multiple problems including keyboard issues & browser hijack attempts

oldman960 · 2008-02-15T08:17:09.000Z

Some improvement from time to time? I’m going to research that catchme fella. It’s just wierd the way it disappeared.

Seeing that you have Avenger we will feed that last file to it.

Files to delete: C:\TEMP\chtOna0119.exe

Just let me know what the results where. Finish up the previous items then we will look deeper.

Download WinPFind35u.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind35u on your desktop.

[*]Close ALL OTHER PROGRAMS.
[*]Open the WinPFind35u folder and double-click on WinPFind35U.exe to start the program.
[*]Under Additional Scans click the checkboxes in front of the following items to select them:

Reg - BotCheck

[*]Now click the Run Scan button on the toolbar.
[*]Let it run unhindered until it finishes.
[*]When the scan is complete Notepad will open with the report file loaded in it.
[*]Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Use the Add Reply button and attach the log. I will review it when it comes in.

Make the settings look like this except set the time to 60 Days and include the additional scans as indicated above.

http://forum.avast.com/index.php?topic=31261.msg260811#msg260811

system · 2008-02-17T09:47:43.000Z

I was able to paste “CFscript.txt” into Combofix. Also, as you can see, I could also attach the Combofix log, this time

I’m a bit foggy about what to do next…forgive me, my husband and kids are both sick and I have had about an hour of sleep in the last 36 hours. Perhaps I should go to bed and try to pick it up again tomorrow.

I can’t begin to tell you how much I appreciate your help.

oldman960 · 2008-02-17T10:20:03.000Z

Yeah, tell me about the bugs, been fighting it for months now.

Getting more functunality out of your omputer has to be a good sign.

You’re almost caught up, pick up at this point with the avenger script, then do the WinPFind35u

click this link, it will take you there.

http://forum.avast.com/index.php?topic=33048.msg278062#msg278062

system · 2008-02-17T20:53:29.000Z

Here is the log for Avenger
When I opened the computer again this morning it is back to business as usual
However when Avenger tried to restart my computer a window popped up in the lower right hand corner that said some process or other wanted to reboot the computer and there were two check boxes
one to allow and one to override

The name of the program was WINAntispyware which is the original troublemaker I thought Avast had gotten rid of months ago

Anyway here is the avenger log:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\vjocxwib

Fatal error: integrity of Services key failed verification check! Security may be fatally compromised. Exiting immediately.

Could not open script file! Status: 0xc0000034 Abort!

oldman960 · 2008-02-17T21:07:31.000Z

When you said “business as usual” was that in a good way?

I can’t find the file we gave to Avenger, so I think it got it.

What do you know about this program?

RABCO

Go ahead with the WinPFind35u

I didn’t see any thing in your last log about WINAntispyware

system · 2008-02-17T21:24:23.000Z

Sorry by business as usual I meant that all of the usual problems are back
I did not post anything about WINAntispyware because it has been gone for months
It is malware (a fake virus removal program) and it does not seem to show up in any log
Is it possible that I have virus remnants causing these problems?
I do not know what RABCO is

system · 2008-02-17T21:36:05.000Z

here is the log for winpfind:


WinPFind35 logfile created on: 2/17/2008 4:28:24 PM
WinPFind35U Version Beta52     Folder = C:\Documents and Settings\Carrie\Desktop\WinPFind35u
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
510.92 Mb Total Physical Memory | 180.41 Mb Available Physical Memory | 35.31% Memory free
1.22 Gb Paging File | 0.95 Gb Available in Paging File | 77.74% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536;
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 55.89 Gb Total Space | 35.40 Gb Free Space | 63.34% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: CARRIE
Current User Name: Carrie
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users

