:\WINDOWS\System32\2C.tmp (manual start)
Messenger: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
NetMeeting Remote Desktop Sharing: C:\WINDOWS\System32\mnmsrvc.exe (manual start)
Mouse Class Driver: System32\DRIVERS\mouclass.sys (system)
Mouse HID Driver: System32\DRIVERS\mouhid.sys (manual start)
WebDav Client Redirector: System32\DRIVERS\mrxdav.sys (manual start)
MRXSMB: System32\DRIVERS\mrxsmb.sys (system)
Distributed Transaction Coordinator: C:\WINDOWS\System32\msdtc.exe (manual start)
Windows Installer: C:\WINDOWS\System32\msiexec.exe /V (manual start)
Microsoft Streaming Service Proxy: system32\drivers\MSKSSRV.sys (manual start)
Microsoft Streaming Clock Proxy: system32\drivers\MSPCLOCK.sys (manual start)
Microsoft Streaming Quality Manager Proxy: system32\drivers\MSPQM.sys (manual start)
Microsoft System Management BIOS Driver: System32\DRIVERS\mssmbios.sys (manual start)
MSSQL$SONY_MEDIAMGR: C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe -sSONY_MEDIAMGR (manual start)
MSSQLServerADHelper: C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe (manual start)
Remote Access NDIS TAPI Driver: System32\DRIVERS\ndistapi.sys (manual start)
NDIS Usermode I/O Protocol: System32\DRIVERS\ndisuio.sys (manual start)
Remote Access NDIS WAN Driver: System32\DRIVERS\ndiswan.sys (manual start)
NetBIOS Interface: System32\DRIVERS\netbios.sys (system)
NetBios over Tcpip: System32\DRIVERS\netbt.sys (system)
Network DDE: %SystemRoot%\system32\netdde.exe (disabled)
Network DDE DSDM: %SystemRoot%\system32\netdde.exe (disabled)
Net Logon: %SystemRoot%\System32\lsass.exe (manual start)
Network Connections: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
1394 Net Driver: System32\DRIVERS\nic1394.sys (manual start)
Network Location Awareness (NLA): %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
NT LM Security Support Provider: %SystemRoot%\System32\lsass.exe (manual start)
Removable Storage: %SystemRoot%\system32\svchost.exe -k netsvcs (manual start)
nv: System32\DRIVERS\nv4_mini.sys (manual start)
NVIDIA Display Driver Service: %SystemRoot%\System32\nvsvc32.exe (autostart)
IPX Traffic Filter Driver: System32\DRIVERS\nwlnkflt.sys (manual start)
IPX Traffic Forwarder Driver: System32\DRIVERS\nwlnkfwd.sys (manual start)
OHCI Compliant IEEE 1394 Host Controller: System32\DRIVERS\ohci1394.sys (system)
Creative OS Services Driver: system32\drivers\ctoss2k.sys (manual start)
Parallel port driver: System32\DRIVERS\parport.sys (manual start)
PCANDIS5 NDIS Protocol Driver: \??\C:\WINDOWS\System32\PCANDIS5.SYS (manual start)
PCI Bus Driver: System32\DRIVERS\pci.sys (system)
Padus ASPI Shell: system32\drivers\pfc.sys (manual start)
PfModNT: \??\C:\WINDOWS\System32\drivers\PfModNT.sys (autostart)
Plug and Play: %SystemRoot%\system32\services.exe (autostart)
IPSEC Services: %SystemRoot%\System32\lsass.exe (autostart)
WAN Miniport (PPTP): System32\DRIVERS\raspptp.sys (manual start)
Processor Driver: System32\DRIVERS\processr.sys (system)
Protected Storage: %SystemRoot%\system32\lsass.exe (autostart)
QoS Packet Scheduler: System32\DRIVERS\psched.sys (manual start)
Direct Parallel Link Driver: System32\DRIVERS\ptilink.sys (manual start)
PxHelp20: System32\Drivers\PxHelp20.sys (system)
pxkbf: System32\drivers\pxkbf.sys (manual start)
pxrts: System32\drivers\pxrts.sys (system)
pxscan: System32\drivers\pxscan.sys (system)
Remote Access Auto Connection Driver: System32\DRIVERS\rasacd.sys (system)
Remote Access Auto Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
WAN Miniport (L2TP): System32\DRIVERS\rasl2tp.sys (manual start)
Remote Access Connection Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Remote Access PPPOE Driver: System32\DRIVERS\raspppoe.sys (manual start)
Direct Parallel: System32\DRIVERS\raspti.sys (manual start)
Rdbss: System32\DRIVERS\rdbss.sys (system)
RDPCDD: System32\DRIVERS\RDPCDD.sys (system)
Remote Desktop Help Session Manager: C:\WINDOWS\system32\sessmgr.exe (manual start)
Digital CD Audio Playback Filter Driver: System32\DRIVERS\redbook.sys (system)
Routing and Remote Access: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Remote Procedure Call (RPC) Locator: %SystemRoot%\System32\locator.exe (manual start)
Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)
QoS RSVP: %SystemRoot%\System32\rsvp.exe (manual start)
Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)
Smart Card Helper: %SystemRoot%\System32\SCardSvr.exe (manual start)
Smart Card: %SystemRoot%\System32\SCardSvr.exe (manual start)
Task Scheduler: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Secdrv: System32\DRIVERS\secdrv.sys (manual start)
Secondary Logon: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
