hjt check up..

Printable View

February 8th, 2010, 08:35 AM
sheek

hjt check up..

gud day...kindly please check my hjt..thank you..

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 8:32:38 PM, on 2/8/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\TOSHIBA\RSelect\RSelSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O13 - Gopher Prefix:
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: TOSHIBA Modem region select service (RSELSVC) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\RSelect\RSelSvc.exe
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 8111 bytes
February 8th, 2010, 12:50 PM
Broni

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Malwarebytes before running the scans.***

STEP 1. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform Quick Scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 2. Download GMER: http://www.gmer.net/files.php, by clicking on Download EXE button.
Alternative downloads:
- http://majorgeeks.com/GMER_d5198.html
- http://www.softpedia.com/get/Interne...ers/GMER.shtml
Double click on downloaded .exe file, select Rootkit tab and click the Scan button.
When scan is completed, click Save button, and save the results as gmer.log
Warning ! Please, do not select the "Show all" checkbox during the scan.
Post the log to your next reply.

RESTART COMPUTER

STEP 3.
Post fresh HijackThis log.
NOTE. If you're using Vista, or 7, right click on HijackThis, and click Run as Administrator
Do NOT attempt to "fix" anything!

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
February 9th, 2010, 10:24 PM
sheek

two days ago, there's a "pop.mp3" appears on my download section on my google chrome browser and i dont know where does it downloading from...and i think its a virus..when i deleted it on my donload folder it then appears again...hope i clean it well...these are the results...

Malwarebytes' Anti-Malware 1.36
Database version: 1945
Windows 5.1.2600 Service Pack 3

2/10/2010 12:38:31 AM
mbam-log-2010-02-10 (00-38-31).txt

Scan type: Quick Scan
Objects scanned: 66759
Time elapsed: 5 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
February 9th, 2010, 10:26 PM
sheek

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-10 09:56:53
Windows 5.1.2600 Service Pack 3
Running: xm3h7f81.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\pfrcrpog.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwClose [0x9D28D6B8]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwConnectPort [0x9D396040]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateFile [0x9D392930]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwCreateKey [0x9D28D574]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreatePort [0x9D396510]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateProcess [0x9D39C870]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateProcessEx [0x9D39CAA0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateSection [0x9D39FFD0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwCreateWaitablePort [0x9D396600]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteFile [0x9D392F20]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDeleteKey [0x9D39E6E0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwDeleteValueKey [0x9D28DA52]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwDuplicateObject [0x9D39C580]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwLoadDriver [0x9D3903F0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwLoadKey [0x9D39E8B0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwMapViewOfSection [0x9D3A0270]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwOpenFile [0x9D392D70]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwOpenKey [0x9D28D64E]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwOpenProcess [0x9D39C350]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwOpenThread [0x9D39C150]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwQueryValueKey [0x9D28D76E]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRenameKey [0x9D39F250]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwReplaceKey [0x9D39ECB0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwRequestWaitReplyPort [0x9D395C00]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwRestoreKey [0x9D28D72E]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSecureConnectPort [0x9D396220]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetInformationFile [0x9D393120]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwSetSystemInformation [0x9D3901C0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software) ZwSetValueKey [0x9D28D8AE]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwTerminateProcess [0x9D39CCD0]
SSDT \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC) ZwUnloadDriver [0x9D3905F0]
SSDT \??\C:\WINDOWS\system32\Drivers\uphcleanhlp.sys ZwUnloadKey [0x9A06D6D0]

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwCallbackReturn + 2C7C 80504518 12 Bytes [10, 65, 39, 9D, 70, C8, 39, ...] {ADC [EBP+0x39], AH; POPF ; JO 0xffffffffffffffce; CMP [EBP-0x62c63560], EBX}
.text C:\WINDOWS\system32\drivers\tos_sps32.sys section is writeable [0xB9C28480, 0x3C939, 0xE8000020]
.dsrt C:\WINDOWS\system32\drivers\tos_sps32.sys unknown last section [0xB9C69900, 0x3CA, 0x48000040]
? srescan.sys The system cannot find the file specified. !
? C:\WINDOWS\system32\Drivers\uphcleanhlp.sys The system cannot find the file specified. !

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [9D39ACA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [9D39B1C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [9D39B320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [9D39AE10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [9D39AE10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [9D39ACA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [9D39B1C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [9D39B320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [9D39ACA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [9D39AE10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [9D39B320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [9D39B1C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [9D39B320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [9D39B1C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [9D39ACA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [9D39AE10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [9D39ACA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [9D39B1C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [9D39B320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [9D39ACA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [9D39AE10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [9D39B320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [9D39B1C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\rspndr.sys[NDIS.SYS!NdisRegisterProtocol] [9D39ACA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\rspndr.sys[NDIS.SYS!NdisOpenAdapter] [9D39B1C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\rspndr.sys[NDIS.SYS!NdisDeregisterProtocol] [9D39AE10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT \SystemRoot\system32\DRIVERS\rspndr.sys[NDIS.SYS!NdisCloseAdapter] [9D39B320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[1220] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00390002
IAT C:\WINDOWS\system32\services.exe[1220] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00390000

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

Device \Driver\Tcpip \Device\Ip vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 wdf01000.sys (WDF Dynamic/Microsoft Corporation)

Device \Driver\Tcpip \Device\Tcp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\BTHUSB \Device\00000087 bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)
Device \Driver\Tcpip \Device\Udp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\BTHUSB \Device\00000089 bthport.sys (Bluetooth Bus Driver/Microsoft Corporation)
Device \Driver\Tcpip \Device\RawIp vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)

Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0026b664e783
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0026b664e783@001d987e81ed 0x44 0xA6 0xDE 0x1F ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0026b664e783@00266889720e 0xD7 0x54 0x99 0xA2 ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0026b664e783 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0026b664e783@001d987e81ed 0x44 0xA6 0xDE 0x1F ...
Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0026b664e783@00266889720e 0xD7 0x54 0x99 0xA2 ...

---- EOF - GMER 1.0.15 ----
February 9th, 2010, 10:29 PM
Broni

This is not complete GMER log.
February 9th, 2010, 10:31 PM
sheek

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 10:09:20 AM, on 2/10/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\TOSHIBA\RSelect\RSelSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{15FDA401-4F48-43A3-9046-7C7BBCEE16EB}: NameServer = 203.131.75.67 210.14.16.5
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: TOSHIBA Modem region select service (RSELSVC) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\RSelect\RSelSvc.exe
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 7813 bytes
February 9th, 2010, 10:33 PM
sheek

how would i know if it is complete log..?
February 9th, 2010, 11:01 PM
Broni
It's OK now.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
- Please, never rename Combofix unless instructed.
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE 1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
- Double click on combofix.exe & follow the prompts.
- When finished, it will produce a report for you.
- Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
February 10th, 2010, 12:18 AM
sheek

ComboFix 10-02-09.03 - Owner 02/10/2010 12:00:12.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1916.1490 [GMT 8:00]
Running from: F:\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Custom Settings\TaskBarCmd v1.1.exe

.
((((((((((((((((((((((((( Files Created from 2010-01-10 to 2010-02-10 )))))))))))))))))))))))))))))))
.