[Processes - Non-Microsoft Only]
s24evmon.exe -> %SystemRoot%\system32\S24EvMon.exe -> Intel Corporation  [Ver = 8, 0, 0, 161 | Size = 311363 bytes | Modified Date = 12/16/2003 6:42:32 PM | Attr =    ]
zcfgsvc.exe -> %SystemRoot%\system32\ZCfgSvc.exe -> Intel Corporation [Ver = 8, 0, 0, 161 | Size = 376832 bytes | Modified Date = 12/16/2003 6:47:42 PM | Attr =    ]
1xconfig.exe -> %SystemRoot%\system32\1XConfig.exe -> Intel [Ver = 8, 0, 0, 161 | Size = 184320 bytes | Modified Date = 12/16/2003 6:43:06 PM | Attr =    ]
aswupdsv.exe -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> ALWIL Software [Ver = 4, 7, 1098, 0 | Size = 17272 bytes | Modified Date = 12/4/2007 9:36:33 AM | Attr =    ]
ashserv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> ALWIL Software [Ver = 4, 7, 1098, 0 | Size = 140664 bytes | Modified Date = 12/4/2007 8:00:16 AM | Attr =    ]
00thotkey.exe -> %SystemRoot%\system32\00THotkey.exe -> TOSHIBA Corp. [Ver = 1, 0, 0, 21 | Size = 258048 bytes | Modified Date = 4/15/2003 11:01:28 PM | Attr =    ]
jusched.exe -> %ProgramFiles%\Java\j2re1.4.2_03\bin\jusched.exe ->  [Ver =  | Size = 32881 bytes | Modified Date = 2/6/2004 7:31:44 PM | Attr =    ]
agrsmmsg.exe -> %SystemRoot%\agrsmmsg.exe -> Agere Systems [Ver = 2.1.28.2 2.1.28.2 04/18/2003 11:20:08 | Size = 88363 bytes | Modified Date = 4/18/2003 2:20:10 PM | Attr =    ]
syntplpr.exe -> %ProgramFiles%\Synaptics\SynTP\SynTPLpr.exe -> Synaptics, Inc. [Ver = 7.5.11 30May03 | Size = 110592 bytes | Modified Date = 5/30/2003 10:25:02 PM | Attr =    ]
syntpenh.exe -> %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe -> Synaptics, Inc. [Ver = 7.5.11 30May03 | Size = 614400 bytes | Modified Date = 5/30/2003 10:23:14 PM | Attr =    ]
touched.exe -> %ProgramFiles%\Toshiba\TouchED\TouchED.exe -> TOSHIBA Corporation [Ver = 2, 5, 0, 0 | Size = 126976 bytes | Modified Date = 1/21/2003 9:00:06 PM | Attr =    ]
tfnf5.exe -> %SystemRoot%\system32\TFNF5.exe -> TOSHIBA Corp. [Ver = 2, 2, 0, 0 | Size = 73728 bytes | Modified Date = 7/18/2003 8:41:26 PM | Attr =    ]
ezsp_px.exe -> %SystemRoot%\system32\ezSP_Px.exe -> Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Modified Date = 8/20/2002 1:29:26 PM | Attr =    ]
pinger.exe -> %SystemDrive%\TOSHIBA\Ivp\ISM\pinger.exe -> TOSHIBA Corporation [Ver = 3.3 | Size = 159744 bytes | Modified Date = 10/20/2003 11:39:26 AM | Attr =    ]
bsclip.exe -> %ProgramFiles%\B's CLiP\Win2K\BsCLiP.exe ->  [Ver =  | Size = 1409024 bytes | Modified Date = 2/4/2004 8:43:00 AM | Attr =    ]
cfsvcs.exe -> %ProgramFiles%\Toshiba\ConfigFree\CFSvcs.exe -> TOSHIBA CORPORATION [Ver = 4, 50, 0, 2 | Size = 28672 bytes | Modified Date = 12/2/2003 8:05:54 PM | Attr =    ]
network adapter manager.exe -> %ProgramFiles%\Sierra Wireless Inc\Network Adapter Manager\Network Adapter Manager.exe -> Sierra Wireless Inc. [Ver = 2, 5, 11, 1 | Size = 163840 bytes | Modified Date = 10/9/2003 4:20:32 PM | Attr =    ]
qttask.exe -> %ProgramFiles%\QuickTime\qttask.exe -> Apple Computer, Inc. [Ver = 6.5.1 | Size = 98304 bytes | Modified Date = 8/18/2004 9:34:48 AM | Attr =    ]
picasamediadetector.exe -> %ProgramFiles%\Picasa2\PicasaMediaDetector.exe ->  [Ver =  | Size = 135168 bytes | Modified Date = 2/4/2005 6:32:51 PM | Attr =    ]
stacmon.exe -> %ProgramFiles%\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe -> SigmaTel Inc. [Ver = 1, 0, 0, 3 | Size = 86073 bytes | Modified Date = 8/3/2003 7:01:14 PM | Attr =    ]
tfncky.exe -> %ProgramFiles%\Toshiba\TOSHIBA Controls\TFncKy.exe -> TOSHIBA Corporation [Ver = 3.01.01 | Size = 102400 bytes | Modified Date = 8/18/2003 12:51:02 PM | Attr =    ]
ashdisp.exe -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe -> ALWIL Software [Ver = 4, 7, 1098, 0 | Size = 79224 bytes | Modified Date = 12/4/2007 8:00:23 AM | Attr =    ]
dvdramsv.exe -> %SystemRoot%\system32\DVDRAMSV.exe -> Matsushita Electric Industrial Co., Ltd. [Ver = 2, 0, 7, 0 | Size = 106496 bytes | Modified Date = 5/23/2003 4:38:26 PM | Attr =    ]
toscdspd.exe -> %ProgramFiles%\Toshiba\TOSCDSPD\TOSCDSPD.exe -> TOSHIBA [Ver = 1, 0, 5, 0 | Size = 65536 bytes | Modified Date = 9/5/2003 6:24:46 AM | Attr =    ]
tpsbattm.exe -> %SystemRoot%\system32\TPSBattM.exe -> TOSHIBA Corporation [Ver = 1, 0, 1, 0 | Size = 45056 bytes | Modified Date = 9/25/2003 1:19:10 PM | Attr =    ]
nvsvc32.exe -> %SystemRoot%\system32\nvsvc32.exe -> NVIDIA Corporation [Ver = 6.14.10.4562 | Size = 77824 bytes | Modified Date = 9/24/2003 9:00:00 PM | Attr =    ]
regsrvc.exe -> %SystemRoot%\system32\RegSrvc.exe -> Intel Corporation [Ver = 8, 0, 0, 161 | Size = 122880 bytes | Modified Date = 12/16/2003 6:41:40 PM | Attr =    ]
superantispyware.exe -> %ProgramFiles%\SUPERAntiSpyware\SUPERAntiSpyware.exe -> SUPERAntiSpyware.com [Ver = 3, 9, 0, 1008 | Size = 1318912 bytes | Modified Date = 6/21/2007 2:06:28 PM | Attr =    ]
swupdtmr.exe -> %SystemDrive%\TOSHIBA\Ivp\Swupdate\swupdtmr.exe ->  [Ver =  | Size = 53248 bytes | Modified Date = 10/21/2003 1:26:14 PM | Attr =    ]
ashmaisv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 7, 1098, 0 | Size = 247160 bytes | Modified Date = 12/4/2007 7:59:53 AM | Attr =    ]
ashwebsv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 7, 1098, 0 | Size = 345464 bytes | Modified Date = 12/4/2007 7:59:01 AM | Attr =    ]
winpfind35u.exe -> %UserProfile%\Desktop\WinPFind35u\WinPFind35U.exe -> OldTimer Tools [Ver = 1.0.0.0 | Size = 309760 bytes | Modified Date = 2/16/2008 1:03:26 PM | Attr =    ]

