|
Answer» And here is my most recent hijackthis log and I ran it while the Roxio Media Manager was trying to install in hopes hijackthis would give you something to work with....
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 1:15:33 PM, on 11/23/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal
Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Maxtor\Sync\SyncServices.exe C:\Program Files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlservr.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\Support.com\bin\tgcmd.exe C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\DellSupport\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Picasa2\PicasaMediaDetector.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Yahoo!\Yahoo! Autosync\AutosyncForYahoo.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe C:\WINDOWS\system32\MsiExec.exe C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\RUN: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe /server /startmonitor /deaf O4 - HKLM\..\Run: [sunjavaupdatesched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe O4 - HKLM\..\Run: [realtray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [quicktime task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" O4 - HKLM\..\Run: [ituneshelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [isusscheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [isuspm startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [intelwireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [hotkeyscmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [dvdlauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [dell quickset] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [act! preloader] "C:\Program Files\ACT\ACT for Windows\Act8.exe" -stayrunning O4 - HKLM\..\Run: [pcmservice] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [isuspm] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O4 - HKCU\..\Run: [dellsupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [picasa media detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe O4 - HKCU\..\Run: [msmsgs] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O4 - Global Startup: Yahoo! Autosync.lnk = C:\Program Files\Yahoo!\Yahoo! Autosync\AutosyncForYahoo.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [searching] Search from the Address bar O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1227318588125 O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe O23 - Service: McAfee Services (mcmscsvc) - Unknown owner - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe (file missing) O23 - Service: McAfee Network Agent (McNASvc) - Unknown owner - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe (file missing) O23 - Service: McAfee Scanner (McODS) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe (file missing) O23 - Service: McAfee PROXY Service (McProxy) - Unknown owner - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe (file missing) O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing) O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing) O23 - Service: McAfee Personal Firewall Service (MpfService) - Unknown owner - C:\Program Files\McAfee\MPF\MPFSrv.exe (file missing) O23 - Service: McAfee Anti-Spam Service (MSK80Service) - Unknown owner - C:\Program Files\McAfee\MSK\MskSrver.exe (file missing) O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Roxio UPnP Renderer 9 - Unknown owner - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe (file missing) O23 - Service: Roxio Upnp Server 9 - Unknown owner - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe (file missing) O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing) O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (file missing) O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe (file missing) O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
-- End of file - 10333 bytes
Please let me know what you come up with.....And lastly here is the ComboFix.txt..........
ComboFix 08-11-22.02 - Kris Maurer 2008-11-23 10:44:00.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.73 [GMT -5:00] Running from: c:\documents and settings\Kris Maurer\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Kris Maurer\Desktop\CFScript.txt
FILE :: c:\windows\system32\bszip.dll c:\windows\system32\fnts~1\wucrtupd.exe .
((((((((((((((((((((((((( Files Created from 2008-10-23 to 2008-11-23 ))))))))))))))))))))))))))))))) .