2010-02-09 16:14 . 2010-02-09 16:27 2967799 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-02-09 15:59 . 2001-12-25 02:23 12074 ----a-r- c:\windows\system32\hsfinst.dll
2010-02-09 15:59 . 2010-02-09 15:59 -------- d-----w- c:\program files\CONEXANT
2010-02-09 15:59 . 2001-10-22 06:37 57344 ----a-r- c:\windows\system32\mdmxsdk.dll
2010-02-09 15:59 . 2002-03-08 16:01 6454 ----a-r- c:\windows\system32\drivers\firmware.bin
2010-02-09 15:59 . 2001-10-22 06:46 9855 ----a-r- c:\windows\system32\drivers\mdmxsdk.sys
2010-02-09 15:59 . 2002-03-14 07:08 1171616 ----a-r- c:\windows\system32\drivers\HSF_DP.sys
2010-02-09 15:59 . 2002-03-14 10:47 162164 ----a-r- c:\windows\system32\drivers\HSFHWCD2.sys
2010-02-09 15:59 . 2002-03-14 07:02 594960 ----a-r- c:\windows\system32\drivers\HSF_CNXT.sys
2010-02-09 15:36 . 2010-02-09 15:36 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-02-09 15:35 . 2009-04-06 07:32 15504 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-09 15:35 . 2009-04-06 07:32 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-09 15:35 . 2010-02-09 16:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-09 15:35 . 2010-02-09 15:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-01 14:20 . 2010-02-05 13:18 25 ----a-w- c:\windows\popcinfot.dat
2010-01-25 13:56 . 2010-01-25 13:56 -------- d-----w- c:\documents and settings\Owner\Application Data\Media Player Classic
2010-01-25 13:55 . 2009-12-12 14:15 178176 ----a-w- c:\windows\system32\unrar.dll
2010-01-25 13:55 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-01-25 13:55 . 2009-05-29 21:37 205824 ----a-w- c:\windows\system32\xvidvfw.dll
2010-01-25 13:55 . 2009-05-29 21:31 881664 ----a-w- c:\windows\system32\xvidcore.dll
2010-01-25 13:55 . 2010-01-05 18:00 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-01-25 13:55 . 2010-01-25 13:56 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-01-19 05:51 . 2010-01-19 05:51 -------- d-----w- c:\windows\system32\NtmsData
2010-01-18 10:29 . 2010-01-18 10:29 -------- d-----w- c:\program files\Defraggler
2010-01-17 15:43 . 2010-01-17 15:43 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap Games
2010-01-17 08:18 . 2010-02-09 16:40 1660 ----a-w- c:\windows\bthservsdp.dat
2010-01-17 05:49 . 2010-02-08 12:29 -------- d-----w- c:\documents and settings\Owner\Application Data\vlc
2010-01-17 05:24 . 2010-01-17 05:24 -------- d-----w- C:\logs
2010-01-17 05:24 . 2010-01-17 05:24 -------- d-----w- c:\documents and settings\Owner\ChikkaDefault
2010-01-16 17:50 . 2010-01-16 17:50 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Ahead
2010-01-16 17:48 . 2010-01-16 06:50 -------- d-----w- c:\program files\Ahead
2010-01-16 17:42 . 2004-03-22 21:17 25840 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2010-01-16 17:42 . 2004-03-22 21:17 24816 ----a-w- c:\windows\system32\mdimon.dll
2010-01-16 17:41 . 2010-01-16 17:41 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-01-16 17:41 . 2010-01-16 17:41 -------- d-----w- c:\windows\SHELLNEW
2010-01-16 17:41 . 2010-01-16 17:41 -------- d-----w- c:\program files\Microsoft.NET
2010-01-16 07:27 . 2010-01-16 07:27 -------- d-sh--w- c:\documents and settings\Owner\IECompatCache
2010-01-16 07:04 . 2009-02-18 02:34 112640 ----a-w- c:\windows\system32\drivers\ewusbnet.sys
2010-01-16 07:04 . 2008-12-30 17:55 102656 ----a-w- c:\windows\system32\drivers\ewusbfake.sys
2010-01-16 07:04 . 2008-12-13 17:26 102400 ----a-w- c:\windows\system32\drivers\ewusbmdm.sys
2010-01-16 07:04 . 2008-04-14 15:36 621056 ----a-w- c:\windows\system32\drivers\mod7700.sys
2010-01-16 07:04 . 2007-08-09 10:13 24448 ----a-w- c:\windows\system32\drivers\ewdcsc.sys
2010-01-16 07:04 . 2010-01-16 06:55 -------- d-----w- c:\program files\Smart Bro
2010-01-16 07:01 . 2010-01-16 06:59 64456 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-16 07:01 . 2010-01-16 07:01 -------- d-sh--w- c:\documents and settings\Owner\PrivacIE
2010-01-16 06:59 . 2010-01-16 06:59 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Stardock
2010-01-16 06:59 . 2010-01-16 06:59 -------- d-----w- c:\program files\Stardock
2010-01-16 06:59 . 2010-01-16 06:59 -------- d-----w- c:\program files\Common Files\Stardock
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Toshiba
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\ATI
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\Owner\Application Data\ATI
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2010-01-16 06:54 . 2010-01-16 06:57 -------- d-----w- c:\program files\Total Video Converter
2010-01-16 06:53 . 2009-04-29 15:09 24064 ----a-w- c:\windows\system32\drivers\PGEffect.sys
2010-01-16 06:52 . 2010-01-16 06:52 -------- d-----w- c:\program files\VideoLAN
2010-01-16 06:52 . 2008-06-10 07:00 69632 ----a-w- c:\windows\system32\TosOlkN.dll
2010-01-16 06:52 . 2008-06-10 07:00 40960 ----a-w- c:\windows\system32\ToscmddN.dll
2010-01-16 06:52 . 2008-06-10 07:00 24576 ----a-w- c:\windows\system32\TosusrpN.dll
2010-01-16 06:52 . 2008-06-10 07:00 102400 ----a-w- c:\windows\system32\Tossps.scr
2010-01-16 06:50 . 2009-05-19 15:11 283960 ----a-w- c:\windows\system32\TPSMain.exe
2010-01-16 06:50 . 2009-05-19 14:54 45056 ----a-w- c:\windows\system32\TPSMainCtl.dll
2010-01-16 06:50 . 2008-07-01 21:03 38200 ----a-w- c:\windows\system32\TPSBattM.exe
2010-01-16 06:50 . 2007-10-08 19:02 69632 ----a-w- c:\windows\system32\TPwrReg.dll
2010-01-16 06:50 . 2007-10-08 19:02 53248 ----a-w- c:\windows\system32\TPwrCfg.dll
2010-01-16 06:50 . 2007-10-08 19:02 45056 ----a-w- c:\windows\system32\TPSAddin.dll
2010-01-16 06:50 . 2007-10-08 19:02 40960 ----a-w- c:\windows\system32\TPSTrace.dll
2010-01-16 06:50 . 2007-10-08 19:02 77824 ----a-w- c:\windows\system32\CpuPerf.dll
2010-01-16 06:50 . 2007-10-08 19:02 40960 ----a-w- c:\windows\system32\TPSDel.dll
2010-01-16 06:50 . 2010-01-16 07:01 -------- d-----w- c:\documents and settings\Owner\Application Data\toshiba
2010-01-16 06:48 . 2009-05-27 18:18 279376 ----a-w- c:\windows\system32\drivers\tos_sps32.sys
2010-01-16 06:48 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\All Users\Application Data\TOSHIBA
2010-01-16 06:48 . 2010-01-16 06:48 -------- d-----w- c:\program files\Common Files\Toshiba Shared
2010-01-16 06:48 . 2007-11-21 23:23 129632 ----a-w- c:\windows\system32\TODDSrv.exe
2010-01-16 06:47 . 2003-01-29 21:35 12032 ----a-w- c:\windows\system32\drivers\Netdevio.sys
2010-01-16 06:46 . 2009-06-09 19:14 118784 ----a-w- c:\windows\system32\TCtrlIO.dll
2010-01-16 06:46 . 2009-02-13 16:51 53248 ----a-w- c:\windows\system32\DLLVGA.dll
2010-01-16 06:46 . 2009-01-10 00:04 28672 ----a-w- c:\windows\system32\TPeculiarity.dll
2010-01-16 06:46 . 2009-01-08 22:16 9728 ----a-w- c:\windows\system32\TCMSVR.dll
2010-01-16 06:46 . 2008-11-26 23:52 4608 ----a-w- c:\windows\system32\TSBWLS.dll
2010-01-16 06:46 . 2007-12-11 14:54 24576 ----a-w- c:\windows\system32\LEDONOFF.exe
2010-01-16 06:46 . 2007-04-04 14:56 5888 ----a-w- c:\windows\system32\drivers\FwLnk.sys
2010-01-16 06:46 . 2008-03-21 19:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll
2010-01-16 06:46 . 2010-01-16 06:46 -------- d-----w- c:\program files\Synaptics
2010-01-16 06:45 . 2009-03-18 17:20 208304 ----a-w- c:\windows\system32\drivers\SynTP.sys
2010-01-16 06:45 . 2009-03-18 17:19 161064 ----a-w- c:\windows\system32\SynTPAPI.dll
2010-01-16 06:45 . 2009-03-18 17:19 120104 ----a-w- c:\windows\system32\SynTPCo4.dll
2010-01-16 06:45 . 2009-03-18 17:19 206120 ----a-w- c:\windows\system32\SynCtrl.dll
2010-01-16 06:45 . 2009-03-18 17:19 169256 ----a-w- c:\windows\system32\SynCOM.dll
2010-01-16 06:45 . 2010-01-16 06:45 -------- d-----w- c:\program files\Realtek WLAN Driver
2010-01-16 06:44 . 2010-01-16 06:51 -------- d-----w- c:\windows\system32\sda
2010-01-16 06:43 . 2009-03-13 00:21 17531392 ----a-w- c:\windows\RTHDCPL.EXE
2010-01-16 06:43 . 2009-03-10 21:32 2168320 ----a-w- c:\windows\MicCal.exe
2010-01-16 06:43 . 2009-03-02 18:14 57344 ----a-w- c:\windows\ALCMTR.EXE
2010-01-16 06:43 . 2008-08-06 03:10 1684736 ----a-w- c:\windows\system32\drivers\Ambfilt.sys
2010-01-16 06:43 . 2008-06-19 23:42 2808832 ----a-w- c:\windows\ALCWZRD.EXE
2010-01-16 06:43 . 2006-01-04 22:41 1389056 ----a-w- c:\windows\system32\drivers\Monfilt.sys
2010-01-16 06:43 . 2008-08-25 23:17 528384 ----a-w- c:\windows\RtlExUpd.dll
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\Owner\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\LocalService\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\Default User\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\program files\Common Files\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Intel
2010-01-16 06:38 . 2010-01-16 06:41 -------- d-----w- c:\program files\Intel
2010-01-16 06:38 . 2008-07-16 23:05 53248 ----a-w- c:\windows\system32\CSVer.dll
2010-01-16 06:37 . 2010-01-16 06:37 -------- d-----w- C:\Intel
2010-01-16 06:37 . 2010-01-16 06:37 -------- d-----w- c:\program files\V.92 Modem On Hold
2010-01-16 06:37 . 2010-01-16 06:37 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Avanquest software
2010-01-16 06:36 . 2008-04-14 04:47 83072 ----a-w- c:\windows\system32\drivers\wdmaud.sys
2010-01-16 06:36 . 2008-04-14 04:15 6272 ----a-w- c:\windows\system32\drivers\splitter.sys
2010-01-16 06:36 . 2008-04-14 04:15 56576 ----a-w- c:\windows\system32\drivers\swmidi.sys
2010-01-16 06:36 . 2008-04-14 04:15 172416 ----a-w- c:\windows\system32\drivers\kmixer.sys
2010-01-16 06:36 . 2008-04-14 04:15 52864 ----a-w- c:\windows\system32\drivers\DMusic.sys
2010-01-16 06:36 . 2008-04-14 02:09 142592 ----a-w- c:\windows\system32\drivers\aec.sys
2010-01-16 06:36 . 2008-04-14 04:45 60800 ----a-w- c:\windows\system32\drivers\sysaudio.sys
2010-01-16 06:36 . 2008-04-14 04:15 2944 ----a-w- c:\windows\system32\drivers\drmkaud.sys
2010-01-16 06:36 . 2008-03-21 17:35 146048 ----a-w- c:\windows\system32\drivers\portcls.sys
2010-01-16 06:36 . 2008-04-14 04:15 60160 ----a-w- c:\windows\system32\drivers\drmk.sys
2010-01-16 06:36 . 2010-01-16 06:36 -------- d-----w- c:\documents and settings\Default User\Application Data\TOSHIBA
2010-01-16 06:35 . 2008-04-14 04:21 101120 ----a-w- c:\windows\system32\drivers\bthpan.sys
2010-01-16 06:35 . 2008-04-14 09:42 151552 ----a-w- c:\windows\system32\irftp.exe
2010-01-16 06:35 . 2008-04-14 09:42 8192 ----a-w- c:\windows\system32\wshirda.dll
2010-01-16 06:35 . 2008-04-14 09:41 28160 ----a-w- c:\windows\system32\irmon.dll
2010-01-16 06:35 . 2008-04-14 04:16 59136 ----a-w- c:\windows\system32\drivers\rfcomm.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-10 04:03 . 2010-01-16 05:50 2784800 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-09 16:49 . 2010-02-09 16:53 1657344 ----a-w- c:\windows\Internet Logs\xDB2.tmp
2010-02-09 16:40 . 2010-01-16 05:50 39068 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-01-25 13:48 . 2010-01-25 13:41 -------- d-----w- c:\documents and settings\Owner\Application Data\Winamp
2010-01-25 13:41 . 2010-01-25 13:41 -------- d-----w- c:\program files\Winamp
2010-01-25 13:41 . 2010-01-25 13:41 -------- d-----w- c:\program files\Winamp Detect
2010-01-20 15:27 . 2010-01-16 05:09 -------- d-----w- c:\program files\QuickTime Alternative
2010-01-18 06:17 . 2010-01-16 06:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-16 16:22 . 2010-01-16 04:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-01-16 06:46 . 2010-01-16 06:46 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01007.Wdf
2010-01-16 06:46 . 2010-01-16 06:46 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-01-16 06:44 . 2010-01-16 06:43 -------- d-----w- c:\program files\Realtek
2010-01-16 06:34 . 2010-01-16 05:48 -------- d-----w- c:\documents and settings\All Users\Application Data\MailFrontier
2010-01-16 06:30 . 2010-01-16 06:28 -------- d-----w- c:\program files\Atheros
2010-01-16 06:30 . 2010-01-16 06:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Atheros
2010-01-16 06:29 . 2010-01-16 06:33 51712 ----a-w- c:\windows\Internet Logs\xDB1.tmp
2010-01-16 06:28 . 2010-01-16 06:28 -------- d-----w- c:\documents and settings\Owner\Application Data\InstallShield
2010-01-16 06:09 . 2010-01-16 05:18 -------- d-----w- c:\program files\driver
2010-01-16 05:52 . 2010-01-16 05:52 -------- d-----w- c:\documents and settings\Owner\Application Data\MailFrontier
2010-01-16 05:47 . 2010-01-16 05:47 -------- d-----w- c:\program files\Zone Labs
2010-01-16 05:46 . 2010-01-16 05:01 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\Unlocker
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\MediaLooks
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\7-Zip
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\documents and settings\Owner\Application Data\Foxit
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\Foxit Software
2010-01-16 05:09 . 2010-01-16 05:09 318 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{A7050037-F0EA-4BAB-BCD5-FC05507D6147}\ARPPRODUCTICON.exe
2010-01-16 05:09 . 2010-01-16 05:09 25214 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{FF77941A-2BFA-4A18-BE2E-69B9498E4D55}\_294823.exe
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\UPHClean
2010-01-16 05:08 . 2010-01-16 05:08 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-01-16 05:08 . 2010-01-16 05:08 410984 ----a-w- c:\windows\system32\deploytk.dll
2010-01-16 05:08 . 2010-01-16 05:08 -------- d-----w- c:\program files\Java
2010-01-16 05:06 . 2010-01-16 05:06 94248 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-16 05:06 . 2010-01-16 05:06 -------- d-----w- c:\program files\Reference Assemblies
2010-01-16 05:01 . 2010-01-16 05:01 -------- d-----w- c:\program files\Windows Media Connect 2
2010-01-16 05:00 . 2010-01-16 05:00 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-01-16 04:59 . 2010-01-16 04:59 -------- d-----w- c:\program files\MSXML 4.0
2010-01-16 04:59 . 2010-01-16 04:59 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-16 04:51 . 2010-01-16 04:51 388096 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-16 04:51 . 2010-01-16 04:51 -------- d-----w- c:\program files\TrendMicro
2010-01-16 04:45 . 2010-01-16 04:44 -------- d-----w- c:\documents and settings\Owner\Application Data\Yahoo!
2010-01-16 04:44 . 2010-01-16 04:38 -------- d-----w- c:\program files\Yahoo!
2010-01-16 04:44 . 2010-01-16 04:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-01-16 04:18 . 2010-01-16 04:18 -------- d-----w- c:\program files\CCleaner
.