system · 2008-02-17T21:41:05.000Z

[Win32 Services - Non-Microsoft Only]
(aswUpdSv) avast! iAVS4 Control Service [Win32_Own | Auto | Running] → %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe → ALWIL Software [Ver = 4, 7, 1098, 0 | Size = 17272 bytes | Modified Date = 12/4/2007 9:36:33 AM | Attr = ]
(avast! Antivirus) avast! Antivirus [Win32_Own | Auto | Running] → %ProgramFiles%\Alwil Software\Avast4\ashServ.exe → ALWIL Software [Ver = 4, 7, 1098, 0 | Size = 140664 bytes | Modified Date = 12/4/2007 8:00:16 AM | Attr = ]
(avast! Mail Scanner) avast! Mail Scanner [Win32_Own | On_Demand | Running] → %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe → ALWIL Software [Ver = 4, 7, 1098, 0 | Size = 247160 bytes | Modified Date = 12/4/2007 7:59:53 AM | Attr = ]
(avast! Web Scanner) avast! Web Scanner [Win32_Own | On_Demand | Running] → %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe → ALWIL Software [Ver = 4, 7, 1098, 0 | Size = 345464 bytes | Modified Date = 12/4/2007 7:59:01 AM | Attr = ]
(CFSvcs) ConfigFree Service [Win32_Own | Auto | Running] → %ProgramFiles%\Toshiba\ConfigFree\CFSvcs.exe → TOSHIBA CORPORATION [Ver = 4, 50, 0, 2 | Size = 28672 bytes | Modified Date = 12/2/2003 8:05:54 PM | Attr = ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] → %SystemRoot%\system32\dmadmin.exe → Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 8/4/2004 2:56:48 AM | Attr = ]
(DVD-RAM_Service) DVD-RAM_Service [Win32_Own | Auto | Running] → %SystemRoot%\system32\DVDRAMSV.exe → Matsushita Electric Industrial Co., Ltd. [Ver = 2, 0, 7, 0 | Size = 106496 bytes | Modified Date = 5/23/2003 4:38:26 PM | Attr = ]
(gusvc) Google Updater Service [Win32_Own | On_Demand | Stopped] → %ProgramFiles%\Google\Common\Google Updater\GoogleUpdaterService.exe → Google [Ver = 2.0.734.29932.beta | Size = 138168 bytes | Modified Date = 6/2/2007 7:46:15 PM | Attr = ]
(iPodService) iPod Service [Win32_Own | On_Demand | Stopped] → %ProgramFiles%\iPod\bin\iPodService.exe → Apple Computer, Inc. [Ver = 4.6.0.15 | Size = 401408 bytes | Modified Date = 6/4/2004 11:37:56 AM | Attr = ]
(Macromedia Licensing Service) Macromedia Licensing Service [Win32_Own | On_Demand | Stopped] → %CommonProgramFiles%\Macromedia Shared\Service\Macromedia Licensing.exe → [Ver = 2.42.000 | Size = 68096 bytes | Modified Date = 9/23/2007 11:38:12 PM | Attr = ]
(NVSvc) NVIDIA Driver Helper Service [Win32_Own | Auto | Running] → %SystemRoot%\system32\nvsvc32.exe → NVIDIA Corporation [Ver = 6.14.10.4562 | Size = 77824 bytes | Modified Date = 9/24/2003 9:00:00 PM | Attr = ]
(Pml Driver HPZ12) Pml Driver HPZ12 [Win32_Own | On_Demand | Stopped] → %SystemRoot%\system32\hpzipm12.exe → HP [Ver = 7, 0, 0, 0 | Size = 65795 bytes | Modified Date = 8/11/2003 3:07:38 AM | Attr = ]
(RegSrvc) RegSrvc [Win32_Own | Auto | Running] → %SystemRoot%\system32\RegSrvc.exe → Intel Corporation [Ver = 8, 0, 0, 161 | Size = 122880 bytes | Modified Date = 12/16/2003 6:41:40 PM | Attr = ]
(S24EventMonitor) Spectrum24 Event Monitor [Win32_Own | Auto | Running] → %SystemRoot%\system32\S24EvMon.exe → Intel Corporation [Ver = 8, 0, 0, 161 | Size = 311363 bytes | Modified Date = 12/16/2003 6:42:32 PM | Attr = ]
(Swupdtmr) Swupdtmr [Win32_Own | Auto | Running] → %SystemDrive%\TOSHIBA\Ivp\Swupdate\swupdtmr.exe → [Ver = | Size = 53248 bytes | Modified Date = 10/21/2003 1:26:14 PM | Attr = ]

system · 2008-02-17T21:43:48.000Z

part three:
[Registry - Non-Microsoft Only]
< Run [HKEY_LOCAL_MACHINE] > → HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run →
000StTHK → %SystemRoot%\system32\000StTHK.exe → [Ver = | Size = 24576 bytes | Modified Date = 6/23/2001 11:28:06 PM | Attr = ]
00THotkey → %SystemRoot%\system32\00THotkey.exe → TOSHIBA Corp. [Ver = 1, 0, 0, 21 | Size = 258048 bytes | Modified Date = 4/15/2003 11:01:28 PM | Attr = ]
AGRSMMSG → %SystemRoot%\agrsmmsg.exe → Agere Systems [Ver = 2.1.28.2 2.1.28.2 04/18/2003 11:20:08 | Size = 88363 bytes | Modified Date = 4/18/2003 2:20:10 PM | Attr = ]
AirCardEnabler → %ProgramFiles%\Sierra Wireless Inc\Network Adapter Manager\Network Adapter Manager.exe → Sierra Wireless Inc. [Ver = 2, 5, 11, 1 | Size = 163840 bytes | Modified Date = 10/9/2003 4:20:32 PM | Attr = ]
avast! → %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe → ALWIL Software [Ver = 4, 7, 1098, 0 | Size = 79224 bytes | Modified Date = 12/4/2007 8:00:23 AM | Attr = ]
B’sCLiP → %ProgramFiles%\B’s CLiP\Win2K\BsCLiP.exe → [Ver = | Size = 1409024 bytes | Modified Date = 2/4/2004 8:43:00 AM | Attr = ]
ezShieldProtector for Px → %SystemRoot%\system32\ezSP_Px.exe → Easy Systems Japan Ltd. [Ver = 1, 0, 0, 0 | Size = 40960 bytes | Modified Date = 8/20/2002 1:29:26 PM | Attr = ]
NvCplDaemon → %SystemRoot%\system32\nvcpl.dll → NVIDIA Corporation [Ver = 6.14.10.4562 | Size = 4861952 bytes | Modified Date = 9/24/2003 9:00:00 PM | Attr = ]
Picasa Media Detector → %ProgramFiles%\Picasa2\PicasaMediaDetector.exe → [Ver = | Size = 135168 bytes | Modified Date = 2/4/2005 6:32:51 PM | Attr = ]
Pinger → %SystemDrive%\TOSHIBA\Ivp\ISM\pinger.exe → TOSHIBA Corporation [Ver = 3.3 | Size = 159744 bytes | Modified Date = 10/20/2003 11:39:26 AM | Attr = ]
PRONoMgr.exe → %ProgramFiles%\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe → Intel(R) Corporation [Ver = 6.1.304.0 | Size = 86016 bytes | Modified Date = 12/10/2003 4:36:16 AM | Attr = ]
QuickTime Task → %ProgramFiles%\QuickTime\qttask.exe → Apple Computer, Inc. [Ver = 6.5.1 | Size = 98304 bytes | Modified Date = 8/18/2004 9:34:48 AM | Attr = ]
SigmaTel StacMon → %ProgramFiles%\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe → SigmaTel Inc. [Ver = 1, 0, 0, 3 | Size = 86073 bytes | Modified Date = 8/3/2003 7:01:14 PM | Attr = ]
SpyBlocker → %ProgramFiles%\SpyBlocker Software\spyblocker.exe → File not found
SunJavaUpdateSched → %ProgramFiles%\Java\j2re1.4.2_03\bin\jusched.exe → [Ver = | Size = 32881 bytes | Modified Date = 2/6/2004 7:31:44 PM | Attr = ]