Serenum Filter Driver: System32\DRIVERS\serenum.sys (manual start)
Serial port driver: System32\DRIVERS\serial.sys (system)
Windows Firewall/Internet Connection Sharing (ICS): %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Shell Hardware Detection: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Microsoft Kernel Audio Splitter: system32\drivers\splitter.sys (manual start)
Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)
SQLAgent$SONY_MEDIAMGR: C:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE -i SONY_MEDIAMGR (manual start)
System Restore Filter Driver: System32\DRIVERS\sr.sys (system)
System Restore Service: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Srv: System32\DRIVERS\srv.sys (manual start)
SSDP Discovery Service: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
Windows Image Acquisition (WIA): %SystemRoot%\System32\svchost.exe -k imgsvc (autostart)
Software Bus Driver: System32\DRIVERS\swenum.sys (manual start)
Microsoft Kernel GS Wavetable Synthesizer: system32\drivers\swmidi.sys (manual start)
MS Software Shadow Copy Provider: C:\WINDOWS\System32\dllhost.exe /Processid:{62E03BF6-CAA3-4E86-B777-1BE6A4C42C52} (manual start)
SymWMI Service: C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe (autostart)
Microsoft Kernel System Audio Device: system32\drivers\sysaudio.sys (manual start)
Performance Logs and Alerts: %SystemRoot%\system32\smlogsvc.exe (manual start)
Telephony: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TCP/IP Protocol Driver: System32\DRIVERS\tcpip.sys (system)
Terminal Device Driver: System32\DRIVERS\termdd.sys (system)
Terminal Services: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
TfFsMon: System32\drivers\TfFsMon.sys (system)
TfNetMon: \??\C:\WINDOWS\System32\drivers\TfNetMon.sys (manual start)
TfSysMon: System32\drivers\TfSysMon.sys (system)
Themes: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
ThreatFire: C:\Program Files\ThreatFire\TFService.exe service (autostart)
Distributed Link Tracking Client: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)
M-Audio USB Keystation Loader: system32\drivers\uks11ldr.sys (manual start)
Windows User Mode Driver Framework: C:\WINDOWS\System32\wdfmgr.exe (manual start)
Microcode Update Driver: System32\DRIVERS\update.sys (manual start)
Upload Manager: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Universal Plug and Play Device Host: %SystemRoot%\System32\svchost.exe -k LocalService (manual start)
Uninterruptible Power Supply: %SystemRoot%\System32\ups.exe (manual start)
Microsoft USB 2.0 Enhanced Host Controller Miniport Driver: System32\DRIVERS\usbehci.sys (manual start)
USB2 Enabled Hub: System32\DRIVERS\usbhub.sys (manual start)
M-Audio USB Keystation: system32\drivers\usbkt1x1.sys (manual start)
USB Scanner Driver: System32\DRIVERS\usbscan.sys (manual start)
USB Mass Storage Driver: System32\DRIVERS\USBSTOR.SYS (manual start)
Microsoft USB Universal Host Controller Miniport Driver: System32\DRIVERS\usbuhci.sys (manual start)
VGA Display Controller.: \SystemRoot\System32\drivers\vga.sys (system)
ViaIde: System32\DRIVERS\viaide.sys (system)
VIA AC'97 Audio Controller (WDM): system32\drivers\ac97via.sys (manual start)
Volume Shadow Copy: %SystemRoot%\System32\vssvc.exe (manual start)
VVFSZ: C:\DOCUME~1\t3kn33k5\LOCALS~1\Temp\VVFSZ.exe (disabled)
Windows Time: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Sony Ericsson W600 driver (WDM): System32\DRIVERS\w600bus.sys (manual start)
Sony Ericsson W600 USB WMC Modem Filter: System32\DRIVERS\w600mdfl.sys (manual start)
Sony Ericsson W600 USB WMC Modem Drivers: System32\DRIVERS\w600mdm.sys (manual start)
Sony Ericsson W600 USB WMC Device Management Drivers: System32\DRIVERS\w600mgmt.sys (manual start)
Sony Ericsson W600 USB WMC OBEX Interface Drivers: System32\DRIVERS\w600obex.sys (manual start)
Remote Access IP ARP Driver: System32\DRIVERS\wanarp.sys (manual start)
Microsoft WINMM WDM Audio Compatibility Driver: system32\drivers\wdmaud.sys (manual start)
WebClient: %SystemRoot%\System32\svchost.exe -k LocalService (autostart)
Windows Management Instrumentation: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Portable Media Serial Number Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)
Portable Media Serial Number: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
WMI Performance Adapter: C:\WINDOWS\System32\wbem\wmiapsrv.exe (manual start)
Security Center: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)
Automatic Updates: %systemroot%\system32\svchost.exe -k netsvcs (autostart)
Wireless Zero Configuration: %SystemRoot%\System32\svchost.exe -k netsvcs (disabled)
Network Provisioning Service: %SystemRoot%\System32\svchost.exe -k netsvcs (manual start)