------- Sigcheck -------

[-] 2009-07-19 . BA8C046D98345129723E6BCAA1E8AB99 . 361600 . . [5.1.2600.5649] . . c:\windows\system32\drivers\tcpip.sys

***the text was too long..i cut it to half....***
February 10th, 2010, 12:19 AM
sheek

***the text was too long..i cut it to half....***

c:\windows\System32\wscntfy.exe ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-01-16 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CFSServ.exe"="CFSServ.exe -NoClient" [X]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-13 919016]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-07-19 128512]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2010-1-16 3450608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"MaxRecentDocs"= 18 (0x12)
"NoSMConfigurePrograms"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth Monitor.lnk
backup=c:\windows\pss\Bluetooth Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACU]
2009-03-06 09:26 479320 ----a-w- c:\program files\Atheros\ACU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 12:00 110592 ----a-w- c:\windows\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CoolSwitch]
2002-03-19 23:30 45632 ----a-w- c:\windows\system32\TaskSwitch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 12:00 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDWMon]
2007-04-14 00:16 311296 ----a-w- c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\DDWMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-05-21 19:18 163840 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-05-21 19:18 143360 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2008-04-14 12:00 208952 ----a-w- c:\windows\ime\IMJP8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2009-02-27 12:40 1202448 ----a-w- c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2009-02-27 13:22 1368064 ----a-w- c:\program files\Intel\WiFi\bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-11-10 07:39 5244216 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-05-21 19:17 135168 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2008-04-14 12:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2008-04-14 12:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2009-03-13 00:21 17531392 ----a-w- c:\windows\RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search Protection]
2009-02-23 13:05 111856 ----a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2007-04-10 00:07 159744 ----a-w- c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-06-10 03:24 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-16 05:08 148888 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-03-18 17:19 1451304 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TDispVol]
2009-04-24 23:27 208896 ----a-w- c:\windows\system32\TDispVol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THotkey]
2009-06-10 17:05 368640 ----a-w- c:\program files\TOSHIBA\TOSHIBA Applet\THotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
2004-12-30 06:32 65536 ----a-w- c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
2009-05-19 15:11 283960 ----a-w- c:\windows\system32\TPSMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TWebCamera]
2009-05-26 12:11 2549624 ----a-w- c:\program files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2010-01-16 06:19 289584 ----a-w- c:\program files\uTorrent\uTorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2010-01-13 22:44 37888 ----a-w- c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
2009-02-23 13:05 111856 ----a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R0 iastor86;iastor86;c:\windows\system32\drivers\iastor86.sys [7/20/2009 12:48 AM 327192]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [1/16/2010 2:14 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1/16/2010 2:14 PM 20560]
R2 RSELSVC;TOSHIBA Modem region select service;c:\program files\TOSHIBA\RSelect\RSelSvc.exe [2/20/2009 5:52 AM 57344]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [3/27/2007 2:22 AM 105856]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [2/20/2007 2:15 AM 134016]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [1/16/2010 2:46 PM 5888]
R3 HSFHWCD2;HSFHWCD2;c:\windows\system32\drivers\HSFHWCD2.sys [2/9/2010 11:59 PM 162164]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [1/16/2010 3:04 PM 102656]
R3 PGEffect;Pangu effect driver;c:\windows\system32\drivers\PGEffect.sys [1/16/2010 2:53 PM 24064]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [1/16/2010 6:53 AM 340096]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1/16/2010 2:43 PM 1684736]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys --> c:\windows\system32\Drivers\RtsUStor.sys [?]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]

--- Other Services/Drivers In Memory ---

*Deregistered* - uphcleanhlp
.
Contents of the 'Scheduled Tasks' folder

2010-02-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-179605362-1417001333-1003Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-16 04:09]

2010-02-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-179605362-1417001333-1003UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-16 04:09]

2010-02-10 c:\windows\Tasks\User_Feed_Synchronization-{F1FADE19-5CFC-45FA-A4E9-31EF44FE5198}.job
- c:\windows\system32\msfeedssync.exe [2009-07-19 16:06]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {15FDA401-4F48-43A3-9046-7C7BBCEE16EB} = 203.131.75.67
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-ITSecMng - c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
MSConfigStartUp-TFncKy - TFncKy.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-10 12:03
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-02-10 12:04:20
ComboFix-quarantined-files.txt 2010-02-10 04:04

Pre-Run: 92,249,133,056 bytes free
Post-Run: 92,220,416,000 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 7A7B1B660DAB757949D466B00CD68EF6
February 10th, 2010, 12:20 AM
sheek

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 12:12:46 PM, on 2/10/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\TOSHIBA\RSelect\RSelSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashQuick.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{15FDA401-4F48-43A3-9046-7C7BBCEE16EB}: NameServer = 203.131.75.67
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: TOSHIBA Modem region select service (RSELSVC) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\RSelect\RSelSvc.exe
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 6987 bytes
February 10th, 2010, 12:37 AM
Broni
1. Please open Notepad
- Click Start , then Run
- Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

File:: c:\windows\ALCMTR.EXE Folder:: Driver:: Registry:: RegLockDel:: MIA:: c:\windows\System32\wscntfy.exe

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

https://discussions.virtualdr.com/im.../2016/03/2.gif

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
- Combofix.txt
- A new HijackThis log.
February 10th, 2010, 03:34 AM
sheek

ComboFix 10-02-09.03 - Owner 02/10/2010 15:23:37.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1916.1346 [GMT 8:00]
Running from: e:\sheryl\set up\ComboFix.exe
Command switches used :: e:\sheryl\set up\CFScript.txt

FILE ::
"c:\windows\ALCMTR.EXE"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\ALCMTR.EXE

c:\windows\System32\wscntfy.exe . . . is missing!!

.
((((((((((((((((((((((((( Files Created from 2010-01-10 to 2010-02-10 )))))))))))))))))))))))))))))))
.