system · 2008-02-17T21:46:18.000Z

part four:

system · 2008-02-17T21:47:08.000Z

< All Users Startup Folder > → C:\Documents and Settings\All Users\Start Menu\Programs\Startup →
%AllUsersProfile%\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk → %CommonProgramFiles%\Adobe\Calibration\Adobe Gamma Loader.exe → Adobe Systems, Inc. [Ver = 1, 0, 0, 1 | Size = 98304 bytes | Modified Date = 5/19/2000 12:03:18 AM | Attr = ]
%AllUsersProfile%\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk → %ProgramFiles%\Adobe\Acrobat 7.0\Reader\reader_sl.exe → Adobe Systems Incorporated [Ver = 7.0.0.0 | Size = 29696 bytes | Modified Date = 12/14/2004 4:44:06 AM | Attr = ]
→ %AllUsersProfile%\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk → File not found
%AllUsersProfile%\Start Menu\Programs\Startup\j2 DllCmd 4.0.lnk → %ProgramFiles%\j2 Messenger 4.0\J2GDllCmd.exe → j2 Global Communications, Inc. [Ver = 4.0.134.0 | Size = 107008 bytes | Modified Date = 6/23/2005 5:51:58 PM | Attr = ]
%AllUsersProfile%\Start Menu\Programs\Startup\j2 Live Menu 3.2.lnk → %ProgramFiles%\j2 Messenger 3.2\J2GDllCmd.exe → j2 Global Communications, Inc. [Ver = 3.2.0.3 | Size = 17408 bytes | Modified Date = 6/10/2004 1:39:44 PM | Attr = ]
%AllUsersProfile%\Start Menu\Programs\Startup\j2 Tray Menu 3.2.lnk → %ProgramFiles%\j2 Messenger 3.2\J2GTray.exe → j2 Global Communications, Inc. [Ver = 3.2.0.3 | Size = 39936 bytes | Modified Date = 6/10/2004 1:38:26 PM | Attr = ]
%AllUsersProfile%\Start Menu\Programs\Startup\j2 Tray Menu 4.0.lnk → %ProgramFiles%\j2 Messenger 4.0\J2GTray.exe → j2 Global Communications, Inc. [Ver = 4.0.134.0 | Size = 500224 bytes | Modified Date = 6/23/2005 5:53:42 PM | Attr = ]
%AllUsersProfile%\Start Menu\Programs\Startup\RAMASST.lnk → %SystemRoot%\system32\RAMASST.exe → Matsushita Electric Industrial Co., Ltd. [Ver = 1, 0, 9, 0 | Size = 155648 bytes | Modified Date = 3/14/2003 2:38:12 PM | Attr = ]
< Carrie Startup Folder > → C:\Documents and Settings\Carrie\Start Menu\Programs\Startup →
%UserProfile%\Start Menu\Programs\Startup\RABCO - Auto Update.lnk → %ProgramFiles%\RABCO\RABCOse.exe → Rabio [Ver = 1, 0, 0, 26 | Size = 183216 bytes | Modified Date = 1/30/2008 4:19:42 PM | Attr = ]
< Default User Startup Folder > → C:\Documents and Settings\Default User\Start Menu\Programs\Startup →

system · 2008-02-17T21:47:52.000Z

< ICQ Agent [HKEY_CURRENT_USER] > → HKEY_CURRENT_USER\Software\Mirabilis\ICQ\Agent\Apps\ →
HKEY_CURRENT_USER\Software\Mirabilis\ICQ\Agent\Apps\ → ->
< ShellExecuteHooks [HKEY_LOCAL_MACHINE] > → HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks →
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} [HKEY_LOCAL_MACHINE] → %ProgramFiles%\SUPERAntiSpyware\SASSEH.DLL → SuperAdBlocker.com [Ver = 1, 0, 0, 1008 | Size = 77824 bytes | Modified Date = 12/20/2006 1:55:48 PM | Attr = ]
< SecurityProviders [HKEY_LOCAL_MACHINE] > → HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders →
< Winlogon settings [HKEY_LOCAL_MACHINE] > → HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon →
< Winlogon settings [HKEY_CURRENT_USER] > → HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon →
< Winlogon settings [HKEY_USERS.DEFAULT] > → HKEY_USERS.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon →
< Winlogon settings [HKEY_USERS\S-1-5-18] > → HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon →
< Winlogon settings [HKEY_USERS\S-1-5-19] > → HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon →
< Winlogon settings [HKEY_USERS\S-1-5-20] > → HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon →
< Winlogon settings [HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006] > → HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon →
< Winlogon\Notify settings [HKEY_LOCAL_MACHINE] > → HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ →
!SASWinLogon → %ProgramFiles%\SUPERAntiSpyware\SASWINLO.dll → SUPERAntiSpyware.com [Ver = 1, 0, 0, 1046 | Size = 294912 bytes | Modified Date = 4/19/2007 1:41:36 PM | Attr = ]
Sebring → %SystemRoot%\system32\LgNotify.dll → Intel Corporation [Ver = 8, 0, 0, 161 | Size = 110592 bytes | Modified Date = 12/16/2003 6:49:34 PM | Attr = ]
< CurrentVersion Policy Settings [HKEY_LOCAL_MACHINE] > → HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ →
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ → ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ → ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ → ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveAutoRun → 67108863 →
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutoRun → 255 →
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ → ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\ → ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\{BDEADF00-C265-11D0-BCED-00A0C90AB50F} → 1 →
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} → 1073741857 →
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\{0DF44EAA-FF21-4412-828E-260A8728E7F1} → 32 →
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ → ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\dontdisplaylastusername → 0 →
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\legalnoticecaption → →
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\legalnoticetext → →
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\shutdownwithoutlogon → 1 →
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\undockwithoutlogon → 1 →
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Uninstall\ → ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\WindowsUpdate\ → ->
< CurrentVersion Policy Settings [HKEY_CURRENT_USER] > → HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ →
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ → ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ → ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations\ → ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ → ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutoRun → 145 →
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ → ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ → ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Uninstall\ → ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\WindowsUpdate\ → ->
< CurrentVersion Policy Settings [HKEY_USERS.DEFAULT] > → HKEY_USERS.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ →
HKEY_USERS.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ → ->
HKEY_USERS.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ → ->
HKEY_USERS.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations\ → ->
HKEY_USERS.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ → ->
HKEY_USERS.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutoRun → 145 →
HKEY_USERS.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\ → ->
HKEY_USERS.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ → ->
HKEY_USERS.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Uninstall\ → ->
HKEY_USERS.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\WindowsUpdate\ → ->