--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: *Registry value not found*

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

*Registry key not found*

--------------------------------------------------

End of report, 34,503 bytes
Report generated in 0.431 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
</code>
---

Next Log:

<code>Emsisoft Anti-Malware - Version 5.1
Last update: 7/10/2011 10:32:15 PM

Scan settings:

Scan type: Deep Scan
Objects: Memory, Traces, C:\, D:\, E:\, J:\
Scan archives: On
Heuristics: Off
ADS Scan: On

Scan start: 7/10/2011 10:49:39 PM

C:\Documents and Settings\t3kn33k5\Desktop\6r6\IZotope.Ozone.DX.VST.RTAS.v3.04.incl.KeyGen-H2O.rar/ozone_keygen.exe detected: Trojan.Generic!IK

Scanned

Files: 12022
Traces: 457444
Cookies: 0
Processes: 10

Found

Files: 1
Traces: 0
Cookies: 0
Processes: 0
Registry keys: 0

Scan end: 7/11/2011 1:24:32 AM
Scan time: 2:34:53

C:\Documents and Settings\t3kn33k5\Desktop\6r6\IZotope.Ozone.DX.VST.RTAS.v3.04.incl.KeyGen-H2O.rar/ozone_keygen.exe Deleted Trojan.Generic!IK

Deleted

Files: 1
Traces: 0
Cookies: 0
</code>
----

Next log(OLD):
<code>Emsisoft Anti-Malware - Version 5.1
Last update: 7/10/2011 7:10:13 AM

Scan settings:

Scan type: N/A
Objects: Memory, Traces, C:\, D:\, E:\, J:\
Scan archives: Off
Heuristics: Off
ADS Scan: On

Scan start: 7/10/2011 7:10:30 AM

Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST5UNST #1 --> ApplicationName detected: Trace.Registry.Autumn Waterfalls Screen Saver!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST5UNST #1 --> AppToUninstall detected: Trace.Registry.Autumn Waterfalls Screen Saver!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST5UNST #1 --> DisplayName detected: Trace.Registry.Autumn Waterfalls Screen Saver!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST5UNST #1 --> UninstallString detected: Trace.Registry.Autumn Waterfalls Screen Saver!A2