2010-02-10 07:12 . 2010-02-10 07:12 -------- d-----w- c:\windows\system32\xircom
2010-02-10 07:12 . 2010-02-10 07:12 -------- d-----w- c:\windows\system32\wbem\snmp
2010-02-10 07:12 . 2010-02-10 07:12 -------- d-----w- c:\windows\system32\oobe
2010-02-10 07:12 . 2010-02-10 07:12 -------- d-----w- c:\program files\microsoft frontpage
2010-02-09 16:14 . 2010-02-09 16:27 2967799 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-02-09 15:59 . 2001-12-25 02:23 12074 ----a-r- c:\windows\system32\hsfinst.dll
2010-02-09 15:59 . 2010-02-09 15:59 -------- d-----w- c:\program files\CONEXANT
2010-02-09 15:59 . 2001-10-22 06:37 57344 ----a-r- c:\windows\system32\mdmxsdk.dll
2010-02-09 15:59 . 2002-03-08 16:01 6454 ----a-r- c:\windows\system32\drivers\firmware.bin
2010-02-09 15:59 . 2001-10-22 06:46 9855 ----a-r- c:\windows\system32\drivers\mdmxsdk.sys
2010-02-09 15:59 . 2002-03-14 07:08 1171616 ----a-r- c:\windows\system32\drivers\HSF_DP.sys
2010-02-09 15:59 . 2002-03-14 10:47 162164 ----a-r- c:\windows\system32\drivers\HSFHWCD2.sys
2010-02-09 15:59 . 2002-03-14 07:02 594960 ----a-r- c:\windows\system32\drivers\HSF_CNXT.sys
2010-02-09 15:36 . 2010-02-09 15:36 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-02-09 15:35 . 2009-04-06 07:32 15504 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-09 15:35 . 2009-04-06 07:32 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-09 15:35 . 2010-02-09 16:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-09 15:35 . 2010-02-09 15:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-01 14:20 . 2010-02-05 13:18 25 ----a-w- c:\windows\popcinfot.dat
2010-01-25 13:56 . 2010-01-25 13:56 -------- d-----w- c:\documents and settings\Owner\Application Data\Media Player Classic
2010-01-25 13:55 . 2009-12-12 14:15 178176 ----a-w- c:\windows\system32\unrar.dll
2010-01-25 13:55 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-01-25 13:55 . 2009-05-29 21:37 205824 ----a-w- c:\windows\system32\xvidvfw.dll
2010-01-25 13:55 . 2009-05-29 21:31 881664 ----a-w- c:\windows\system32\xvidcore.dll
2010-01-25 13:55 . 2010-01-05 18:00 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-01-25 13:55 . 2010-01-25 13:56 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-01-19 05:51 . 2010-01-19 05:51 -------- d-----w- c:\windows\system32\NtmsData
2010-01-18 10:29 . 2010-01-18 10:29 -------- d-----w- c:\program files\Defraggler
2010-01-17 15:43 . 2010-01-17 15:43 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap Games
2010-01-17 08:18 . 2010-02-10 04:34 1660 ----a-w- c:\windows\bthservsdp.dat
2010-01-17 05:49 . 2010-02-08 12:29 -------- d-----w- c:\documents and settings\Owner\Application Data\vlc
2010-01-17 05:24 . 2010-01-17 05:24 -------- d-----w- C:\logs
2010-01-17 05:24 . 2010-01-17 05:24 -------- d-----w- c:\documents and settings\Owner\ChikkaDefault
2010-01-16 17:50 . 2010-01-16 17:50 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Ahead
2010-01-16 17:48 . 2010-01-16 06:50 -------- d-----w- c:\program files\Ahead
2010-01-16 17:42 . 2004-03-22 21:17 25840 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2010-01-16 17:42 . 2004-03-22 21:17 24816 ----a-w- c:\windows\system32\mdimon.dll
2010-01-16 17:41 . 2010-01-16 17:41 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-01-16 17:41 . 2010-01-16 17:41 -------- d-----w- c:\windows\SHELLNEW
2010-01-16 17:41 . 2010-01-16 17:41 -------- d-----w- c:\program files\Microsoft.NET
2010-01-16 07:27 . 2010-01-16 07:27 -------- d-sh--w- c:\documents and settings\Owner\IECompatCache
2010-01-16 07:04 . 2009-02-18 02:34 112640 ----a-w- c:\windows\system32\drivers\ewusbnet.sys
2010-01-16 07:04 . 2008-12-30 17:55 102656 ----a-w- c:\windows\system32\drivers\ewusbfake.sys
2010-01-16 07:04 . 2008-12-13 17:26 102400 ----a-w- c:\windows\system32\drivers\ewusbmdm.sys
2010-01-16 07:04 . 2008-04-14 15:36 621056 ----a-w- c:\windows\system32\drivers\mod7700.sys
2010-01-16 07:04 . 2007-08-09 10:13 24448 ----a-w- c:\windows\system32\drivers\ewdcsc.sys
2010-01-16 07:04 . 2010-01-16 06:55 -------- d-----w- c:\program files\Smart Bro
2010-01-16 07:01 . 2010-01-16 06:59 64456 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-16 07:01 . 2010-01-16 07:01 -------- d-sh--w- c:\documents and settings\Owner\PrivacIE
2010-01-16 06:59 . 2010-01-16 06:59 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Stardock
2010-01-16 06:59 . 2010-01-16 06:59 -------- d-----w- c:\program files\Stardock
2010-01-16 06:59 . 2010-01-16 06:59 -------- d-----w- c:\program files\Common Files\Stardock
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Toshiba
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\ATI
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\Owner\Application Data\ATI
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2010-01-16 06:54 . 2010-01-16 06:57 -------- d-----w- c:\program files\Total Video Converter
2010-01-16 06:53 . 2009-04-29 15:09 24064 ----a-w- c:\windows\system32\drivers\PGEffect.sys
2010-01-16 06:52 . 2010-01-16 06:52 -------- d-----w- c:\program files\VideoLAN
2010-01-16 06:52 . 2008-06-10 07:00 69632 ----a-w- c:\windows\system32\TosOlkN.dll
2010-01-16 06:52 . 2008-06-10 07:00 40960 ----a-w- c:\windows\system32\ToscmddN.dll
2010-01-16 06:52 . 2008-06-10 07:00 24576 ----a-w- c:\windows\system32\TosusrpN.dll
2010-01-16 06:52 . 2008-06-10 07:00 102400 ----a-w- c:\windows\system32\Tossps.scr
2010-01-16 06:50 . 2009-05-19 15:11 283960 ----a-w- c:\windows\system32\TPSMain.exe
2010-01-16 06:50 . 2009-05-19 14:54 45056 ----a-w- c:\windows\system32\TPSMainCtl.dll
2010-01-16 06:50 . 2008-07-01 21:03 38200 ----a-w- c:\windows\system32\TPSBattM.exe
2010-01-16 06:50 . 2007-10-08 19:02 69632 ----a-w- c:\windows\system32\TPwrReg.dll
2010-01-16 06:50 . 2007-10-08 19:02 53248 ----a-w- c:\windows\system32\TPwrCfg.dll
2010-01-16 06:50 . 2007-10-08 19:02 45056 ----a-w- c:\windows\system32\TPSAddin.dll
2010-01-16 06:50 . 2007-10-08 19:02 40960 ----a-w- c:\windows\system32\TPSTrace.dll
2010-01-16 06:50 . 2007-10-08 19:02 77824 ----a-w- c:\windows\system32\CpuPerf.dll
2010-01-16 06:50 . 2007-10-08 19:02 40960 ----a-w- c:\windows\system32\TPSDel.dll
2010-01-16 06:50 . 2010-01-16 07:01 -------- d-----w- c:\documents and settings\Owner\Application Data\toshiba
2010-01-16 06:48 . 2009-05-27 18:18 279376 ----a-w- c:\windows\system32\drivers\tos_sps32.sys
2010-01-16 06:48 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\All Users\Application Data\TOSHIBA
2010-01-16 06:48 . 2010-01-16 06:48 -------- d-----w- c:\program files\Common Files\Toshiba Shared
2010-01-16 06:48 . 2007-11-21 23:23 129632 ----a-w- c:\windows\system32\TODDSrv.exe
2010-01-16 06:47 . 2003-01-29 21:35 12032 ----a-w- c:\windows\system32\drivers\Netdevio.sys
2010-01-16 06:46 . 2009-06-09 19:14 118784 ----a-w- c:\windows\system32\TCtrlIO.dll
2010-01-16 06:46 . 2009-02-13 16:51 53248 ----a-w- c:\windows\system32\DLLVGA.dll
2010-01-16 06:46 . 2009-01-10 00:04 28672 ----a-w- c:\windows\system32\TPeculiarity.dll
2010-01-16 06:46 . 2009-01-08 22:16 9728 ----a-w- c:\windows\system32\TCMSVR.dll
2010-01-16 06:46 . 2008-11-26 23:52 4608 ----a-w- c:\windows\system32\TSBWLS.dll
2010-01-16 06:46 . 2007-12-11 14:54 24576 ----a-w- c:\windows\system32\LEDONOFF.exe
2010-01-16 06:46 . 2007-04-04 14:56 5888 ----a-w- c:\windows\system32\drivers\FwLnk.sys
2010-01-16 06:46 . 2008-03-21 19:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll
2010-01-16 06:46 . 2010-01-16 06:46 -------- d-----w- c:\program files\Synaptics
2010-01-16 06:45 . 2009-03-18 17:20 208304 ----a-w- c:\windows\system32\drivers\SynTP.sys
2010-01-16 06:45 . 2009-03-18 17:19 161064 ----a-w- c:\windows\system32\SynTPAPI.dll
2010-01-16 06:45 . 2009-03-18 17:19 120104 ----a-w- c:\windows\system32\SynTPCo4.dll
2010-01-16 06:45 . 2009-03-18 17:19 206120 ----a-w- c:\windows\system32\SynCtrl.dll
2010-01-16 06:45 . 2009-03-18 17:19 169256 ----a-w- c:\windows\system32\SynCOM.dll
2010-01-16 06:45 . 2010-01-16 06:45 -------- d-----w- c:\program files\Realtek WLAN Driver
2010-01-16 06:44 . 2010-01-16 06:51 -------- d-----w- c:\windows\system32\sda
2010-01-16 06:43 . 2009-03-13 00:21 17531392 ----a-w- c:\windows\RTHDCPL.EXE
2010-01-16 06:43 . 2009-03-10 21:32 2168320 ----a-w- c:\windows\MicCal.exe
2010-01-16 06:43 . 2008-08-06 03:10 1684736 ----a-w- c:\windows\system32\drivers\Ambfilt.sys
2010-01-16 06:43 . 2008-06-19 23:42 2808832 ----a-w- c:\windows\ALCWZRD.EXE
2010-01-16 06:43 . 2006-01-04 22:41 1389056 ----a-w- c:\windows\system32\drivers\Monfilt.sys
2010-01-16 06:43 . 2008-08-25 23:17 528384 ----a-w- c:\windows\RtlExUpd.dll
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\Owner\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\LocalService\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\Default User\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\program files\Common Files\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Intel
2010-01-16 06:38 . 2010-01-16 06:41 -------- d-----w- c:\program files\Intel
2010-01-16 06:38 . 2008-07-16 23:05 53248 ----a-w- c:\windows\system32\CSVer.dll
2010-01-16 06:37 . 2010-01-16 06:37 -------- d-----w- C:\Intel
2010-01-16 06:37 . 2010-01-16 06:37 -------- d-----w- c:\program files\V.92 Modem On Hold
2010-01-16 06:37 . 2010-01-16 06:37 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Avanquest software
2010-01-16 06:36 . 2008-04-14 04:47 83072 ----a-w- c:\windows\system32\drivers\wdmaud.sys
2010-01-16 06:36 . 2008-04-14 04:15 6272 ----a-w- c:\windows\system32\drivers\splitter.sys
2010-01-16 06:36 . 2008-04-14 04:15 56576 ----a-w- c:\windows\system32\drivers\swmidi.sys
2010-01-16 06:36 . 2008-04-14 04:15 172416 ----a-w- c:\windows\system32\drivers\kmixer.sys
2010-01-16 06:36 . 2008-04-14 04:15 52864 ----a-w- c:\windows\system32\drivers\DMusic.sys
2010-01-16 06:36 . 2008-04-14 02:09 142592 ------w- c:\windows\system32\drivers\aec.sys
2010-01-16 06:36 . 2008-04-14 04:45 60800 ----a-w- c:\windows\system32\drivers\sysaudio.sys
2010-01-16 06:36 . 2008-04-14 04:15 2944 ----a-w- c:\windows\system32\drivers\drmkaud.sys
2010-01-16 06:36 . 2008-03-21 17:35 146048 ----a-w- c:\windows\system32\drivers\portcls.sys
2010-01-16 06:36 . 2008-04-14 04:15 60160 ----a-w- c:\windows\system32\drivers\drmk.sys
2010-01-16 06:36 . 2010-01-16 06:36 -------- d-----w- c:\documents and settings\Default User\Application Data\TOSHIBA
2010-01-16 06:35 . 2008-04-14 04:21 101120 ----a-w- c:\windows\system32\drivers\bthpan.sys
2010-01-16 06:35 . 2008-04-14 09:42 151552 ----a-w- c:\windows\system32\irftp.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-10 07:27 . 2010-01-16 05:50 2912032 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-10 04:34 . 2010-01-16 05:50 41180 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-09 16:49 . 2010-02-09 16:53 1657344 ----a-w- c:\windows\Internet Logs\xDB2.tmp
2010-01-25 13:48 . 2010-01-25 13:41 -------- d-----w- c:\documents and settings\Owner\Application Data\Winamp
2010-01-25 13:41 . 2010-01-25 13:41 -------- d-----w- c:\program files\Winamp
2010-01-25 13:41 . 2010-01-25 13:41 -------- d-----w- c:\program files\Winamp Detect
2010-01-20 15:27 . 2010-01-16 05:09 -------- d-----w- c:\program files\QuickTime Alternative
2010-01-18 06:17 . 2010-01-16 06:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-16 16:22 . 2010-01-16 04:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-01-16 06:46 . 2010-01-16 06:46 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01007.Wdf
2010-01-16 06:46 . 2010-01-16 06:46 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-01-16 06:44 . 2010-01-16 06:43 -------- d-----w- c:\program files\Realtek
2010-01-16 06:34 . 2010-01-16 05:48 -------- d-----w- c:\documents and settings\All Users\Application Data\MailFrontier
2010-01-16 06:30 . 2010-01-16 06:28 -------- d-----w- c:\program files\Atheros
2010-01-16 06:30 . 2010-01-16 06:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Atheros
2010-01-16 06:29 . 2010-01-16 06:33 51712 ----a-w- c:\windows\Internet Logs\xDB1.tmp
2010-01-16 06:28 . 2010-01-16 06:28 -------- d-----w- c:\documents and settings\Owner\Application Data\InstallShield
2010-01-16 06:09 . 2010-01-16 05:18 -------- d-----w- c:\program files\driver
2010-01-16 05:52 . 2010-01-16 05:52 -------- d-----w- c:\documents and settings\Owner\Application Data\MailFrontier
2010-01-16 05:47 . 2010-01-16 05:47 -------- d-----w- c:\program files\Zone Labs
2010-01-16 05:46 . 2010-01-16 05:01 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\Unlocker
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\MediaLooks
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\7-Zip
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\documents and settings\Owner\Application Data\Foxit
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\Foxit Software
2010-01-16 05:09 . 2010-01-16 05:09 318 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{A7050037-F0EA-4BAB-BCD5-FC05507D6147}\ARPPRODUCTICON.exe
2010-01-16 05:09 . 2010-01-16 05:09 25214 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{FF77941A-2BFA-4A18-BE2E-69B9498E4D55}\_294823.exe
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\UPHClean
2010-01-16 05:08 . 2010-01-16 05:08 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-01-16 05:08 . 2010-01-16 05:08 410984 ----a-w- c:\windows\system32\deploytk.dll
2010-01-16 05:08 . 2010-01-16 05:08 -------- d-----w- c:\program files\Java
2010-01-16 05:06 . 2010-01-16 05:06 94248 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-16 05:06 . 2010-01-16 05:06 -------- d-----w- c:\program files\Reference Assemblies
2010-01-16 05:01 . 2010-01-16 05:01 -------- d-----w- c:\program files\Windows Media Connect 2
2010-01-16 05:00 . 2010-01-16 05:00 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-01-16 04:59 . 2010-01-16 04:59 -------- d-----w- c:\program files\MSXML 4.0
2010-01-16 04:59 . 2010-01-16 04:59 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-16 04:51 . 2010-01-16 04:51 388096 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-16 04:51 . 2010-01-16 04:51 -------- d-----w- c:\program files\TrendMicro
2010-01-16 04:45 . 2010-01-16 04:44 -------- d-----w- c:\documents and settings\Owner\Application Data\Yahoo!
2010-01-16 04:44 . 2010-01-16 04:38 -------- d-----w- c:\program files\Yahoo!
2010-01-16 04:44 . 2010-01-16 04:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-01-16 04:18 . 2010-01-16 04:18 -------- d-----w- c:\program files\CCleaner
.
***1/2 page***
February 10th, 2010, 03:35 AM
sheek

