Solved I have a user with the sirefef virus

Mike in IT · Aug 30, 2012

I have a user who has the sirefef virus. I have Forefront installed, it will catch it and remove it. But it comes back in a matter of minutes. I am running the scans you ask for in the preliminary removal steps and will post the logs as soon as I get them. This is on an XP laptop that I am remoted into using GoToAssist so I can't shut down the internet connections when running the scans, I hope this won't affect the scans too much. If it will I can get the user a temp and have this one sent back to me for cleaning. Just let me know.

Jay Pfoutz · Aug 30, 2012

Hello, and welcome to TechSpot.

Please see here for the board rules and other FAQ.

Please feel free to introduce yourself, after you follow the steps below to get started.

Information

From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by a malware removal helper.
Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
If you have already asked for help somewhere, please post the link to the topic you were helped.
We try our best to reply quickly, but for any reason we do not reply in two days, please reply to this topic with the word BUMP!
Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.

Please review the 5-Step removal instructions and post the logs back here for my review.

Also, include this scan:

Download AdwCleaner by Xplode onto your Desktop.

Double click on AdwCleaner.exe to run the tool.
Click on Search.
A logfile will automatically open after the scan has finished.
Please post the content of that logfile in your reply.
You can find the logfile at C:\AdwCleaner[Rn].txt as well - n is the order number.

Jay Pfoutz · Sep 4, 2012

Hello. Are you still with us?

Your thread has been marked as "Inactive" because of your lack of reply. Please let us know how your computer is running, or if you want to continue in this topic.

Thanks.

Mike in IT · Sep 4, 2012

Sorry it took so long to get back to this thread. I've had some computer problems (other than the one mentioned here). I'm still working on getting the computer with the virus, it's in a different state. I'll post here again when I get it and have run all the tests.

Jay Pfoutz · Sep 5, 2012

Okie dokie.

Mike in IT · Sep 7, 2012

Sorry it took so long:

Malwarebytes Anti-Malware 1.62.0.1300
www.malwarebytes.org

Database version: v2012.09.07.09

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 7.0.5730.13
mmcnair :: DMA-3161 [administrator]