Scanned

Files: 144018
Traces: 560211
Cookies: 0
Processes: 25

Found

Files: 0
Traces: 4
Cookies: 0
Processes: 0
Registry keys: 0

Scan end: 7/10/2011 1:20:56 PM
Scan time: 6:10:26

Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST5UNST #1 --> ApplicationName Quarantined Trace.Registry.Autumn Waterfalls Screen Saver!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST5UNST #1 --> AppToUninstall Quarantined Trace.Registry.Autumn Waterfalls Screen Saver!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST5UNST #1 --> DisplayName Quarantined Trace.Registry.Autumn Waterfalls Screen Saver!A2
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST5UNST #1 --> UninstallString Quarantined Trace.Registry.Autumn Waterfalls Screen Saver!A2

Quarantined

Files: 0
Traces: 4
Cookies: 0
</code>
---

Next Log:
<code>Log created by WinPatrol [FREE Edition] version 19.3.2010.5:19.3.2010.5
Scan saved at 8:25:47 PM, on 7/29/2011
Platform: Windows XP SP1 Home Edition Service Pack 1 (Build 2600)
MSIE: Internet Explorer (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRAM FILES\Ahead\InCD\InCDsrv.exe
C:\PROGRAM FILES\BUFFALO\CLIENT MANAGER3\Bwsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\PROGRAM FILES\MALWAREBYTES' ANTI-MALWARE\MBAMSERVICE.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\CTHELPER.EXE
C:\PROGRAM FILES\Java\JRE1.5.0_02\bin\jusched.exe
C:\PROGRAM FILES\SYNCROSOFT\POS\H2O\cledx.exe
C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\WINPATROL.EXE
C:\PROGRAM FILES\MALWAREBYTES' ANTI-MALWARE\mbamgui.exe
C:\PROGRAM FILES\MICROSOFT ANTISPYWARE\GCASDTSERV.EXE
C:\PROGRAM FILES\CREATIVE PROFESSIONAL\E-MU PATCHMIX DSP\EMUPATCHMIXDSP.EXE
C:\PROGRAM FILES\ClamWin\bin\ClamTray.exe
C:\PROGRAM FILES\BUFFALO\CLIENT MANAGER3\cm3_tray.exe
C:\PROGRAM FILES\MOZILLA FIREFOX\firefox.exe
C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGIN-CONTAINER.EXE
C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\WINPATROLEX.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [NeroFilterCheck]C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WINDVDPatch]CTHELPER.EXE
O4 - HKLM\..\Run: [NvCplDaemon]C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz]nwiz.exe /install
O4 - HKLM\..\Run: [gcasServ]C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched]C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [CTHelper]CTHELPER.EXE
O4 - HKLM\..\Run: [NvMediaCenter]C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [H2O]C:\Program Files\SyncroSoft\POS\H2O\cledx.exe
O4 - HKLM\..\Run: [WinPatrol [FREE Edition]]C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware]C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /starttray
O4 - HKLM\..\Run: [KernelFaultCheck]%systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [NBJ]C:\Program Files\Ahead\Nero BackItUp\NBJ.exe
O4 - HKCU\..\Run: [SetDefaultMIDI]MIDIDef.exe
O4 - HKCU\..\Run: [ClamWin]C:\Program Files\ClamWin\bin\ClamTray.exe --logon
O4 - Global Startup: Adobe Gamma Loader.lnk=C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: ClientManager3.lnk=C:\Program Files\BUFFALO\Client Manager3\cm3_tray.exe
O9 - Extra button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm
O9 - Extra 'Tools' menuitem: @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm
O11 - Options group: [Java (Sun)] Java (Sun) - C:\Program Files\Java\jre1.5.0_02\bin
O11 - Options group: [] -
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\PLUGINS\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
O14 - IERESET.INF: SEARCH_PAGE_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
O14 - IERESET.INF:HKCU, Start Page = %START_PAGE_URL%
O14 - IERESET.INF:HKLM, Default_Page_URL = %START_PAGE_URL%
O14 - IERESET.INF:HKLM, Default_Search_URL = %SEARCH_PAGE_URL%
O14 - IERESET.INF:HKLM, Search Page = %SEARCH_PAGE_URL%
O14 - IERESET.INF:HKCU, Search Page = %SEARCH_PAGE_URL%
O23 - Service: Adobe LM Service - - C:\PROGRAM FILES\COMMON FILES\ADOBE SYSTEMS SHARED\Service\ADOBELMSVC.EXE
O23 - Service: Application Management - - C:\WINDOWS\SYSTEM32\APPMGMTS.DLL
O23 - Service: Bwsvc - BUFFALO INC. - C:\PROGRAM FILES\BUFFALO\CLIENT MANAGER3\Bwsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSVCCDA.EXE
O23 - Service: Human Interface Device Access - - C:\WINDOWS\SYSTEM32\HIDSERV.DLL
O23 - Service: InCD Helper (read only) - Ahead Software AG - C:\PROGRAM FILES\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\PROGRAM FILES\iPod\bin\IPODSERVICE.EXE
O23 - Service: KJUKZSKN - Sysinternals - www.sysinternals.com - C:\Documents and Settings\t3kn33k5\Local Settings\Temp\KJUKZSKN.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\PROGRAM FILES\MALWAREBYTES' ANTI-MALWARE\MBAMSERVICE.EXE
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: VVFSZ - Sysinternals - www.sysinternals.com - C:\Documents and Settings\t3kn33k5\Local Settings\Temp\VVFSZ.exe