***2/2 page***

------- Sigcheck -------

[-] 2009-07-19 . BA8C046D98345129723E6BCAA1E8AB99 . 361600 . . [5.1.2600.5649] . . c:\windows\system32\drivers\tcpip.sys

c:\windows\System32\wscntfy.exe ... is missing !!
.
((((((((((((((((((((((((((((( SnapShot@2010-02-10_04.03.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-10 07:13 . 2010-02-10 07:13 16384 c:\windows\Temp\Perflib_Perfdata_730.dat
+ 2010-02-10 07:12 . 2010-02-10 07:12 16384 c:\windows\Temp\Perflib_Perfdata_3a0.dat
+ 2008-04-14 12:00 . 2010-02-10 07:17 71462 c:\windows\system32\perfc009.dat
- 2008-04-14 12:00 . 2010-02-10 02:53 71462 c:\windows\system32\perfc009.dat
+ 2010-01-16 05:50 . 2010-02-10 07:22 300920 c:\windows\system32\ZoneLabs\avsys\bases\sfdb.dat
+ 2008-04-14 12:00 . 2010-02-10 07:17 441692 c:\windows\system32\perfh009.dat
- 2008-04-14 12:00 . 2010-02-10 02:53 441692 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-01-16 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CFSServ.exe"="CFSServ.exe -NoClient" [X]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-13 919016]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-07-19 128512]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2010-1-16 3450608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"MaxRecentDocs"= 18 (0x12)
"NoSMConfigurePrograms"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth Monitor.lnk
backup=c:\windows\pss\Bluetooth Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACU]
2009-03-06 09:26 479320 ----a-w- c:\program files\Atheros\ACU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 12:00 110592 ----a-w- c:\windows\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CoolSwitch]
2002-03-19 23:30 45632 ----a-w- c:\windows\system32\TaskSwitch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 12:00 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDWMon]
2007-04-14 00:16 311296 ----a-w- c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\DDWMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-05-21 19:18 163840 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-05-21 19:18 143360 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2008-04-14 12:00 208952 ----a-w- c:\windows\ime\IMJP8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2009-02-27 12:40 1202448 ----a-w- c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2009-02-27 13:22 1368064 ----a-w- c:\program files\Intel\WiFi\bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-11-10 07:39 5244216 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-05-21 19:17 135168 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2008-04-14 12:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2008-04-14 12:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2009-03-13 00:21 17531392 ----a-w- c:\windows\RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search Protection]
2009-02-23 13:05 111856 ----a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2007-04-10 00:07 159744 ----a-w- c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-06-10 03:24 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-16 05:08 148888 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-03-18 17:19 1451304 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TDispVol]
2009-04-24 23:27 208896 ----a-w- c:\windows\system32\TDispVol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THotkey]
2009-06-10 17:05 368640 ----a-w- c:\program files\TOSHIBA\TOSHIBA Applet\THotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
2004-12-30 06:32 65536 ----a-w- c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
2009-05-19 15:11 283960 ----a-w- c:\windows\system32\TPSMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TWebCamera]
2009-05-26 12:11 2549624 ----a-w- c:\program files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2010-01-16 06:19 289584 ----a-w- c:\program files\uTorrent\uTorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2010-01-13 22:44 37888 ----a-w- c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
2009-02-23 13:05 111856 ----a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R0 iastor86;iastor86;c:\windows\system32\drivers\iastor86.sys [7/20/2009 12:48 AM 327192]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [1/16/2010 2:14 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1/16/2010 2:14 PM 20560]
R2 RSELSVC;TOSHIBA Modem region select service;c:\program files\TOSHIBA\RSelect\RSelSvc.exe [2/20/2009 5:52 AM 57344]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [3/27/2007 2:22 AM 105856]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [2/20/2007 2:15 AM 134016]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [1/16/2010 2:46 PM 5888]
R3 HSFHWCD2;HSFHWCD2;c:\windows\system32\drivers\HSFHWCD2.sys [2/9/2010 11:59 PM 162164]
R3 PGEffect;Pangu effect driver;c:\windows\system32\drivers\PGEffect.sys [1/16/2010 2:53 PM 24064]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [1/16/2010 6:53 AM 340096]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1/16/2010 2:43 PM 1684736]
S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [1/16/2010 3:04 PM 102656]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys --> c:\windows\system32\Drivers\RtsUStor.sys [?]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]