9/7/2012 11:21:36 AM
mbam-log-2012-09-07 (11-21-36).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 371160
Time elapsed: 7 minute(s), 36 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-09-07 13:12:07
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD1600AAJS-60WAA0 rev.58.01D58
Running: n1yk8sxh.exe; Driver: c:\windows\temp\uwlyapog.sys
---- System - GMER 1.0.15 ----
SSDT \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys ZwCreateSection [0xBA60C700]
---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB95D6380, 0x346307, 0xE8000020]
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Cdfs \Cdfs DLAIFS_M.SYS (Drive Letter Access Component/Roxio)
---- EOF - GMER 1.0.15 ----
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 10.5.1
Run by mmcnair at 13:42:15 on 2012-09-07
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2031.1124 [GMT -4:00]
.
AV: Microsoft Forefront Endpoint Protection *Enabled/Updated* {1F383481-F70E-4E7A-8B69-C4B4A23928E4}
.
============== Running Processes ===============
.
C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe
C:\Program Files\Citrix\GoToAssist Remote Support Customer\430\g2ax_service.exe
C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\ProPatches\Scheduler\stSchedEx.exe
C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSvcm.exe
C:\WINDOWS\system32\CCM\CcmExec.exe
C:\Program Files\Citrix\GoToAssist Remote Support Customer\430\g2ax_comm_customer.exe
C:\Program Files\Citrix\GoToAssist Remote Support Customer\430\g2ax_system_customer.exe
C:\Program Files\Citrix\GoToAssist Remote Support Customer\430\g2ax_user_customer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Shoreline Communications\ShoreWare Client\STCLogin.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = https://www.dmacafe.com/
uInternet Settings,ProxyOverride = <local>
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\pc tools\pc tools security\bdt\PCTBrowserDefender.dll
BHO: Lync Browser Helper: {31d09ba0-12f5-4cce-be8a-2923e76605da} - c:\program files\microsoft lync\OCHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office14\GROOVEEX.DLL
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\oracle\javafx 2.1 runtime\bin\ssv.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~2\office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\oracle\javafx 2.1 runtime\bin\jp2ssv.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\pc tools\pc tools security\bdt\PCTBrowserDefender.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [SoundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray
mRun: [SetRefresh] c:\program files\compaq\setrefresh\SetRefresh.exe
mRun: [AAWTray] c:\program files\lavasoft\ad-aware 2007\AAWTray.exe
mRun: [RoxioDragToDisc] "c:\program files\roxio\drag-to-disc\DrgToDsc.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [<NO NAME>]
mRun: [Adobe Acrobat Speed Launcher] "c:\program files\adobe\acrobat 10.0\acrobat\Acrobat_sl.exe"
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 10.0\acrobat\Acrotray.exe"
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Communicator] "c:\program files\microsoft lync\communicator.exe" /fromrunkey
mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
mRun: [SpyHunter Security Suite] c:\program files\enigma software group\spyhunter\SpyHunter4.exe
dRunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs"
dRunOnce: [TSClientAXDisabler] cmd.exe /C "%systemroot%\Installer\TSClientMsiTrans\tscdsbl.bat"
mPolicies-explorer: NoAutorun = 1 (0x1)
mPolicies-system: disablecad = 1 (0x1)
mPolicies-system: consentpromptbehavioradmin = 0 (0x0)
mPolicies-system: consentpromptbehavioruser = 3 (0x3)
mPolicies-system: enableuiadesktoptoggle = 0 (0x0)
mPolicies-system: promptonsecuredesktop = 0 (0x0)
mPolicies-system: MaxGPOScriptWait = 60 (0x3c)
IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_02\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - c:\program files\microsoft lync\OCHelper.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
DPF: {00134F72-5284-44F7-95A8-52A619F70751} - hxxp://dmatrend:8080/officescan/console/html/ClientInstall/WinNTChk.cab
DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} - hxxp://dmatrend:8080/officescan/console/html/ClientInstall/setup.cab
DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} - hxxp://dmatrend:8080/officescan/console/html/root/AtxEnc.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1207759085531
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1207759154421
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