--- Additional WinPatrol Info ---
Default Browser: Firefox - Firefox version 3.6.18
MSIE: Internet Explorer (6.00.2800.1106)
Firefox 3.6.18 installed in C:\Program Files\Mozilla Firefox.
21 IE Cookies in Folder: C:\Documents and Settings\t3kn33k5\Cookies\
0 Mozilla Cookies in Folder: C:\Documents and Settings\t3kn33k5\Application Data\Mozilla\FireFox\Profiles\x1420b4r.default

WP00 - HKLM\CS1: BootExecute = autocheck autochk *
WP00 - HKLM\CCS: BootExecute = autocheck autochk *
WP00 - HKLM\CS3: BootExecute = autocheck autochk *
WP02 - HKLM\CCS: Command = C:\WINDOWS\system32\cmd.exe

WP03 - Windows Automatic Update = 2:Notify me but don't automatically download or install them.


WP08 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix: Default = http://
WP08 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes: www = http://


WP16 - ActiveX: {05589fa1-c356-11ce-bf01-00aa0055595a} [ActiveMovieControl Object] C:\WINDOWS\system32\wmpdxm.dll 10.00.00.3646
WP16 - ActiveX: {0713E8A2-850A-101B-AFC0-4210102A8DA7} [Microsoft TreeView Control, version 5.0 (SP2)] C:\WINDOWS\system32\comctl32.ocx 6.00.8105
WP16 - ActiveX: {0713E8D2-850A-101B-AFC0-4210102A8DA7} [Microsoft ProgressBar Control, version 5.0 (SP2)] C:\WINDOWS\system32\comctl32.ocx 6.00.8105
WP16 - ActiveX: {1D2B4F40-1F10-11D1-9E88-00C04FDCAB92} [ThumbCtl Class] C:\WINDOWS\system32\webvw.dll 6.00.2800.1106
WP16 - ActiveX: {22D6F312-B0F6-11D0-94AB-0080C74C7E95} [Windows Media Player] C:\WINDOWS\system32\wmpdxm.dll 10.00.00.3646
WP16 - ActiveX: {52a2aaae-085d-4187-97ea-8c30db990436} [HHCtrl Object] C:\WINDOWS\system32\hhctrl.ocx 5.2.3790.558
WP16 - ActiveX: {58DA8D8A-9D6A-101B-AFC0-4210102A8DA7} [Microsoft ListView Control, version 5.0 (SP2)] C:\WINDOWS\system32\comctl32.ocx 6.00.8105
WP16 - ActiveX: {58DA8D8F-9D6A-101B-AFC0-4210102A8DA7} [Microsoft ImageList Control, version 5.0 (SP2)] C:\WINDOWS\system32\comctl32.ocx 6.00.8105
WP16 - ActiveX: {6B7E638F-850A-101B-AFC0-4210102A8DA7} [Microsoft StatusBar Control, version 5.0 (SP2)] C:\WINDOWS\system32\comctl32.ocx 6.00.8105
WP16 - ActiveX: {8856F961-340A-11D0-A96B-00C04FD705A2} [Microsoft Web Browser] C:\WINDOWS\system32\shdocvw.dll 6.00.2800.1892
WP16 - ActiveX: {AE24FDAE-03C6-11D1-8B76-0080C744F389} [Microsoft Scriptlet Component] C:\WINDOWS\system32\MSHTML.DLL 6.00.2800.1561
WP16 - ActiveX: {CA8A9780-280D-11CF-A24D-444553540000} [Adobe Acrobat Control for ActiveX] C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\pdf.ocx 5.0.0.0
WP16 - ActiveX: {E5DF9D10-3B52-11D1-83E8-00A0C90DC849} [WebViewFolderIcon Class] C:\WINDOWS\system32\webvw.dll 6.00.2800.1106