2008-11-22 16:51 . c:\windows\LastGood.Tmp 2008-11-21 21:35 . 2008-11-21 21:35d--------c:\windows\system32\scripting 2008-11-21 21:35 . 2008-11-21 21:35d--------c:\windows\system32\en 2008-11-21 21:35 . 2008-11-21 21:35d--------c:\windows\system32\bits 2008-11-21 21:35 . 2008-11-21 21:35d--------c:\windows\l2schemas 2008-11-21 21:33 . 2008-11-21 21:36d--------c:\windows\ServicePackFiles 2008-11-21 21:25 . 2008-11-21 21:25d--------c:\windows\EHome 2008-11-21 21:22 . 2008-08-14 05:04138,496-----c---c:\windows\system32\dllcache\afd.sys 2008-11-21 21:20 . 2008-04-13 19:12712,704---------c:\windows\system32\windowscodecs.dll 2008-11-21 21:20 . 2008-04-13 19:12346,112---------c:\windows\system32\windowscodecsext.dll 2008-11-21 21:20 . 2008-04-13 19:12276,992---------c:\windows\system32\wmphoto.dll 2008-11-21 21:20 . 2008-04-13 19:1269,120---------c:\windows\system32\wlanapi.dll 2008-11-21 21:18 . 2008-04-13 19:111,888,992---------c:\windows\system32\ati3duag.dll 2008-11-21 21:17 . 2008-06-13 06:05272,128-----c---c:\windows\system32\dllcache\bthport.sys 2008-11-21 21:08 . 2008-09-15 07:121,846,400-----c---c:\windows\system32\dllcache\win32k.sys 2008-11-21 21:08 . 2008-09-08 05:41333,824-----c---c:\windows\system32\dllcache\srv.sys 2008-11-21 20:57 . 2008-08-14 05:112,189,184-----c---c:\windows\system32\dllcache\ntoskrnl.exe 2008-11-21 20:57 . 2008-08-14 05:092,145,280-----c---c:\windows\system32\dllcache\ntkrnlmp.exe 2008-11-21 20:57 . 2008-08-14 04:332,066,048-----c---c:\windows\system32\dllcache\ntkrnlpa.exe 2008-11-21 20:57 . 2008-08-14 04:332,023,936-----c---c:\windows\system32\dllcache\ntkrpamp.exe 2008-11-21 20:56 . 2008-10-24 06:21455,296-----c---c:\windows\system32\dllcache\mrxsmb.sys 2008-11-21 20:54 . 2008-09-04 12:151,106,944-----c---c:\windows\system32\dllcache\msxml3.dll 2008-11-21 20:54 . 2008-04-11 14:04691,712-----c---c:\windows\system32\dllcache\inetcomm.dll 2008-11-21 20:54 . 2008-10-15 11:34337,408-----c---c:\windows\system32\dllcache\netapi32.dll 2008-11-21 20:54 . 2008-05-01 09:33331,776-----c---c:\windows\system32\dllcache\msadce.dll 2008-11-21 18:32 . 2008-11-21 18:32d--------C:\VundoFix Backups 2008-11-20 22:36 . 2008-11-20 22:36d--------c:\program files\Malwarebytes' Anti-Malware 2008-11-20 22:36 . 2008-10-22 16:1038,496--a------c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-20 22:36 . 2008-10-22 16:1015,504--a------c:\windows\system32\drivers\mbam.sys 2008-11-20 22:31 . 2008-11-20 22:31d--------c:\program files\Trend Micro 2008-11-20 21:29 . 2008-11-20 21:29d--------c:\documents and settings\Kris Maurer\Application Data\Malwarebytes 2008-11-20 21:29 . 2008-11-20 21:29d--------c:\documents and settings\All Users\Application Data\Malwarebytes 2008-11-20 16:58 . 2008-11-20 16:58d--------c:\documents and settings\Kris Maurer\DoctorWeb 2008-11-20 16:51 . 2005-02-15 15:02163,840--a------c:\windows\system32\igfxres.dll 2008-11-20 16:43 . 2008-04-13 19:11156,672--a--c---c:\windows\system32\dllcache\winzm.ime 2008-11-20 16:43 . 2008-04-13 19:11156,672--a--c---c:\windows\system32\dllcache\winsp.ime 2008-11-20 16:43 . 2008-04-13 19:11156,672--a--c---c:\windows\system32\dllcache\winpy.ime 2008-11-20 16:43 . 2008-04-13 19:1165,536--a--c---c:\windows\system32\dllcache\winime.ime 2008-11-20 16:43 . 2004-08-12 09:1028,288--a--c---c:\windows\system32\dllcache\xjis.nls 2008-11-20 16:41 . 2004-08-12 08:581,875,968--a--c---c:\windows\system32\dllcache\msir3jp.lex 2008-11-20 16:40 . 2008-04-13 19:0913,463,552--a--c---c:\windows\system32\dllcache\hwxjpn.dll 2008-11-20 16:39 . 2004-08-12 08:56195,618--a--c---c:\windows\system32\dllcache\c_10002.nls 2008-11-20 16:36 . 2008-11-20 16:36749-rah-----c:\windows\WindowsShell.Manifest 2008-11-20 16:36 . 2008-11-20 16:36749-rah-----c:\windows\system32\wuaucpl.cpl.manifest 2008-11-20 16:36 . 2008-11-20 16:36749-rah-----c:\windows\system32\sapi.cpl.manifest 2008-11-20 16:36 . 2008-11-20 16:36749-rah-----c:\windows\system32\ncpa.cpl.manifest 2008-11-20 16:36 . 2008-11-20 16:36488-rah-----c:\windows\system32\logonui.exe.manifest 2008-11-20 16:35 . 2004-08-12 08:5816,384--a--c---c:\windows\system32\dllcache\isignup.exe 2008-11-20 16:22 . 2004-08-12 09:0624,661--a------c:\windows\system32\spxcoins.dll 2008-11-20 16:22 . 2004-08-12 09:0624,661--a--c---c:\windows\system32\dllcache\spxcoins.dll 2008-11-20 16:22 . 2004-08-12 08:5813,312--a------c:\windows\system32\irclass.dll 2008-11-20 16:22 . 2004-08-12 08:5813,312--a--c---c:\windows\system32\dllcache\irclass.dll 2008-11-20 16:21 . 2004-08-12 09:061,042,903--a--c---c:\windows\system32\dllcache\SP2.CAT 2008-11-20 16:21 . 2004-08-12 09:02797,189--a--c---c:\windows\system32\dllcache\NT5IIS.CAT 2008-11-20 16:21 . 2004-08-12 08:59399,645--a--c---c:\windows\system32\dllcache\MAPIMIG.CAT 2008-11-20 16:21 . 2004-08-12 09:0137,484--a--c---c:\windows\system32\dllcache\MW770.CAT 2008-11-20 16:21 . 2004-08-12 08:5713,472--a--c---c:\windows\system32\dllcache\HPCRDP.CAT 2008-11-20 16:21 . 2004-08-12 08:578,574--a--c---c:\windows\system32\dllcache\IASNT4.CAT 2008-11-20 16:21 . 2004-08-12 09:117,710--a--c---c:\windows\system32\dllcache\OEMBIOS.CAT 2008-11-20 16:21 . 2004-08-12 09:097,334--a--c---c:\windows\system32\dllcache\wmerrenu.cat 2008-11-20 11:08 . 2008-11-20 11:08d--------c:\windows\dell 2008-11-20 11:08 . 2008-11-20 21:18527,921,152--a------c:\windows\MEMORY.DMP 2008-11-20 10:15 . 2008-11-20 12:15d--------c:\program files\CleanUp! 2008-11-19 15:53 . 2008-11-19 15:53d--------c:\documents and settings\Administrator\Application Data\InstallShield 2008-11-14 16:56 . 2008-11-20 22:49d--------c:\program files\Common Files\Wise Installation Wizard 2008-11-14 16:53 . 2008-11-20 16:254,128--a------C:\INFCACHE.1