TCP: DhcpNameServer = 10.1.2.217 10.1.2.215
TCP: Interfaces\{EC87D345-94E4-401B-A58E-6EF0A80FAECF} : DhcpNameServer = 10.1.2.217 10.1.2.215
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Notify: GoToAssist Express Customer - c:\program files\citrix\gotoassist remote support customer\430\g2ax_winlogon.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office14\GROOVEEX.DLL
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
.
============= SERVICES / DRIVERS ===============
.
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648]
R1 MpKslcd8f9a51;MpKslcd8f9a51;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e02ffa68-ca1e-46a9-9c38-548ced214e7f}\MpKslcd8f9a51.sys [2012-9-7 29904]
R2 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2007-8-27 566616]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\pc tools\pc tools security\bdt\BDTUpdateService.exe [2012-8-30 575448]
R2 GoToAssist Remote Support Customer;GoToAssist Remote Support Customer;c:\program files\citrix\gotoassist remote support customer\430\g2ax_service.exe [2012-8-22 610960]
R2 msoidsvc;Microsoft Online Services Sign-in Assistant;c:\program files\common files\microsoft shared\microsoft online services\MSOIDSVC.EXE [2011-4-28 1577376]
R2 Security Scheduler;ScriptLogic Remote Scheduler Service;c:\windows\propatches\scheduler\stSchedEx.exe [2008-12-4 980312]
R2 SpyHunter 4 Service;SpyHunter 4 Service;c:\progra~1\enigma~1\spyhun~1\SH4SER~1.EXE [2012-8-21 763840]
R3 esgiguard;esgiguard;c:\program files\enigma software group\spyhunter\esgiguard.sys [2011-5-6 13904]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2008-4-9 36608]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-7-2 250056]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2010-12-27 31124344]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
S3 PCTBD;PC Tools Browser Defender Driver;c:\windows\system32\drivers\PCTBD.sys [2012-8-30 70768]
S3 SBRE;SBRE;\??\c:\windows\system32\drivers\sbredrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2012-09-07 15:20:37--------d-----w-c:\documents and settings\mmcnair\application data\Malwarebytes
2012-09-07 13:46:53--------d-----w-c:\documents and settings\mmcnair\local settings\application data\Sun
2012-09-07 13:44:2529904----a-w-c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e02ffa68-ca1e-46a9-9c38-548ced214e7f}\MpKslcd8f9a51.sys
2012-09-07 13:42:26--------d-----w-c:\documents and settings\mmcnair\Tracing
2012-09-07 13:41:34--------d-----w-c:\documents and settings\mmcnair\application data\ShoreWare Client
2012-09-07 13:41:0756200----a-w-c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e02ffa68-ca1e-46a9-9c38-548ced214e7f}\offreg.dll
2012-09-07 12:57:487022536----a-w-c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e02ffa68-ca1e-46a9-9c38-548ced214e7f}\mpengine.dll
2012-08-30 13:27:17--------d-----w-c:\documents and settings\all users\application data\XoftSpySE
2012-08-30 13:06:4670768----a-w-c:\windows\system32\drivers\PCTBD.sys
2012-08-30 13:06:44767960----a-w-c:\windows\BDTSupport.dll
2012-08-30 13:06:42149464----a-w-c:\windows\SGDetectionTool.dll
2012-08-30 13:06:402267096----a-w-c:\windows\PCTBDCore.dll
2012-08-30 13:06:401689560----a-w-c:\windows\PCTBDRes.dll
2012-08-30 13:01:06203120----a-w-c:\windows\system32\drivers\PCTSD.sys
2012-08-30 13:01:03--------d-----w-c:\program files\common files\PC Tools
2012-08-30 13:01:01--------d-----w-c:\program files\PC Tools
2012-08-30 13:00:32--------d-----w-c:\documents and settings\all users\application data\PC Tools
2012-08-30 12:23:43--------d-----w-C:\sh4ldr
2012-08-30 12:23:43--------d-----w-c:\program files\Enigma Software Group
2012-08-30 12:23:03--------d-----w-c:\windows\ADAFC0B4FC1545D9BAB3BC7A8829D0C4.TMP
2012-08-29 14:00:17--------d-----w-c:\program files\stinger
2012-08-29 13:30:45--------d-----w-c:\documents and settings\all users\application data\Malwarebytes
2012-08-29 13:30:4322344----a-w-c:\windows\system32\drivers\mbam.sys
2012-08-29 13:30:43--------d-----w-c:\program files\Malwarebytes' Anti-Malware
2012-08-27 13:24:19--------d-----w-c:\program files\Microsoft Synchronization Services
2012-08-27 13:23:26--------d-----w-c:\program files\Microsoft SQL Server Compact Edition
2012-08-27 13:23:26--------d-----w-c:\documents and settings\all users\Microsoft
2012-08-27 13:13:56--------d-----w-c:\program files\Microsoft Visual Studio 8
2012-08-27 13:11:56--------d-----w-c:\program files\Microsoft Analysis Services
2012-08-15 16:25:43--------d-----w-c:\program files\Microsoft Lync
2012-08-15 16:24:54--------d-----w-c:\program files\OCSetup