WP32 - Hidden File: C:\boot.ini
WP32 - Hidden File: C:\IO.SYS
WP32 - Hidden File: C:\MSDOS.SYS
WP32 - Hidden File: C:\NTDETECT.COM
WP32 - Hidden File: C:\ntldr
WP32 - Hidden File: C:\pagefile.sys
WP32 - Hidden File: C:\WINDOWS\Thumbs.db
WP32 - Hidden File: C:\WINDOWS\WindowsShell.Manifest
WP32 - Hidden File: C:\WINDOWS\winnt.bmp
WP32 - Hidden File: C:\WINDOWS\winnt256.bmp
WP32 - Hidden File: C:\WINDOWS\system32\cdplayer.exe.manifest
WP32 - Hidden File: C:\WINDOWS\system32\config\default.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\default.tmp.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\SAM.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\SECURITY.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\software.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\software.tmp.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\system.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\system.tmp.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\TempKey.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\userdiff.LOG
WP32 - Hidden File: C:\WINDOWS\system32\config\userdifr.LOG
WP32 - Hidden File: C:\WINDOWS\system32\logonui.exe.manifest
WP32 - Hidden File: C:\WINDOWS\system32\ncpa.cpl.manifest
WP32 - Hidden File: C:\WINDOWS\system32\nwc.cpl.manifest
WP32 - Hidden File: C:\WINDOWS\system32\Restore\filelist.xml
WP32 - Hidden File: C:\WINDOWS\system32\sapi.cpl.manifest
WP32 - Hidden File: C:\WINDOWS\system32\WindowsLogon.manifest
WP32 - Hidden File: C:\WINDOWS\system32\wuaucpl.cpl.manifest
WP32 - Hidden File: C:\Program Files\Common Files\Services\Thumbs.db

WP33 - File Type .AVI: [Video Clip]C:\Program Files\Windows Media Player\wmplayer.exe /prefetch:8 /Open %L
WP33 - File Type .BAT: [MS-DOS Batch File]%1 %*
WP33 - File Type .CAB: [Cabinet File]C:\WINDOWS\Explorer.exe /idlist,%I,%L
WP33 - File Type .CAT: [Security Catalog]rundll32.exe cryptext.dll,CryptExtOpenCAT %1
WP33 - File Type .CHM: [Compiled HTML Help file]C:\WINDOWS\hh.exe %1
WP33 - File Type .COM: [MS-DOS Application]%1 %*
WP33 - File Type .CMD: [Windows NT Command Script]%1 %*
WP33 - File Type .DOC: [WordPad Document]C:\Program Files\Windows NT\Accessories\WORDPAD.EXE %1
WP33 - File Type .EML: [Outlook Express Mail Message]C:\Program Files\Outlook Express\msimn.exe /eml:%1
WP33 - File Type .EXE: [Application]%1 %*
WP33 - File Type .INF: [Setup Information]C:\WINDOWS\System32\NOTEPAD.EXE %1
WP33 - File Type .JS: [JScript Script File]C:\WINDOWS\System32\WScript.exe %1 %*
WP33 - File Type .LOG: [Text Document]C:\WINDOWS\system32\NOTEPAD.EXE %1
WP33 - File Type .MSI: [Windows Installer Package]C:\WINDOWS\System32\msiexec.exe /i %1 %*
WP33 - File Type .MID: [MIDI Sequence]C:\Program Files\Windows Media Player\wmplayer.exe /Open %L
WP33 - File Type .MP3: [MP3 Format Sound]C:\Program Files\Windows Media Player\wmplayer.exe /prefetch:6 /Open %L
WP33 - File Type .PIF: [Shortcut to MS-DOS Program]%1 %*
WP33 - File Type .REG: [Registration Entries]regedit.exe %1
WP33 - File Type .RTF: [Rich Text Document]C:\Program Files\Windows NT\Accessories\WORDPAD.EXE %1
WP33 - File Type .SCR: [Screen Saver]%1 %*
WP33 - File Type .TXT: [Text Document]C:\WINDOWS\system32\NOTEPAD.EXE %1
WP33 - File Type .URL: [Internet Shortcut]rundll32.exe shdocvw.dll,OpenURL %l
WP33 - File Type .VBS: [VBScript Script File]C:\WINDOWS\System32\WScript.exe %1 %*
WP33 - File Type .VBE: [VBScript Encoded Script File]C:\WINDOWS\System32\WScript.exe %1 %*
WP33 - File Type .WSF: [Windows Script File]C:\WINDOWS\System32\WScript.exe %1 %*
WP33 - File Type .WSH: [Windows Script Host Settings File]C:\WINDOWS\System32\WScript.exe %1 %*