. (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-21 23:28---------d-----wc:\documents and settings\All Users\Application Data\Google Updater 2008-11-15 03:55---------d-----wc:\program files\Common Files\Scanner 2008-11-15 02:38---------d-----wc:\program files\Windows Media Connect 2 2008-10-24 11:21455,296----a-wc:\windows\system32\drivers\mrxsmb.sys 2008-05-04 00:0456--sh--rc:\windows\system32\42F52BF3EA.sys .
((((((((((((((((((((((((((((( [emailprotected]_11.09.34.87 ))))))))))))))))))))))))))))))))))))))))) . + 2008-11-22 16:21:4932,768----a-rc:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe - 2007-07-31 00:19:46203,096-c--a-wc:\windows\system32\dllcache\wuweb.dll + 2008-07-19 03:09:44205,000-c--a-wc:\windows\system32\dllcache\wuweb.dll - 2008-11-22 15:50:441,786--sha-wc:\windows\system32\KGyGaAvL.sys + 2008-11-23 15:49:331,786--sha-wc:\windows\system32\KGyGaAvL.sys - 2007-05-08 19:03:041,275,392----a-wc:\windows\system32\msxml4.dll + 2008-09-30 21:43:341,286,152----a-wc:\windows\system32\msxml4.dll - 2007-07-31 00:19:46203,096----a-wc:\windows\system32\wuweb.dll + 2008-07-19 03:09:44205,000----a-wc:\windows\system32\wuweb.dll + 2008-11-23 15:48:3516,384----atwc:\windows\temp\Perflib_Perfdata_584.dat + 2008-09-30 21:42:081,286,152----a-wc:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll + 2008-09-30 21:45:1291,656----a-wc:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-31 68856] "isuspm"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032] "dellsupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "tgcmd"="c:\program files\Support.com\bin\tgcmd.exe" [2007-03-07 1773568] "sunjavaupdatesched"="c:\program files\Java\jre1.5.0_02\bin\jusched.exe" [2005-03-04 36975] "realtray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2005-10-07 26112] "quicktime task"="c:\program files\QuickTime\qttask.exe" [2007-10-19 286720] "mxomssmenu"="c:\program files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-07-13 169264] "ituneshelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-09-25 229952] "isusscheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 86960] "isuspm startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-09-11 218032] "intelwireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-02-15 155648] "hotkeyscmds"="c:\windows\system32\hkcmd.exe" [2005-02-15 126976] "dvdlauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248] "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035] "dell quickset"="c:\program files\Dell\QuickSet\quickset.exe" [2005-03-04 606208] "apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648] "act! preloader"="c:\program files\ACT\ACT for Windows\Act8.exe" [2006-04-05 1015808]
c:\documents and settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-10-07 24576] QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 806912]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] 2004-09-07 16:08 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Desktop Manager.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Desktop Manager.lnk backup=c:\windows\pss\Desktop Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Yahoo! Autosync.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Yahoo! Autosync.lnk backup=c:\windows\pss\Yahoo! Autosync.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msmsgs] --------- 2008-04-13 19:12 1695232 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pcmservice] --a------ 2004-04-11 20:15 290816 c:\program files\Dell\Media Experience\PCMService.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\picasa media detector] --a------ 2008-02-25 20:23 443968 c:\program files\Picasa2\PicasaMediaDetector.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "RoxWatch9"=2 (0x2) "RoxLiveShare9"=2 (0x2) "Roxio Upnp Server 9"=2 (0x2) "Roxio UPnP Renderer 9"=3 (0x3) "MSK80Service"=2 (0x2) "MpfService"=2 (0x2) "McSysmon"=3 (0x3) "McShield"=2 (0x2) "McProxy"=2 (0x2) "McODS"=3 (0x3) "McNASvc"=2 (0x2) "mcmscsvc"=2 (0x2)
[HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\WINDOWS\\system32\\sessmgr.exe"= "c:\\Program Files\\ACT\\ACT for Windows\\Act8.exe"= "%windir%\\system32\\sessmgr.exe"=
R2 Maxtor Sync Service;Maxtor Service;"c:\program files\Maxtor\Sync\SyncServices.exe" [2007-07-13 156976] R2 MSSQL$ACT7;MSSQL$ACT7;c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlservr.exe -sACT7 [] R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" [2007-11-02 24652] S1 8a0dfb28;8a0dfb28;c:\windows\system32\drivers\8a0dfb28.sys [] S3 SQLAgent$ACT7;SQLAgent$ACT7;c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlagent.EXE -i ACT7 [] . Contents of the 'Scheduled Tasks' folder
2008-08-01 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
2008-07-15 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe []
2007-10-18 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [] .
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-23 10:48:26 Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully hidden files: 0
************************************************************************** . --------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(980) c:\program files\Intel\Wireless\Bin\LgNotify.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe c:\program files\Intel\Wireless\Bin\WLKEEPER.exe c:\progra~1\Intel\Wireless\Bin\1XConfig.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe c:\program files\Microsoft SQL Server\MSSQL$ACT7\Binn\sqlservr.exe c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\windows\system32\rundll32.exe c:\program files\iPod\bin\iPodService.exe c:\windows\system32\msiexec.exe c:\program files\Apoint\ApntEx.exe c:\windows\system32\msiexec.exe c:\program files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe c:\progra~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe . ************************************************************************** . Completion time: 2008-11-23 10:57:36 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-23 15:57:05 ComboFix2.txt 2008-11-22 16:10:45
Pre-Run: 17,798,598,656 bytes free Post-Run: 17,781,473,280 bytes free
226--- E O F ---2008-11-22 16:21:50 Well, everything appears to check out. You will, of course, want to run regular virus scans, but there are no longer any obvious signs of infection. As for this Roxio installer...it's a bit hard to say exactly what is going on. Your logs show traces of Roxio existing in some form and it looks like you either had Roxio installed at one point or you stopped it in the middle of installation (probably the latter). I could be wrong, but it's possible that your registry is confusing the computer and making it want to install Roxio. For starters, let's try disabling the InstallShield updater from running at startup, as well as the Roxio entries in your log. Scan with HijackThis (without a log) and place checkmarks next to these entries:
O4 - HKLM\..\Run: [isusscheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [isuspm startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKCU\..\Run: [isuspm] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O23 - Service: Roxio UPnP Renderer 9 - Unknown owner - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe (file missing) O23 - Service: Roxio Upnp Server 9 - Unknown owner - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe (file missing) O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing) O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (file missing)
Close all other windows and click Fix Checked. While you're at it, check C:\Program Files and C:\Program Files\Common Files for any Roxio folders. If you find them, delete them. You should then download CCleaner (without the Yahoo! toolbar) and use it to clean out files and broken registry entries.
You may even want to open up the Windows search function and perform a search (you may need to view hidden files and folders) for "roxio" and delete everything related to the program. If you're uncertain, leave it alone. Keep in mind that I'm assuming you are not using any Roxio products, which is why I'm having you delete everything related.
Once you've done everything, restart and cross your fingers. If the problem persists, you may want to CONTACT Roxio. There are viruses that will try to run the installer, but I've never seen one that acts quite like this, so I suspect that it isn't malicious.CBMatt,
All looks good and computer is back to normal operation. Your help has been AWSOME and I will be in touch soon, I have a friends computer to work on around Christmas and I sounds like it is in similar shape
Thanks again,
C-TrainGreat, I'm glad to hear that things are running SMOOTHLY again. And I'll be happy to help you out with the other computer if you need me. Take care.
|