system · 2008-02-17T21:48:28.000Z

< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-18] > → HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ →
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ → ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ → ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations\ → ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ → ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutoRun → 145 →
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run\ → ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ → ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Uninstall\ → ->
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\WindowsUpdate\ → ->
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-19] > →
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ →
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ → ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ → ->
HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutoRun → 145 →
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-20] > → HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ →
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ → ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ → ->
HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutoRun → 145 →
< CurrentVersion Policy Settings [HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006] > → HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ →
HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ → ->
HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ → ->
HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations\ → ->
HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ → ->
HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoDriveTypeAutoRun → 145 →
HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ → ->
HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\ → ->
HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Uninstall\ → ->
HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\WindowsUpdate\ → ->

system · 2008-02-17T21:53:34.000Z

< HOSTS File > (27 bytes) → C:\WINDOWS\System32\drivers\etc\Hosts →
< Internet Explorer Settings [HKEY_LOCAL_MACHINE] > → ->
HKEY_LOCAL_MACHINE: Main\Default_Page_URL → http://go.microsoft.com/fwlink/?LinkId=69157 →
HKEY_LOCAL_MACHINE: Main\Default_Search_URL → http://go.microsoft.com/fwlink/?LinkId=54896 →
HKEY_LOCAL_MACHINE: Main\Local Page → %SystemRoot%\system32\blank.htm →
HKEY_LOCAL_MACHINE: Main\Search Page → http://go.microsoft.com/fwlink/?LinkId=54896 →
HKEY_LOCAL_MACHINE: Main\Start Page → http://go.microsoft.com/fwlink/?LinkId=69157 →
HKEY_LOCAL_MACHINE: Search\CustomizeSearch → http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm →
HKEY_LOCAL_MACHINE: Search\Default_Search_URL → http://www.google.com/ie →
HKEY_LOCAL_MACHINE: Search\SearchAssistant → http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm →
< Internet Explorer Settings [HKEY_CURRENT_USER] > → ->
HKEY_CURRENT_USER: Main\Local Page → C:\WINDOWS\system32\blank.htm →
HKEY_CURRENT_USER: Main\Search Page → http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch →
HKEY_CURRENT_USER: Main\Start Page → http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome →
HKEY_CURRENT_USER: Search\SearchAssistant → http://www.google.com/ie →
HKEY_CURRENT_USER: SearchURL\ → http://www.google.com/search?q=%s[Reg Error: Value provider does not exist or could not be read.] →
HKEY_CURRENT_USER: URLSearchHooks\{37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} [HKEY_LOCAL_MACHINE] → %ProgramFiles%\JUSearch\SearchEnh1.dll [URLSearchHook Class] → United Online, Inc. [Ver = 2.1.03 | Size = 102472 bytes | Modified Date = 11/9/2004 3:36:29 AM | Attr = ]
HKEY_CURRENT_USER: ProxyEnable → 0 →
HKEY_CURRENT_USER: ProxyOverride → →
< Internet Explorer Settings [HKEY_USERS.DEFAULT] > → ->
HKEY_USERS.DEFAULT: Main\Search Page → http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch →
HKEY_USERS.DEFAULT: Main\Start Page → http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome →
HKEY_USERS.DEFAULT: ProxyEnable → 0 →
< Internet Explorer Settings [HKEY_USERS\S-1-5-18] > → ->
HKEY_USERS\S-1-5-18: Main\Search Page → http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch →
HKEY_USERS\S-1-5-18: Main\Start Page → http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome →
HKEY_USERS\S-1-5-18: ProxyEnable → 0 →
< Internet Explorer Settings [HKEY_USERS\S-1-5-19] > → ->
HKEY_USERS\S-1-5-19: Main\Search Bar → http://www.toshiba.com/search →
HKEY_USERS\S-1-5-19: Main\Start Page → http://www.toshiba.com →
HKEY_USERS\S-1-5-19: ProxyEnable → 0 →
< Internet Explorer Settings [HKEY_USERS\S-1-5-20] > → ->
HKEY_USERS\S-1-5-20: Main\Search Bar → http://www.toshiba.com/search →
HKEY_USERS\S-1-5-20: Main\Start Page → http://www.toshiba.com →
HKEY_USERS\S-1-5-20: ProxyEnable → 0 →
< Internet Explorer Settings [HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006] > → ->
HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006: Main\Local Page → C:\WINDOWS\system32\blank.htm →
HKEY_USERS\S-1-5-21-142928211-1550766908-524529910-1006: Main\Search Page → http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch →

system · 2008-02-17T21:54:25.000Z

system · 2008-02-17T21:55:48.000Z

system · 2008-02-17T21:56:44.000Z

< Default Protocols [HKEY_USERS\S-1-5-18] - Select to Repair > → HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults →
shell → shell protocol not assigned →
< Default Protocols [HKEY_USERS\S-1-5-19] - Select to Repair > → HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults →
shell → shell protocol not assigned →
< Default Protocols [HKEY_USERS\S-1-5-20] - Select to Repair > → HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults →
shell → shell protocol not assigned →
< Protocol Handlers [HKEY_LOCAL_MACHINE] > → HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ →
ipp: [HKEY_LOCAL_MACHINE] → Reg Error: Key does not exist or could not be opened.[Reg Error: Value does not exist or could not be read.] → File not found
msdaipp: [HKEY_LOCAL_MACHINE] → Reg Error: Key does not exist or could not be opened.[Reg Error: Value does not exist or could not be read.] → File not found