2012-08-15 13:57:1978336------w-c:\windows\system32\dllcache\browser.dll
.
==================== Find3M ====================
.
2012-08-09 13:39:47426184----a-w-c:\windows\system32\FlashPlayerApp.exe
2012-08-09 13:39:4670344----a-w-c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-06 13:58:5178336----a-w-c:\windows\system32\browser.dll
2012-07-06 02:07:08143872----a-w-c:\windows\system32\javacpl.cpl
2012-07-06 02:06:30772544----a-w-c:\windows\system32\npDeployJava1.dll
2012-07-06 02:06:20687544----a-w-c:\windows\system32\deployJava1.dll
2012-07-04 14:05:18139784----a-w-c:\windows\system32\drivers\rdpwd.sys
2012-07-03 15:07:44832512----a-w-c:\windows\system32\wininet.dll
2012-07-03 15:07:431830912------w-c:\windows\system32\inetcpl.cpl
2012-07-03 15:07:4278336----a-w-c:\windows\system32\ieencode.dll
2012-07-03 15:07:4217408------w-c:\windows\system32\corpol.dll
2012-07-03 13:40:151866112----a-w-c:\windows\system32\win32k.sys
.
============= FINISH: 13:42:38.40 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 5/19/2008 9:58:34 AM
System Uptime: 9/7/2012 8:05:56 AM (5 hours ago)
.
Motherboard: Hewlett-Packard | | 2820h
Processor: Intel(R) Core(TM)2 Duo CPU E6550 @ 2.33GHz | XU1 PROCESSOR | 2327/1333mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 149 GiB total, 118.925 GiB free.
D: is CDROM ()
H: is NetworkDisk (NTFS) - 7060 GiB total, 3351.007 GiB free.
N: is NetworkDisk (NTFS) - 7060 GiB total, 3351.007 GiB free.
S: is NetworkDisk (NTFS) - 7060 GiB total, 3351.007 GiB free.
Y: is NetworkDisk (NTFS) - 7060 GiB total, 3351.007 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
Description: PS/2 Compatible Mouse
Device ID: ACPI\PNP0F13\4&1E368A7A&0
Manufacturer: Microsoft
Name: PS/2 Compatible Mouse
PNP Device ID: ACPI\PNP0F13\4&1E368A7A&0
Service: i8042prt
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
.
32 Bit HP CIO Components Installer
Ad-Aware 2007
Adobe Acrobat X Standard - English, Français, Deutsch
Adobe Flash Player 11 ActiveX
Adobe Reader X (10.1.3)
AutoSplit Pro Plug-In, v. 2.3
Browser Guard 4.0
Compatibility Pack for the 2007 Office system
Configuration Manager Client
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
FileZilla Client 3.4.0
GoToAssist Customer 1.6.0.430
High Definition Audio Driver Package - KB888111
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Intel(R) Graphics Media Accelerator Driver
Intel(R) PRO Network Connections 12.1.14.1
Intel® Management Engine Interface
Java Auto Updater
Java(TM) 6 Update 2
Java(TM) 7 Update 5
JavaFX 2.1.1
LightScribe System Software 1.10.23.1
Malwarebytes Anti-Malware version 1.62.0.1300
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2656353)
Microsoft .NET Framework 1.1 Security Update (KB2656370)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Forefront Endpoint Protection
Microsoft Forefront Endpoint Protection 2010 Server Management
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Lync 2010
Microsoft National Language Support Downlevel APIs
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Groove MUI (English) 2010
Microsoft Office InfoPath MUI (English) 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Word MUI (English) 2010
Microsoft Online Services Sign-in Assistant
Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
Microsoft Security Client
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 14
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft WSE 2.0 SP3 Runtime
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB933579)
NVIDIA Drivers
PDF-XChange 3.5
PDF reDirect (remove only)
perform plus III
PowerQuest DeployCenter 5.0
RDC
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator Tools
Roxio Drag-to-Disc
Roxio Express Labeler 3
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft InfoPath 2010 (KB2553322) 32-Bit Edition
Security Update for Microsoft InfoPath 2010 (KB2553431) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553260) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553447) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589322) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2597986) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition
Security Update for Microsoft Visio Viewer 2010 (KB2598287) 32-Bit Edition
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 7 (KB2183461)
Security Update for Windows Internet Explorer 7 (KB2360131)
Security Update for Windows Internet Explorer 7 (KB2416400)
Security Update for Windows Internet Explorer 7 (KB2482017)
Security Update for Windows Internet Explorer 7 (KB2497640)