--- Other Services/Drivers In Memory ---

*Deregistered* - uphcleanhlp
.
Contents of the 'Scheduled Tasks' folder

2010-02-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-179605362-1417001333-1003Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-16 04:09]

2010-02-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-179605362-1417001333-1003UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-16 04:09]

2010-02-10 c:\windows\Tasks\User_Feed_Synchronization-{F1FADE19-5CFC-45FA-A4E9-31EF44FE5198}.job
- c:\windows\system32\msfeedssync.exe [2009-07-19 16:06]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
Completion time: 2010-02-10 15:28:05
ComboFix-quarantined-files.txt 2010-02-10 07:28
ComboFix2.txt 2010-02-10 04:04

Pre-Run: 92,217,192,448 bytes free
Post-Run: 92,180,242,432 bytes free

- - End Of File - - 326B622D186A703845AB7917F2A86CB2
February 10th, 2010, 03:38 AM
sheek

Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 3:37:13 PM, on 2/10/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Program Files\Intel\WiFi\bin\EvtEng.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
C:\Program Files\TOSHIBA\RSelect\RSelSvc.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{15FDA401-4F48-43A3-9046-7C7BBCEE16EB}: NameServer = 203.131.75.67
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
O23 - Service: TOSHIBA Modem region select service (RSELSVC) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\RSelect\RSelSvc.exe
O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\S24EvMon.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 6912 bytes
February 10th, 2010, 03:40 AM
Broni
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2
- Double-click SystemLook.exe to run it.
- Vista users:: Right click on SystemLook.exe, click Run As Administrator
- Copy the content of the following box into the main textfield:
  
  Code:
  
  :filefind wscntfy.exe
- Click the Look button to start the scan.
- When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt
February 10th, 2010, 09:36 AM
sheek

here's the result what shall i do next...?

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 21:35 on 10/02/2010 by Owner (Administrator - Elevation successful)

========== filefind ==========

Searching for "wscntfy.exe"
No files found.

-=End Of File=-
February 10th, 2010, 07:59 PM
Broni

1 Attachment(s)

Attached is zipped wscntfy.exe file.
Unzip it and paste wscntfy.exe file into c:\windows\System32 folder.

Re-run Combofix and post its fresh log.
February 11th, 2010, 08:39 PM
sheek

2 Attachment(s)

i just did the instructions you said broni...but there's a message box telling (open win.doc)

and i inserted the xp sp3 installer but there appears again a message box telling (open win2.doc)

what should i do..?i think there's no way to execute that file...
February 11th, 2010, 09:27 PM
Broni

The first message is simply generic warning.
Cancel the message and forget about it.

Please, re run Combofix.
February 11th, 2010, 10:06 PM
sheek

ComboFix 10-02-09.03 - Owner 02/12/2010 9:56.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1916.1394 [GMT 8:00]
Running from: e:\sheryl\set up\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2010-01-12 to 2010-02-12 )))))))))))))))))))))))))))))))
.