[Files/Folders - Created Within 90 days]
avenger → %SystemDrive%\avenger → [Folder | Created Date = 2/17/2008 3:45:33 PM | Attr = ]
1 C:*.tmp files → C:*.tmp →
Deckard → %SystemDrive%\Deckard → [Folder | Created Date = 2/10/2008 2:49:57 AM | Attr = ]
QooBox → %SystemDrive%\QooBox → [Folder | Created Date = 2/10/2008 5:27:42 PM | Attr = ]
aavmker4.sys → %SystemRoot%\System32\drivers\aavmker4.sys → ALWIL Software [Ver = 4.7.1098.0 | Size = 26624 bytes | Modified Date = 12/4/2007 9:49:02 AM | Attr = ]
aswmon.sys → %SystemRoot%\System32\drivers\aswmon.sys → ALWIL Software [Ver = 4.7.1098.0 | Size = 93264 bytes | Modified Date = 12/4/2007 9:56:02 AM | Attr = ]
aswmon2.sys → %SystemRoot%\System32\drivers\aswmon2.sys → ALWIL Software [Ver = 4.7.1098.0 | Size = 94544 bytes | Modified Date = 12/4/2007 9:55:46 AM | Attr = ]
aswRdr.sys → %SystemRoot%\System32\drivers\aswRdr.sys → ALWIL Software [Ver = 4.7.1098.0 | Size = 23152 bytes | Modified Date = 12/4/2007 9:53:39 AM | Attr = ]
aswTdi.sys → %SystemRoot%\System32\drivers\aswTdi.sys → ALWIL Software [Ver = 4.7.1098.0 | Size = 42912 bytes | Modified Date = 12/4/2007 9:51:52 AM | Attr = ]
cdr4_xp.sys → %SystemRoot%\System32\drivers\cdr4_xp.sys → Sonic Solutions [Ver = 8.0.0.212 | Size = 9336 bytes | Modified Date = 3/7/2007 6:51:00 PM | Attr = ]
cdralw2k.sys → %SystemRoot%\System32\drivers\cdralw2k.sys → Sonic Solutions [Ver = 8.0.0.212 | Size = 9464 bytes | Modified Date = 3/7/2007 6:51:00 PM | Attr = ]
actskin4.ocx → %SystemRoot%\System32\actskin4.ocx → [Ver = 4, 2, 7, 3 | Size = 380928 bytes | Modified Date = 1/9/2004 4:13:58 AM | Attr = ]
aswBoot.exe → %SystemRoot%\System32\aswBoot.exe → ALWIL Software [Ver = 4, 7, 1098, 0 | Size = 837496 bytes | Modified Date = 12/4/2007 8:04:28 AM | Attr = ]
AvastSS.scr → %SystemRoot%\System32\AvastSS.scr → ALWIL Software [Ver = 4, 7, 1098, 0 | Size = 95608 bytes | Modified Date = 12/4/2007 7:54:04 AM | Attr = ]
fdsv.exe → %SystemRoot%\System32\fdsv.exe → Smallfrogs Studio [Ver = 1.0.0.10 | Size = 73728 bytes | Modified Date = 8/31/2000 8:00:00 AM | Attr = ]
grep.exe → %SystemRoot%\System32\grep.exe → [Ver = | Size = 80412 bytes | Modified Date = 8/31/2000 8:00:00 AM | Attr = ]
pxafs.dll → %SystemRoot%\System32\pxafs.dll → Sonic Solutions [Ver = 3.6.36.500 | Size = 129784 bytes | Modified Date = 3/7/2007 6:51:00 PM | Attr = ]
pxcpya64.exe → %SystemRoot%\System32\pxcpya64.exe → Sonic Solutions [Ver = 1.00.40a | Size = 64760 bytes | Modified Date = 3/7/2007 6:51:00 PM | Attr = ]
pxinsa64.exe → %SystemRoot%\System32\pxinsa64.exe → Sonic Solutions [Ver = 3.00.56a | Size = 64760 bytes | Modified Date = 3/7/2007 6:51:00 PM | Attr = ]
pxsfs.dll → %SystemRoot%\System32\pxsfs.dll → Sonic Solutions [Ver = 3.6.36.500 | Size = 1628920 bytes | Modified Date = 3/7/2007 6:51:00 PM | Attr = ]
sed.exe → %SystemRoot%\System32\sed.exe → [Ver = | Size = 98816 bytes | Modified Date = 8/31/2000 8:00:00 AM | Attr = ]
swreg.exe → %SystemRoot%\System32\swreg.exe → SteelWerX [Ver = 3.0.0.0 | Size = 161792 bytes | Modified Date = 8/31/2000 8:00:00 AM | Attr = ]
swsc.exe → %SystemRoot%\System32\swsc.exe → SteelWerX [Ver = 2.0.0.5 | Size = 136704 bytes | Modified Date = 8/31/2000 8:00:00 AM | Attr = ]
swxcacls.exe → %SystemRoot%\System32\swxcacls.exe → SteelWerX [Ver = 1.0.1.1 | Size = 212480 bytes | Modified Date = 8/31/2000 8:00:00 AM | Attr = ]
VFind.exe → %SystemRoot%\System32\VFind.exe → [Ver = | Size = 49152 bytes | Modified Date = 8/31/2000 8:00:00 AM | Attr = ]
zip.exe → %SystemRoot%\System32\zip.exe → [Ver = | Size = 68096 bytes | Modified Date = 8/31/2000 8:00:00 AM | Attr = ]
ie7 → %SystemRoot%\ie7 → [Folder | Created Date = 1/30/2008 1:33:50 AM | Attr = H ]
46 C:\WINDOWS*.tmp files → C:\WINDOWS*.tmp →
Nircmd.exe → %SystemRoot%\Nircmd.exe → NirSoft [Ver = 2.00 | Size = 51200 bytes | Modified Date = 8/31/2000 8:00:00 AM | Attr = ]
QTFont.for → %SystemRoot%\QTFont.for → [Ver = | Size = 1409 bytes | Modified Date = 2/11/2008 12:42:43 PM | Attr = ]
QTFont.qfn → %SystemRoot%\QTFont.qfn → [Ver = | Size = 54156 bytes | Modified Date = 2/11/2008 12:42:29 PM | Attr = H ]