Security Update for Windows Internet Explorer 7 (KB2530548)
Security Update for Windows Internet Explorer 7 (KB2544521)
Security Update for Windows Internet Explorer 7 (KB2559049)
Security Update for Windows Internet Explorer 7 (KB2586448)
Security Update for Windows Internet Explorer 7 (KB2618444)
Security Update for Windows Internet Explorer 7 (KB2647516)
Security Update for Windows Internet Explorer 7 (KB2675157)
Security Update for Windows Internet Explorer 7 (KB2699988)
Security Update for Windows Internet Explorer 7 (KB2722913)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2510581)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2621440)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2641653)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2660465)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2685939)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219)
Security Update for Windows XP (KB2707511)
Security Update for Windows XP (KB2709162)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2718523)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135)
Security Update for Windows XP (KB2731847)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
ShoreTel Call Manager
Sonic Activation Module
SoundMAX
Spelling Dictionaries Support For Adobe Reader 8
SpyHunter
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2010 (KB2598289) 32-Bit Edition
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB2641690)
Update for Windows XP (KB2718704)
Update for Windows XP (KB943729)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VNC Free Edition 4.1.2
WebFldrs XP
WIMGAPI
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Presentation Foundation
Windows XP Service Pack 3
XML Paper Specification Shared Components Pack 1.0
ZipGenius 6 (6.0.3.1140)
.
==== Event Viewer Messages From Past Week ========
.
9/7/2012 9:05:26 AM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures.New Signature Version: Previous Signature Version: 1.135.639.0Update Source: Microsoft Update ServerUpdate Stage: InstallSource Path: http://www.microsoft.comSignature Type: AntiVirusUpdate Type: FullUser: NT AUTHORITY\SYSTEMCurrent Engine Version: Previous Engine Version: 1.1.8704.0Error code: 0x80240017Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
9/7/2012 8:06:13 AM, error: Dhcp [1002] - The IP address lease 10.1.27.17 for the Network Card with network address 001E0BB89247 has been denied by the DHCP server 10.1.2.215 (The DHCP Server sent a DHCPNACK message).
9/4/2012 8:35:42 AM, error: Microsoft Antimalware [2001] - Microsoft Antimalware has encountered an error trying to update signatures.New Signature Version: Previous Signature Version: 1.135.390.0Update Source: Microsoft Update ServerUpdate Stage: InstallSource Path: http://www.microsoft.comSignature Type: AntiVirusUpdate Type: FullUser: NT AUTHORITY\SYSTEMCurrent Engine Version: Previous Engine Version: 1.1.8704.0Error code: 0x80240017Error description: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support.
8/31/2012 8:41:54 AM, error: Service Control Manager [7003] - The PC Tools Browser Defender Driver service depends on the following nonexistent service: PCTCore
8/31/2012 8:18:18 AM, error: DCOM [10016] - The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID {24FF4FDC-1D9F-4195-8C79-0DA39248FF48} to the user NT AUTHORITY\SYSTEM SID (S-1-5-18). This security permission can be modified using the Component Services administrative tool.
8/31/2012 8:17:33 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: i8042prt
8/31/2012 10:16:28 AM, error: DCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {0C0A3666-30C9-11D0-8F20-00805F2CD064} to the user DMAINC\lmatthews SID (S-1-5-21-1644491937-1343024091-839522115-34300). This security permission can be modified using the Component Services administrative tool.
.
==== End Of File ===========================
# AdwCleaner v2.000 - Logfile created 09/07/2012 at 13:45:06
# Updated 30/08/2012 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : mmcnair - DMA-3161
# Boot Mode : Normal
# Running from : C:\Documents and Settings\mmcnair\Desktop\adwcleaner.exe
# Option [Search]
***** [Services] *****
***** [Files / Folders] *****
***** [Registry] *****
Key Found : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
***** [Internet Browsers] *****
-\\ Internet Explorer v7.0.5730.13
[OK] Registry is clean.
*************************
AdwCleaner[R1].txt - [615 octets] - [07/09/2012 13:45:05]
########## EOF - H:\AdwCleaner[R1].txt - [674 octets] ##########
That is all of them.