Memory currently in use: 88%
Physical Memory Free: 58,888 KB
Paging File Free: 901,904 KB
Virtual Memory Free: 2,057,488 KB


--
End of file
</code>

Next Log(OLD):

<code>Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Database version: 7066

Windows 5.1.2600 (Safe Mode)
Internet Explorer 6.0.2600.0000

7/10/2011 4:57:15 PM
mbam-log-2011-07-10 (16-57-15).txt

Scan type: Full scan (C:\|D:\|E:\|)
Objects scanned: 294847
Time elapsed: 1 hour(s), 9 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
</code>

Please help! sorry if this is too much info! :) I had more logs I wanted to post...

BC AdBot (Login to Remove)

 


#2 Noviciate

Noviciate

  • Malware Response Team
  • 5,277 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Numpty HQ
  • Local time:07:48 PM

Posted 30 July 2011 - 04:14 PM

Good evening. :)

The bottom line is that if this PC were in front of me, i'd backup any important software and then reformat and reinstall.

The operating system is about seven years out of date given that Service Pack 2 for XP was released on August 25, 2004. Unless the PC has been in cold storage for that long, this means the machine has been a slime magnet due to the insecurities that this causes.

There's no active real-time anti-virus on the machine, and Clamwin doesn't count as it doesn't run in real-time, so unless you uninstalled it before you posted, the PC has been at risk from this too.

There are a number of old versions of software that have been linked to infections due to the insecurities that they had, which isn't good either.

Finally, the P2P software and the infections you mentioned is the icing on the cake.

It is going to be impossible to guarantee a clean computer at the end of the removal process, which makes it something of a non-starter in the first place. The possibility that legitimate files may have been infected or corrupted by the malware that has been/is present on your PC, and also that security settings may have been lowered making your computer more liable to infection in the future, means that starting over is the easiest and most reliable solution to your problems.

So long, and thanks for all the fish.

 

 


#3 t3kn33k5

t3kn33k5
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:11:48 AM

Posted 31 July 2011 - 02:36 PM

I dont know why I even bothered to post anything. :) I figured reformatting and reinstalling would be the best option. The computer was given to me by a friend that actually had it in storage for about 4.5 years :) It has a bunch of music that me and my friends made so there are a lot of important files on it. The only problem I am having with backing them up is getting an external HD to work without having SP2 installed. But I guess I can back them up onto DVD's but that process takes forever. Anyways, thanks for the reply I appreciate it.

#4 t3kn33k5

t3kn33k5
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:11:48 AM

Posted 31 July 2011 - 02:37 PM

.

Edited by t3kn33k5, 31 July 2011 - 02:42 PM.


#5 Noviciate

Noviciate

  • Malware Response Team
  • 5,277 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Numpty HQ
  • Local time:07:48 PM

Posted 31 July 2011 - 02:59 PM

Good evening. :)

There's a simpler way if you have a flashdrive of about 128 Mb or a spare blank disk you can burn to.
If you want some more info, just ask.

So long, and thanks for all the fish.

 

 


#6 Noviciate

Noviciate

  • Malware Response Team
  • 5,277 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Numpty HQ
  • Local time:07:48 PM

Posted 06 August 2011 - 03:35 PM

As this issue appears to have been resolved, this thread is now closed.

So long, and thanks for all the fish.

 

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users