2010-02-10 07:12 . 2010-02-10 07:12 -------- d-----w- c:\windows\system32\xircom
2010-02-10 07:12 . 2010-02-10 07:12 -------- d-----w- c:\windows\system32\wbem\snmp
2010-02-10 07:12 . 2010-02-10 07:12 -------- d-----w- c:\windows\system32\oobe
2010-02-10 07:12 . 2010-02-10 07:12 -------- d-----w- c:\program files\microsoft frontpage
2010-02-09 16:14 . 2010-02-09 16:27 2967799 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-02-09 15:59 . 2001-12-25 02:23 12074 ----a-r- c:\windows\system32\hsfinst.dll
2010-02-09 15:59 . 2010-02-09 15:59 -------- d-----w- c:\program files\CONEXANT
2010-02-09 15:59 . 2001-10-22 06:37 57344 ----a-r- c:\windows\system32\mdmxsdk.dll
2010-02-09 15:59 . 2002-03-08 16:01 6454 ----a-r- c:\windows\system32\drivers\firmware.bin
2010-02-09 15:59 . 2001-10-22 06:46 9855 ----a-r- c:\windows\system32\drivers\mdmxsdk.sys
2010-02-09 15:59 . 2002-03-14 07:08 1171616 ----a-r- c:\windows\system32\drivers\HSF_DP.sys
2010-02-09 15:59 . 2002-03-14 10:47 162164 ----a-r- c:\windows\system32\drivers\HSFHWCD2.sys
2010-02-09 15:59 . 2002-03-14 07:02 594960 ----a-r- c:\windows\system32\drivers\HSF_CNXT.sys
2010-02-09 15:36 . 2010-02-09 15:36 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2010-02-09 15:35 . 2009-04-06 07:32 15504 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-02-09 15:35 . 2009-04-06 07:32 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-02-09 15:35 . 2010-02-09 16:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-09 15:35 . 2010-02-09 15:35 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-02-01 14:20 . 2010-02-05 13:18 25 ----a-w- c:\windows\popcinfot.dat
2010-01-25 13:56 . 2010-01-25 13:56 -------- d-----w- c:\documents and settings\Owner\Application Data\Media Player Classic
2010-01-25 13:55 . 2009-12-12 14:15 178176 ----a-w- c:\windows\system32\unrar.dll
2010-01-25 13:55 . 2004-01-25 16:18 217088 ----a-w- c:\windows\system32\yv12vfw.dll
2010-01-25 13:55 . 2009-05-29 21:37 205824 ----a-w- c:\windows\system32\xvidvfw.dll
2010-01-25 13:55 . 2009-05-29 21:31 881664 ----a-w- c:\windows\system32\xvidcore.dll
2010-01-25 13:55 . 2010-01-05 18:00 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2010-01-25 13:55 . 2010-01-25 13:56 -------- d-----w- c:\program files\K-Lite Codec Pack
2010-01-19 05:51 . 2010-01-19 05:51 -------- d-----w- c:\windows\system32\NtmsData
2010-01-18 10:29 . 2010-01-18 10:29 -------- d-----w- c:\program files\Defraggler
2010-01-17 15:43 . 2010-01-17 15:43 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap Games
2010-01-17 08:18 . 2010-02-12 01:52 1660 ----a-w- c:\windows\bthservsdp.dat
2010-01-17 05:49 . 2010-02-08 12:29 -------- d-----w- c:\documents and settings\Owner\Application Data\vlc
2010-01-17 05:24 . 2010-01-17 05:24 -------- d-----w- C:\logs
2010-01-17 05:24 . 2010-01-17 05:24 -------- d-----w- c:\documents and settings\Owner\ChikkaDefault
2010-01-16 17:50 . 2010-01-16 17:50 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Ahead
2010-01-16 17:48 . 2010-01-16 06:50 -------- d-----w- c:\program files\Ahead
2010-01-16 17:42 . 2004-03-22 21:17 25840 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\mdippr.dll
2010-01-16 17:42 . 2004-03-22 21:17 24816 ----a-w- c:\windows\system32\mdimon.dll
2010-01-16 17:41 . 2010-01-16 17:41 -------- d-----w- c:\program files\Microsoft ActiveSync
2010-01-16 17:41 . 2010-01-16 17:41 -------- d-----w- c:\windows\SHELLNEW
2010-01-16 17:41 . 2010-01-16 17:41 -------- d-----w- c:\program files\Microsoft.NET
2010-01-16 07:27 . 2010-01-16 07:27 -------- d-sh--w- c:\documents and settings\Owner\IECompatCache
2010-01-16 07:04 . 2009-02-18 02:34 112640 ----a-w- c:\windows\system32\drivers\ewusbnet.sys
2010-01-16 07:04 . 2008-12-30 17:55 102656 ----a-w- c:\windows\system32\drivers\ewusbfake.sys
2010-01-16 07:04 . 2008-12-13 17:26 102400 ----a-w- c:\windows\system32\drivers\ewusbmdm.sys
2010-01-16 07:04 . 2008-04-14 15:36 621056 ----a-w- c:\windows\system32\drivers\mod7700.sys
2010-01-16 07:04 . 2007-08-09 10:13 24448 ----a-w- c:\windows\system32\drivers\ewdcsc.sys
2010-01-16 07:04 . 2010-01-16 06:55 -------- d-----w- c:\program files\Smart Bro
2010-01-16 07:01 . 2010-01-16 06:59 64456 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-01-16 07:01 . 2010-01-16 07:01 -------- d-sh--w- c:\documents and settings\Owner\PrivacIE
2010-01-16 06:59 . 2010-01-16 06:59 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Stardock
2010-01-16 06:59 . 2010-01-16 06:59 -------- d-----w- c:\program files\Stardock
2010-01-16 06:59 . 2010-01-16 06:59 -------- d-----w- c:\program files\Common Files\Stardock
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Toshiba
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\ATI
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\Owner\Application Data\ATI
2010-01-16 06:56 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\All Users\Application Data\ATI
2010-01-16 06:54 . 2010-01-16 06:57 -------- d-----w- c:\program files\Total Video Converter
2010-01-16 06:53 . 2009-04-29 15:09 24064 ----a-w- c:\windows\system32\drivers\PGEffect.sys
2010-01-16 06:52 . 2010-01-16 06:52 -------- d-----w- c:\program files\VideoLAN
2010-01-16 06:52 . 2008-06-10 07:00 69632 ----a-w- c:\windows\system32\TosOlkN.dll
2010-01-16 06:52 . 2008-06-10 07:00 40960 ----a-w- c:\windows\system32\ToscmddN.dll
2010-01-16 06:52 . 2008-06-10 07:00 24576 ----a-w- c:\windows\system32\TosusrpN.dll
2010-01-16 06:52 . 2008-06-10 07:00 102400 ----a-w- c:\windows\system32\Tossps.scr
2010-01-16 06:50 . 2009-05-19 15:11 283960 ----a-w- c:\windows\system32\TPSMain.exe
2010-01-16 06:50 . 2009-05-19 14:54 45056 ----a-w- c:\windows\system32\TPSMainCtl.dll
2010-01-16 06:50 . 2008-07-01 21:03 38200 ----a-w- c:\windows\system32\TPSBattM.exe
2010-01-16 06:50 . 2007-10-08 19:02 69632 ----a-w- c:\windows\system32\TPwrReg.dll
2010-01-16 06:50 . 2007-10-08 19:02 53248 ----a-w- c:\windows\system32\TPwrCfg.dll
2010-01-16 06:50 . 2007-10-08 19:02 45056 ----a-w- c:\windows\system32\TPSAddin.dll
2010-01-16 06:50 . 2007-10-08 19:02 40960 ----a-w- c:\windows\system32\TPSTrace.dll
2010-01-16 06:50 . 2007-10-08 19:02 77824 ----a-w- c:\windows\system32\CpuPerf.dll
2010-01-16 06:50 . 2007-10-08 19:02 40960 ----a-w- c:\windows\system32\TPSDel.dll
2010-01-16 06:50 . 2010-01-16 07:01 -------- d-----w- c:\documents and settings\Owner\Application Data\toshiba
2010-01-16 06:48 . 2009-05-27 18:18 279376 ----a-w- c:\windows\system32\drivers\tos_sps32.sys
2010-01-16 06:48 . 2010-01-16 06:56 -------- d-----w- c:\documents and settings\All Users\Application Data\TOSHIBA
2010-01-16 06:48 . 2010-01-16 06:48 -------- d-----w- c:\program files\Common Files\Toshiba Shared
2010-01-16 06:48 . 2007-11-21 23:23 129632 ----a-w- c:\windows\system32\TODDSrv.exe
2010-01-16 06:47 . 2003-01-29 21:35 12032 ----a-w- c:\windows\system32\drivers\Netdevio.sys
2010-01-16 06:46 . 2009-06-09 19:14 118784 ----a-w- c:\windows\system32\TCtrlIO.dll
2010-01-16 06:46 . 2009-02-13 16:51 53248 ----a-w- c:\windows\system32\DLLVGA.dll
2010-01-16 06:46 . 2009-01-10 00:04 28672 ----a-w- c:\windows\system32\TPeculiarity.dll
2010-01-16 06:46 . 2009-01-08 22:16 9728 ----a-w- c:\windows\system32\TCMSVR.dll
2010-01-16 06:46 . 2008-11-26 23:52 4608 ----a-w- c:\windows\system32\TSBWLS.dll
2010-01-16 06:46 . 2007-12-11 14:54 24576 ----a-w- c:\windows\system32\LEDONOFF.exe
2010-01-16 06:46 . 2007-04-04 14:56 5888 ----a-w- c:\windows\system32\drivers\FwLnk.sys
2010-01-16 06:46 . 2008-03-21 19:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll
2010-01-16 06:46 . 2010-01-16 06:46 -------- d-----w- c:\program files\Synaptics
2010-01-16 06:45 . 2009-03-18 17:20 208304 ----a-w- c:\windows\system32\drivers\SynTP.sys
2010-01-16 06:45 . 2009-03-18 17:19 161064 ----a-w- c:\windows\system32\SynTPAPI.dll
2010-01-16 06:45 . 2009-03-18 17:19 120104 ----a-w- c:\windows\system32\SynTPCo4.dll
2010-01-16 06:45 . 2009-03-18 17:19 206120 ----a-w- c:\windows\system32\SynCtrl.dll
2010-01-16 06:45 . 2009-03-18 17:19 169256 ----a-w- c:\windows\system32\SynCOM.dll
2010-01-16 06:45 . 2010-01-16 06:45 -------- d-----w- c:\program files\Realtek WLAN Driver
2010-01-16 06:44 . 2010-01-16 06:51 -------- d-----w- c:\windows\system32\sda
2010-01-16 06:43 . 2009-03-13 00:21 17531392 ----a-w- c:\windows\RTHDCPL.EXE
2010-01-16 06:43 . 2009-03-10 21:32 2168320 ----a-w- c:\windows\MicCal.exe
2010-01-16 06:43 . 2008-08-06 03:10 1684736 ----a-w- c:\windows\system32\drivers\Ambfilt.sys
2010-01-16 06:43 . 2008-06-19 23:42 2808832 ----a-w- c:\windows\ALCWZRD.EXE
2010-01-16 06:43 . 2006-01-04 22:41 1389056 ----a-w- c:\windows\system32\drivers\Monfilt.sys
2010-01-16 06:43 . 2008-08-25 23:17 528384 ----a-w- c:\windows\RtlExUpd.dll
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\Owner\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\LocalService\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\Default User\Application Data\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\program files\Common Files\Intel
2010-01-16 06:41 . 2010-01-16 06:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Intel
2010-01-16 06:38 . 2010-01-16 06:41 -------- d-----w- c:\program files\Intel
2010-01-16 06:38 . 2008-07-16 23:05 53248 ----a-w- c:\windows\system32\CSVer.dll
2010-01-16 06:37 . 2010-01-16 06:37 -------- d-----w- C:\Intel
2010-01-16 06:37 . 2010-01-16 06:37 -------- d-----w- c:\program files\V.92 Modem On Hold
2010-01-16 06:37 . 2010-01-16 06:37 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Avanquest software
2010-01-16 06:36 . 2008-04-14 04:47 83072 ----a-w- c:\windows\system32\drivers\wdmaud.sys
2010-01-16 06:36 . 2008-04-14 04:15 6272 ----a-w- c:\windows\system32\drivers\splitter.sys
2010-01-16 06:36 . 2008-04-14 04:15 56576 ----a-w- c:\windows\system32\drivers\swmidi.sys
2010-01-16 06:36 . 2008-04-14 04:15 172416 ----a-w- c:\windows\system32\drivers\kmixer.sys
2010-01-16 06:36 . 2008-04-14 04:15 52864 ----a-w- c:\windows\system32\drivers\DMusic.sys
2010-01-16 06:36 . 2008-04-14 02:09 142592 ------w- c:\windows\system32\drivers\aec.sys
2010-01-16 06:36 . 2008-04-14 04:45 60800 ----a-w- c:\windows\system32\drivers\sysaudio.sys
2010-01-16 06:36 . 2008-04-14 04:15 2944 ----a-w- c:\windows\system32\drivers\drmkaud.sys
2010-01-16 06:36 . 2008-03-21 17:35 146048 ----a-w- c:\windows\system32\drivers\portcls.sys
2010-01-16 06:36 . 2008-04-14 04:15 60160 ----a-w- c:\windows\system32\drivers\drmk.sys
2010-01-16 06:36 . 2010-01-16 06:36 -------- d-----w- c:\documents and settings\Default User\Application Data\TOSHIBA
2010-01-16 06:35 . 2008-04-14 04:21 101120 ----a-w- c:\windows\system32\drivers\bthpan.sys
2010-01-16 06:35 . 2008-04-14 09:42 151552 ----a-w- c:\windows\system32\irftp.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-12 02:00 . 2010-01-16 05:50 3103776 --sha-w- c:\windows\system32\drivers\fidbox.dat
2010-02-12 01:52 . 2010-01-16 05:50 44060 --sha-w- c:\windows\system32\drivers\fidbox.idx
2010-02-09 16:49 . 2010-02-09 16:53 1657344 ----a-w- c:\windows\Internet Logs\xDB2.tmp
2010-01-25 13:48 . 2010-01-25 13:41 -------- d-----w- c:\documents and settings\Owner\Application Data\Winamp
2010-01-25 13:41 . 2010-01-25 13:41 -------- d-----w- c:\program files\Winamp
2010-01-25 13:41 . 2010-01-25 13:41 -------- d-----w- c:\program files\Winamp Detect
2010-01-20 15:27 . 2010-01-16 05:09 -------- d-----w- c:\program files\QuickTime Alternative
2010-01-18 06:17 . 2010-01-16 06:28 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-16 16:22 . 2010-01-16 04:44 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-01-16 06:46 . 2010-01-16 06:46 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01007.Wdf
2010-01-16 06:46 . 2010-01-16 06:46 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-01-16 06:44 . 2010-01-16 06:43 -------- d-----w- c:\program files\Realtek
2010-01-16 06:34 . 2010-01-16 05:48 -------- d-----w- c:\documents and settings\All Users\Application Data\MailFrontier
2010-01-16 06:30 . 2010-01-16 06:28 -------- d-----w- c:\program files\Atheros
2010-01-16 06:30 . 2010-01-16 06:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Atheros
2010-01-16 06:29 . 2010-01-16 06:33 51712 ----a-w- c:\windows\Internet Logs\xDB1.tmp
2010-01-16 06:28 . 2010-01-16 06:28 -------- d-----w- c:\documents and settings\Owner\Application Data\InstallShield
2010-01-16 06:09 . 2010-01-16 05:18 -------- d-----w- c:\program files\driver
2010-01-16 05:52 . 2010-01-16 05:52 -------- d-----w- c:\documents and settings\Owner\Application Data\MailFrontier
2010-01-16 05:47 . 2010-01-16 05:47 -------- d-----w- c:\program files\Zone Labs
2010-01-16 05:46 . 2010-01-16 05:01 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\Unlocker
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\MediaLooks
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\7-Zip
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\documents and settings\Owner\Application Data\Foxit
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\Foxit Software
2010-01-16 05:09 . 2010-01-16 05:09 318 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{A7050037-F0EA-4BAB-BCD5-FC05507D6147}\ARPPRODUCTICON.exe
2010-01-16 05:09 . 2010-01-16 05:09 25214 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{FF77941A-2BFA-4A18-BE2E-69B9498E4D55}\_294823.exe
2010-01-16 05:09 . 2010-01-16 05:09 -------- d-----w- c:\program files\UPHClean
2010-01-16 05:08 . 2010-01-16 05:08 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2010-01-16 05:08 . 2010-01-16 05:08 410984 ----a-w- c:\windows\system32\deploytk.dll
2010-01-16 05:08 . 2010-01-16 05:08 -------- d-----w- c:\program files\Java
2010-01-16 05:06 . 2010-01-16 05:06 94248 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-16 05:06 . 2010-01-16 05:06 -------- d-----w- c:\program files\Reference Assemblies
2010-01-16 05:01 . 2010-01-16 05:01 -------- d-----w- c:\program files\Windows Media Connect 2
2010-01-16 05:00 . 2010-01-16 05:00 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-01-16 04:59 . 2010-01-16 04:59 -------- d-----w- c:\program files\MSXML 4.0
2010-01-16 04:59 . 2010-01-16 04:59 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-16 04:51 . 2010-01-16 04:51 388096 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-01-16 04:51 . 2010-01-16 04:51 -------- d-----w- c:\program files\TrendMicro
2010-01-16 04:45 . 2010-01-16 04:44 -------- d-----w- c:\documents and settings\Owner\Application Data\Yahoo!
2010-01-16 04:44 . 2010-01-16 04:38 -------- d-----w- c:\program files\Yahoo!
2010-01-16 04:44 . 2010-01-16 04:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2010-01-16 04:18 . 2010-01-16 04:18 -------- d-----w- c:\program files\CCleaner
.