Jay Pfoutz · Sep 7, 2012

ComboFix

Please download ComboFix

by sUBs
From BleepingComputer.com

Please save the file to your Desktop, but rename it first to svchost.exe

Important information about ComboFix

Before the download:

Please copy and paste these instructions to Notepad and save to your Desktop, or print them - for easier access.
It is important to rename ComboFix before the download.
Please do not rename ComboFix to other names, but only the one indicated.

After the download:

Close any open browsers.
Very Important: Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Please visit here if you don't know how.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until ComboFix has completely finished.
If there is no Internet connection after running ComboFix, then restart your computer to restore back your connection.

Running ComboFix:

Double click on svchost.exe & follow the prompts.
It will attempt to install the Recovery Console:

When ComboFix finishes, it will produce a report for you.
Please post the "C:\Combo-Fix.txt" in your next reply.

Troubleshooting ComboFix

Safe Mode:

If you still cannot get ComboFix to run, try booting into Safe Mode, and run it there.

(To boot into Safe Mode, tap F8 after BIOS, and just before the Windows
logo appears. A list of options will appear, select "Safe Mode.")

Re-downloading:

If this doesn't work either, try the same method (above method), but try to download it again, except name
ComboFix.exe to iexplore.exe, explorer.exe, or winlogon.exe.

Malware is known for blocking all "user" processes, except for its whitelist of system important processes such as iexplore.exe, explorer.exe, winlogon.exe.