[Files/Folders - Modified Within 30 days]
avenger → %SystemDrive%\avenger → [Folder | Modified Date = 2/17/2008 3:45:33 PM | Attr = ]
1 C:*.tmp files → C:*.tmp →
Config.Msi → %SystemDrive%\Config.Msi → [Folder | Modified Date = 2/10/2008 2:40:05 PM | Attr = ]
Deckard → %SystemDrive%\Deckard → [Folder | Modified Date = 2/10/2008 2:49:57 AM | Attr = ]
Program Files → %ProgramFiles% → [Folder | Modified Date = 2/15/2008 10:31:25 PM | Attr = R ]
QooBox → %SystemDrive%\QooBox → [Folder | Modified Date = 2/17/2008 4:23:27 AM | Attr = ]
RECYCLER → %SystemDrive%\RECYCLER → [Folder | Modified Date = 2/10/2008 2:54:55 AM | Attr = HS]

system · 2008-02-17T21:57:06.000Z

System Volume Information -> %SystemDrive%\System Volume Information ->  [Folder | Modified Date = 2/10/2008 2:50:26 AM | Attr =  HS]
TEMP -> %SystemDrive%\TEMP ->  [Folder | Modified Date = 2/17/2008 4:17:54 AM | Attr =    ]
WINDOWS -> %SystemRoot% ->  [Folder | Modified Date = 2/17/2008 3:40:59 PM | Attr =    ]
etc -> %SystemRoot%\System32\drivers\etc ->  [Folder | Modified Date = 2/14/2008 3:58:30 PM | Attr =    ]
hosts -> %SystemRoot%\System32\drivers\etc\hosts ->  [Ver =  | Size = 27 bytes | Modified Date = 2/14/2008 3:58:30 PM | Attr =    ]
CatRoot -> %SystemRoot%\System32\CatRoot ->  [Folder | Modified Date = 2/9/2008 4:34:50 PM | Attr =    ]
3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> 
CatRoot2 -> %SystemRoot%\System32\CatRoot2 ->  [Folder | Modified Date = 2/14/2008 9:07:53 PM | Attr =    ]
dllcache -> %SystemRoot%\System32\dllcache ->  [Folder | Modified Date = 2/9/2008 4:33:25 PM | Attr = RHS]
drivers -> %SystemRoot%\System32\drivers ->  [Folder | Modified Date = 2/17/2008 3:45:34 PM | Attr =    ]
en-US -> %SystemRoot%\System32\en-US ->  [Folder | Modified Date = 1/30/2008 1:39:43 AM | Attr =    ]
Restore -> %SystemRoot%\System32\Restore ->  [Folder | Modified Date = 2/10/2008 2:50:26 AM | Attr =    ]
wpa.dbl -> %SystemRoot%\System32\wpa.dbl ->  [Ver =  | Size = 1158 bytes | Modified Date = 2/17/2008 3:45:39 PM | Attr =    ]
$hf_mig$ -> %SystemRoot%\$hf_mig$ ->  [Folder | Modified Date = 1/30/2008 1:40:33 AM | Attr =    ]
46 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> 
bootstat.dat -> %SystemRoot%\bootstat.dat ->  [Ver =  | Size = 2048 bytes | Modified Date = 2/17/2008 3:45:20 PM | Attr =   S]
Downloaded Program Files -> %SystemRoot%\Downloaded Program Files ->  [Folder | Modified Date = 2/10/2008 2:54:55 AM | Attr =   S]
erdnt -> %SystemRoot%\erdnt ->  [Folder | Modified Date = 2/10/2008 5:28:05 PM | Attr =    ]
Help -> %SystemRoot%\Help ->  [Folder | Modified Date = 1/30/2008 4:20:03 AM | Attr =    ]
ie7 -> %SystemRoot%\ie7 ->  [Folder | Modified Date = 1/30/2008 1:35:56 AM | Attr =  H ]
ie7updates -> %SystemRoot%\ie7updates ->  [Folder | Modified Date = 1/30/2008 1:39:19 AM | Attr =    ]
imsins.BAK -> %SystemRoot%\imsins.BAK ->  [Ver =  | Size = 1374 bytes | Modified Date = 1/30/2008 1:40:43 AM | Attr =    ]
inf -> %SystemRoot%\inf ->  [Folder | Modified Date = 2/9/2008 4:33:25 PM | Attr =  H ]
Installer -> %SystemRoot%\Installer ->  [Folder | Modified Date = 2/10/2008 2:40:05 PM | Attr =  HS]
machine.ver -> %SystemRoot%\machine.ver ->  [Ver =  | Size = 2838 bytes | Modified Date = 2/7/2008 11:34:51 AM | Attr =    ]
Media -> %SystemRoot%\Media ->  [Folder | Modified Date = 1/30/2008 1:36:24 AM | Attr =    ]
Prefetch -> %SystemRoot%\Prefetch ->  [Folder | Modified Date = 2/17/2008 4:27:31 PM | Attr =    ]
QTFont.for -> %SystemRoot%\QTFont.for ->  [Ver =  | Size = 1409 bytes | Modified Date = 2/11/2008 12:42:43 PM | Attr =    ]
QTFont.qfn -> %SystemRoot%\QTFont.qfn ->  [Ver =  | Size = 54156 bytes | Modified Date = 2/11/2008 12:42:29 PM | Attr =  H ]
RegisteredPackages -> %SystemRoot%\RegisteredPackages ->  [Folder | Modified Date = 1/20/2008 1:33:07 AM | Attr =    ]
security -> %SystemRoot%\security ->  [Folder | Modified Date = 2/8/2008 3:55:15 PM | Attr =    ]
swupdate.INI -> %SystemRoot%\swupdate.INI ->  [Ver =  | Size = 67 bytes | Modified Date = 2/7/2008 11:34:20 AM | Attr =    ]
system -> %SystemRoot%\system ->  [Folder | Modified Date = 2/5/2008 1:56:44 PM | Attr =    ]
system.ini -> %SystemRoot%\system.ini ->  [Ver =  | Size = 227 bytes | Modified Date = 2/17/2008 4:21:48 AM | Attr =    ]
system32 -> %SystemRoot%\system32 ->  [Folder | Modified Date = 2/17/2008 4:23:30 AM | Attr =    ]
Tasks -> %SystemRoot%\Tasks ->  [Folder | Modified Date = 2/14/2008 3:55:00 PM | Attr =   S]
Temp -> %SystemRoot%\Temp ->  [Folder | Modified Date = 2/17/2008 3:47:49 PM | Attr =    ]
WBEM -> %SystemRoot%\WBEM ->  [Folder | Modified Date = 1/30/2008 1:36:41 AM | Attr =    ]
winamp.ini -> %SystemRoot%\winamp.ini ->  [Ver =  | Size = 1125 bytes | Modified Date = 1/20/2008 1:29:19 AM | Attr =    ]
WMSysPr9.prx -> %SystemRoot%\WMSysPr9.prx ->  [Ver =  | Size = 316640 bytes | Modified Date = 1/20/2008 1:32:50 AM | Attr =    ]
SA.DAT -> %SystemRoot%\tasks\SA.DAT ->  [Ver =  | Size = 6 bytes | Modified Date = 2/17/2008 3:45:28 PM | Attr =  H ]
WebReg 20040630191426.job -> %SystemRoot%\tasks\WebReg 20040630191426.job ->  [Ver =  | Size = 434 bytes | Modified Date = 2/14/2008 7:14:00 PM | Attr =    ]
qmgr0.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat ->  [Ver =  | Size = 4617 bytes | Modified Date = 2/9/2008 4:31:05 PM | Attr =    ]
qmgr1.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat ->  [Ver =  | Size = 4232 bytes | Modified Date = 2/9/2008 4:31:05 PM | Attr =    ]
data.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\data.dat ->  [Ver =  | Size = 1538 bytes | Modified Date = 11/5/2004 12:27:56 PM | Attr =    ]
opa11.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\OFFICE\DATA\opa11.dat ->  [Ver =  | Size = 8658 bytes | Modified Date = 6/14/2004 9:02:59 PM | Attr =    ]
wkcalcat.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Works\wkcalcat.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 5/31/2005 10:25:17 AM | Attr =    ]
wklntnts.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Works\wklntnts.dat ->  [Ver =  | Size = 526924 bytes | Modified Date = 3/26/2006 12:37:04 PM | Attr =    ]
wklntsk.dat -> C:\Documents and Settings\All Users\Application Data\Microsoft\Works\wklntsk.dat ->  [Ver =  | Size = 526924 bytes | Modified Date = 3/26/2006 12:37:04 PM | Attr =    ]
SSUPDATE.EXE -> C:\Documents and Settings\Carrie\Local Settings\Temp\SSUPDATE.EXE -> SUPERAntiSpyware.com [Ver = 1, 0, 0, 1030 | Size = 146672 bytes | Modified Date = 6/21/2007 2:07:10 PM | Attr =    ]
4 C:\Documents and Settings\Carrie\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Carrie\Local Settings\Temp\*.tmp -> 
Perflib_Perfdata_4fc.dat -> C:\Documents and Settings\Carrie\Local Settings\Temp\Perflib_Perfdata_4fc.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 2/17/2008 3:45:34 PM | Attr =    ]
4 C:\Documents and Settings\Carrie\Local Settings\Temp\*.tmp files -> C:\Documents and Settings\Carrie\Local Settings\Temp\*.tmp -> 
Perflib_Perfdata_660.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_660.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 2/17/2008 3:43:20 PM | Attr =    ]
Perflib_Perfdata_8b8.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_8b8.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 2/15/2008 10:32:24 PM | Attr =    ]
Perflib_Perfdata_93c.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_93c.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 2/17/2008 3:45:38 PM | Attr =    ]
Perflib_Perfdata_a0.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_a0.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 2/15/2008 10:32:16 PM | Attr =    ]
Perflib_Perfdata_a8.dat -> C:\WINDOWS\Temp\Perflib_Perfdata_a8.dat ->  [Ver =  | Size = 16384 bytes | Modified Date = 2/17/2008 3:45:28 PM | Attr =    ]