------- Sigcheck -------

[-] 2009-07-19 . BA8C046D98345129723E6BCAA1E8AB99 . 361600 . . [5.1.2600.5649] . . c:\windows\system32\drivers\tcpip.sys

c:\windows\System32\wscntfy.exe ... is missing !!
.
((((((((((((((((((((((((((((( SnapShot@2010-02-10_04.03.16 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-02-12 01:54 . 2010-02-12 01:54 16384 c:\windows\Temp\Perflib_Perfdata_2b0.dat
+ 2010-02-12 01:53 . 2010-02-12 01:53 16384 c:\windows\Temp\Perflib_Perfdata_104.dat
+ 2008-04-14 12:00 . 2010-02-12 01:58 71462 c:\windows\system32\perfc009.dat
- 2008-04-14 12:00 . 2010-02-10 02:53 71462 c:\windows\system32\perfc009.dat
+ 2010-01-16 05:50 . 2010-02-12 01:55 315424 c:\windows\system32\ZoneLabs\avsys\bases\sfdb.dat
- 2008-04-14 12:00 . 2010-02-10 02:53 441692 c:\windows\system32\perfh009.dat
+ 2008-04-14 12:00 . 2010-02-12 01:58 441692 c:\windows\system32\perfh009.dat
+ 2010-01-17 05:50 . 2010-02-11 15:15 5164544 c:\windows\system32\ZoneLabs\zlqrtdb.dat
+ 2010-01-16 05:48 . 2010-02-10 13:41 15336238 c:\windows\system32\ZoneLabs\spyware.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

***1/2 page***
February 11th, 2010, 10:08 PM
sheek

***2/2 page***
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-01-16 135664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CFSServ.exe"="CFSServ.exe -NoClient" [X]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-13 919016]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-07-19 128512]

c:\documents and settings\Owner\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - c:\program files\Stardock\ObjectDock\ObjectDock.exe [2010-1-16 3450608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"MaxRecentDocs"= 18 (0x12)
"NoSMConfigurePrograms"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Monitor.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth Monitor.lnk
backup=c:\windows\pss\Bluetooth Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ACU]
2009-03-06 09:26 479320 ----a-w- c:\program files\Atheros\ACU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 12:00 110592 ----a-w- c:\windows\system32\bthprops.cpl

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CoolSwitch]
2002-03-19 23:30 45632 ----a-w- c:\windows\system32\TaskSwitch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 12:00 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDWMon]
2007-04-14 00:16 311296 ----a-w- c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\DDWMon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-05-21 19:18 163840 ----a-w- c:\windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-05-21 19:18 143360 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
2008-04-14 12:00 208952 ----a-w- c:\windows\ime\IMJP8_1\imjpmig.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2009-02-27 12:40 1202448 ----a-w- c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelZeroConfig]
2009-02-27 13:22 1368064 ----a-w- c:\program files\Intel\WiFi\bin\ZCfgSvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-11-10 07:39 5244216 ----a-w- c:\progra~1\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-05-21 19:17 135168 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
2008-04-14 12:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
2008-04-14 12:00 455168 ----a-w- c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2009-03-13 00:21 17531392 ----a-w- c:\windows\RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Search Protection]
2009-02-23 13:05 111856 ----a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SmoothView]
2007-04-10 00:07 159744 ----a-w- c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2009-06-10 03:24 61440 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-01-16 05:08 148888 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-03-18 17:19 1451304 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TDispVol]
2009-04-24 23:27 208896 ----a-w- c:\windows\system32\TDispVol.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\THotkey]
2009-06-10 17:05 368640 ----a-w- c:\program files\TOSHIBA\TOSHIBA Applet\THotkey.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TOSCDSPD]
2004-12-30 06:32 65536 ----a-w- c:\program files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TPSMain]
2009-05-19 15:11 283960 ----a-w- c:\windows\system32\TPSMain.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TWebCamera]
2009-05-26 12:11 2549624 ----a-w- c:\program files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2010-01-16 06:19 289584 ----a-w- c:\program files\uTorrent\uTorrent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2010-01-13 22:44 37888 ----a-w- c:\program files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YSearchProtection]
2009-02-23 13:05 111856 ----a-w- c:\program files\Yahoo!\Search Protection\SearchProtection.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R0 iastor86;iastor86;c:\windows\system32\drivers\iastor86.sys [7/20/2009 12:48 AM 327192]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [1/16/2010 2:14 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [1/16/2010 2:14 PM 20560]
R2 RSELSVC;TOSHIBA Modem region select service;c:\program files\TOSHIBA\RSelect\RSelSvc.exe [2/20/2009 5:52 AM 57344]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [3/27/2007 2:22 AM 105856]
R2 trudf;TOSHIBA DVD-RAM UDF File System Driver;c:\windows\system32\drivers\trudf.sys [2/20/2007 2:15 AM 134016]
R3 FwLnk;FwLnk Driver;c:\windows\system32\drivers\FwLnk.sys [1/16/2010 2:46 PM 5888]
R3 PGEffect;Pangu effect driver;c:\windows\system32\drivers\PGEffect.sys [1/16/2010 2:53 PM 24064]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187B.sys [1/16/2010 6:53 AM 340096]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [1/16/2010 2:43 PM 1684736]
S3 HSFHWCD2;HSFHWCD2;c:\windows\system32\drivers\HSFHWCD2.sys [2/9/2010 11:59 PM 162164]
S3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\drivers\ewusbfake.sys [1/16/2010 3:04 PM 102656]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys --> c:\windows\system32\Drivers\RtsUStor.sys [?]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]

--- Other Services/Drivers In Memory ---

*Deregistered* - uphcleanhlp
.
Contents of the 'Scheduled Tasks' folder

2010-02-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-179605362-1417001333-1003Core.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-16 04:09]

2010-02-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1993962763-179605362-1417001333-1003UA.job
- c:\documents and settings\Owner\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-01-16 04:09]

2010-02-12 c:\windows\Tasks\User_Feed_Synchronization-{F1FADE19-5CFC-45FA-A4E9-31EF44FE5198}.job
- c:\windows\system32\msfeedssync.exe [2009-07-19 16:06]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com
mStart Page = hxxp://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-12 09:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3728)
c:\windows\system32\WININET.dll
c:\program files\Stardock\ObjectDock\DockShellHook.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-02-12 10:01:09
ComboFix-quarantined-files.txt 2010-02-12 02:01
ComboFix2.txt 2010-02-10 07:28
ComboFix3.txt 2010-02-10 04:04

Pre-Run: 91,991,277,568 bytes free
Post-Run: 91,953,696,768 bytes free

- - End Of File - - 71311D722F5E09D98C5A1C7D4D943D16
February 11th, 2010, 11:36 PM
Broni

Something wrong here.
Did you actually...

Quote:

Unzip it and paste wscntfy.exe file into c:\windows\System32 folder.

See, if the file is there.
February 12th, 2010, 01:31 AM
sheek

yes..but i deleted it...because if don't do that, the message box wont stop to reappear again..and i think there's no way to execute that file...but my laptop quite doing good...i did what you said lately..i did the system restore stuff and i defrag my laptop lately...is that wscntfy.exe important..?

and by the way whenever i reboot my laptop there's to option appearing before loading the windows xp...it says,

windows recovery console
windows xp professional

i can use the arrow keys to choose...but if i don't choose, it will appear in just 1.5 sec..and then windows xp start to load...how can i get rid of that option..?
February 12th, 2010, 01:31 AM
sheek

yes..but i deleted it...because if don't do that, the message box wont stop to reappear again..and i think there's no way to execute that file...but my laptop quite doing good...i did what you said lately..i did the system restore stuff and i defrag my laptop lately...is that wscntfy.exe important..?

and by the way whenever i reboot my laptop there's two option appearing before loading the windows xp...it says,

windows recovery console
windows xp professional

i can use the arrow keys to choose...but if i don't choose, it will appear in just 1.5 sec..and then windows xp starts to load...how can i get rid of that option..?

*sorry for the repost..i didn't mean it...
February 12th, 2010, 01:40 AM
Broni
Quote:

but my laptop quite doing good

We'll leave it alone then.

Quote:

and by the way whenever i reboot my laptop there's to option appearing before loading the windows xp...it says,

windows recovery console
windows xp professional

i can use the arrow keys to choose...but if i don't choose, it will appear in just 1.5 sec..and then windows xp starts to load...how can i get rid of that option..?

You could, but recovery console was installed for a reason.
It's a very useful tool, if the computer gets into serious trouble, like being not bootable.
It's for your own good.

I want you to run one more scan, but first...

Uninstall Combofix:
Go Start > Run [Vista users, go Start>"Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall"
Click OK (Vista users - press Enter).
Restart computer.

Then...

1. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

2. Go to Kaspersky website and perform an online antivirus scan.

1. Disable your active antivirus program.
2. Read through the requirements and privacy statement and click on Accept button.
3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
4. When the downloads have finished, click on Settings.
5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
- Archives
- Mail databases
6. Click on My Computer under Scan.
7. Once the scan is complete, it will display the results. Click on View Scan Report.
8. You will see a list of infected items there. Click on Save Report As....
9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

Post fresh HijackThis log as well.