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

Mike in IT · Sep 10, 2012

ComboFix 12-09-09.02 - mmcnair 09/10/2012 7:37.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2031.1312 [GMT -4:00]
Running from: c:\documents and settings\mmcnair\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Default User\FXI326E.tmp
c:\documents and settings\Default User\RD3268.tmp
c:\documents and settings\Default User\REG3269.tmp
c:\documents and settings\Default User\REG326A.tmp
c:\documents and settings\Default User\REG326F.tmp
c:\documents and settings\Default User\REG3270.tmp
c:\documents and settings\lmathews.DMAINC\g2ax_customer_downloadhelper_win32_x86.exe
c:\documents and settings\lmathews.DMAINC\g2mdlhlpx.exe
c:\documents and settings\LocalService\INI3551.tmp
c:\documents and settings\lrjohnson\Local Settings\Application Data\assembly\tmp
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-08-10 to 2012-09-10 )))))))))))))))))))))))))))))))
.
.
2012-09-07 15:20 . 2012-09-07 15:20--------d-----w-c:\documents and settings\mmcnair\Application Data\Malwarebytes
2012-09-07 13:46 . 2012-09-07 13:46--------d-----w-c:\documents and settings\mmcnair\Local Settings\Application Data\Sun
2012-09-07 13:42 . 2012-09-07 13:42--------d-----w-c:\documents and settings\mmcnair\Tracing
2012-09-07 13:41 . 2012-09-07 13:41--------d-----w-c:\documents and settings\mmcnair\Application Data\ShoreWare Client
2012-08-30 20:26 . 2012-08-30 20:26--------d-----w-c:\documents and settings\lmathews.DMAINC\Local Settings\Application Data\Threat Expert
2012-08-30 13:32 . 2012-08-30 13:32--------d-----w-c:\documents and settings\lmathews.DMAINC\Application Data\Malwarebytes
2012-08-30 13:27 . 2012-08-30 13:27--------d-----w-c:\documents and settings\All Users\Application Data\XoftSpySE
2012-08-30 13:25 . 2012-08-30 13:25--------d-----w-c:\documents and settings\Administrator\Local Settings\Application Data\Threat Expert
2012-08-30 13:06 . 2012-06-22 15:3970768----a-w-c:\windows\system32\drivers\PCTBD.sys
2012-08-30 13:06 . 2012-06-22 15:38767960----a-w-c:\windows\BDTSupport.dll
2012-08-30 13:06 . 2012-06-22 15:39149464----a-w-c:\windows\SGDetectionTool.dll
2012-08-30 13:06 . 2012-06-22 15:392267096----a-w-c:\windows\PCTBDCore.dll
2012-08-30 13:06 . 2012-06-22 15:391689560----a-w-c:\windows\PCTBDRes.dll
2012-08-30 13:01 . 2012-06-22 19:34203120----a-w-c:\windows\system32\drivers\PCTSD.sys
2012-08-30 13:01 . 2012-08-30 14:05--------d-----w-c:\program files\Common Files\PC Tools
2012-08-30 13:01 . 2012-08-30 13:25--------d-----w-c:\program files\PC Tools
2012-08-30 13:00 . 2012-08-30 13:26--------d-----w-c:\documents and settings\All Users\Application Data\PC Tools
2012-08-30 13:00 . 2012-08-30 13:00--------d-----w-c:\documents and settings\Administrator\Application Data\TestApp
2012-08-30 12:23 . 2012-08-30 12:23110080----a-r-c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{ADAFC0B4-FC15-45D9-BAB3-BC7A8829D0C4}\IconF7A21AF7.exe
2012-08-30 12:23 . 2012-08-30 12:23110080----a-r-c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{ADAFC0B4-FC15-45D9-BAB3-BC7A8829D0C4}\IconD7F16134.exe
2012-08-30 12:23 . 2012-08-30 12:23110080----a-r-c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{ADAFC0B4-FC15-45D9-BAB3-BC7A8829D0C4}\IconCF33A0CE.exe
2012-08-30 12:23 . 2012-08-30 12:24--------d-----w-C:\sh4ldr
2012-08-30 12:23 . 2012-08-30 12:23--------d-----w-c:\program files\Enigma Software Group
2012-08-30 12:23 . 2012-08-30 12:23--------d-----w-c:\windows\ADAFC0B4FC1545D9BAB3BC7A8829D0C4.TMP
2012-08-29 14:00 . 2012-08-29 14:06--------d-----w-c:\program files\stinger
2012-08-29 13:30 . 2012-08-29 13:30--------d-----w-c:\documents and settings\genadmin\Application Data\Malwarebytes
2012-08-29 13:30 . 2012-08-29 13:30--------d-----w-c:\documents and settings\All Users\Application Data\Malwarebytes
2012-08-29 13:30 . 2012-08-29 13:31--------d-----w-c:\program files\Malwarebytes' Anti-Malware
2012-08-29 13:30 . 2012-07-03 17:4622344----a-w-c:\windows\system32\drivers\mbam.sys
2012-08-27 13:24 . 2012-08-27 13:24--------d-----w-c:\program files\Microsoft Synchronization Services
2012-08-27 13:23 . 2012-08-27 13:23--------d-----w-c:\program files\Microsoft Sync Framework
2012-08-27 13:23 . 2012-08-27 13:23--------d-----w-c:\program files\Microsoft SQL Server Compact Edition
2012-08-27 13:23 . 2012-08-27 13:23--------d-----w-c:\documents and settings\All Users\Microsoft
2012-08-27 13:13 . 2012-08-27 13:13--------d-----w-c:\program files\Microsoft Visual Studio 8
2012-08-27 13:11 . 2012-08-27 13:11--------d-----w-c:\program files\Microsoft Analysis Services
2012-08-17 13:37 . 2012-08-17 13:37--------d-----w-c:\documents and settings\LocalService\13973
2012-08-16 13:11 . 2012-08-16 13:11--------d-----w-c:\documents and settings\lmathews.DMAINC\Lync Recordings
2012-08-15 18:10 . 2012-09-05 11:39--------d-----w-c:\documents and settings\lmathews.DMAINC\Tracing
2012-08-15 16:25 . 2012-08-16 15:01--------d-----w-c:\program files\Microsoft Lync
2012-08-15 16:24 . 2012-08-15 16:25--------d-----w-c:\program files\OCSetup