< End of report >

oldman960 · 2008-02-17T22:00:03.000Z

Okay, I’ve got to go out for awhile and will go over thhe log then.

I found “Microsoft AntiSpyware” in the log. Is this what you saw? This one I believe is ok.

But we’ll get rid of Rabco.

Go to add/remove programs and uninstall these if present.

Rabio
Cool
RABCO

You may want to look for WinWINAntispyware

Open HJT, run a system scan only, check mark these lines if present

O2 - BHO: RabioBHO - {1C2E5D27-A17C-4D89-85DD-3553C189380D} - C:\Program Files\RABCO\RABCO.dll
O4 - Startup: RABCO - Auto Update.lnk = C:\Program Files\RABCO\RABCOse.exe

Close all other browsers/windows, click fix, close HJT.

Open a new Notepad session (Do not use a Word Processor or WordPad). Click “Format” and be certain that Word Wrap is not enabled.

Copy and paste all the text in the quote box below into Notepad.

Click File, Save as…, and set the location to your Desktop, and enter (including quotation marks) as the filename: “CFscript.txt” . Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown at the bottom of this post.

File:: C:\Program Files\RABCO\RABCO.dll C:\Program Files\RABCO\RABCOse.exe
Folder::
C:\Program Files\RABCO

This will start ComboFix again.Close all browser/windows first. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HJT log.

polonus · 2008-02-17T22:03:39.000Z

Hi oldman,

Consider the use of sdfix here as well, and what Ritchie performed here with a RABCO infestation:
http://www.bleepingcomputer.com/forums/index.php?s=1954ba93daa6a6d78b019da7ba89ac36&showuser=75975

polonus

Announcements