2012-08-15 16:24 . 2012-08-15 16:25--------d-----w-c:\documents and settings\LocalService\Tracing
2012-08-15 13:57 . 2012-07-06 13:5878336------w-c:\windows\system32\dllcache\browser.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-09 13:39 . 2012-07-02 11:55426184----a-w-c:\windows\system32\FlashPlayerApp.exe
2012-08-09 13:39 . 2012-07-02 11:5570344----a-w-c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-06 13:58 . 2004-08-04 07:5678336----a-w-c:\windows\system32\browser.dll
2012-07-06 02:07 . 2008-04-09 16:12143872----a-w-c:\windows\system32\javacpl.cpl
2012-07-06 02:06 . 2012-07-23 13:19772544----a-w-c:\windows\system32\npDeployJava1.dll
2012-07-06 02:06 . 2012-07-23 13:19687544----a-w-c:\windows\system32\deployJava1.dll
2012-07-04 14:05 . 2004-08-04 08:01139784----a-w-c:\windows\system32\drivers\rdpwd.sys
2012-07-03 15:07 . 2004-08-04 07:56832512----a-w-c:\windows\system32\wininet.dll
2012-07-03 15:07 . 2004-08-04 07:561830912------w-c:\windows\system32\inetcpl.cpl
2012-07-03 15:07 . 2004-08-04 07:5678336----a-w-c:\windows\system32\ieencode.dll
2012-07-03 15:07 . 2004-08-04 07:5617408------w-c:\windows\system32\corpol.dll
2012-07-03 13:40 . 2004-08-04 06:171866112----a-w-c:\windows\system32\win32k.sys
2012-06-28 01:08 . 2012-06-28 01:089226440----a-w-c:\documents and settings\Default User\InstallAX.exe
2012-06-22 14:43 . 2012-08-30 13:063488----a-w-c:\windows\UDB.zip
2012-06-22 14:43 . 2012-08-30 13:06131----a-w-c:\windows\IDB.zip
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-07 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-07 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-07 137752]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-07-10 1036288]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"AAWTray"="c:\program files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 88024]
"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-10-30 1116920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"nwiz"="nwiz.exe" [2007-12-05 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2011-06-06 36760]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2011-06-06 2903448]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"Communicator"="c:\program files\Microsoft Lync\communicator.exe" [2012-05-16 12098648]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"SpyHunter Security Suite"="c:\program files\Enigma Software Group\SpyHunter\SpyHunter4.exe" [2012-08-21 5158848]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]
"TSClientAXDisabler"="c:\windows\Installer\TSClientMsiTrans\tscdsbl.bat" [2008-01-19 2247]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"disablecad"= 1 (0x1)
"consentpromptbehavioradmin"= 0 (0x0)
"consentpromptbehavioruser"= 3 (0x3)
"enableuiadesktoptoggle"= 0 (0x0)
"promptonsecuredesktop"= 0 (0x0)
"MaxGPOScriptWait"= 60 (0x3c)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoAutorun"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist Express Customer]
2012-08-22 11:39610448----a-w-c:\program files\Citrix\GoToAssist Remote Support Customer\430\g2ax_winlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-24657\Scripts\Logon\0\0]
"Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-24657\Scripts\Logon\1\0]
"Script"=INDProxy.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29634\Scripts\Logon\0\0]
"Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29634\Scripts\Logon\1\0]
"Script"=INDProxy.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29866\Scripts\Logon\0\0]
"Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29866\Scripts\Logon\1\0]
"Script"=FWAProxy.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29866\Scripts\Logon\1\1]
"Script"=firefox_login.vbs
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34298\Scripts\Logon\0\0]
"Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34298\Scripts\Logon\1\0]
"Script"=INDProxy.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34300\Scripts\Logon\0\0]
"Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34300\Scripts\Logon\1\0]
"Script"=INDProxy.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34416\Scripts\Logon\0\0]
"Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34416\Scripts\Logon\1\0]
"Script"=FWAProxy.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34416\Scripts\Logon\1\1]
"Script"=firefox_login.vbs
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Lync\\UcMapi.exe"=
"c:\\Program Files\\Microsoft Lync\\communicator.exe"=
.
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe [8/30/2012 9:06 AM 575448]
R2 GoToAssist Remote Support Customer;GoToAssist Remote Support Customer;c:\program files\Citrix\GoToAssist Remote Support Customer\430\g2ax_service.exe [8/22/2012 7:40 AM 610960]
R2 msoidsvc;Microsoft Online Services Sign-in Assistant;c:\program files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE [4/28/2011 6:14 AM 1577376]
R2 Security Scheduler;ScriptLogic Remote Scheduler Service;c:\windows\ProPatches\Scheduler\stSchedEx.exe [12/4/2008 3:33 PM 980312]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [4/9/2008 2:54 PM 36608]
S2 SpyHunter 4 Service;SpyHunter 4 Service;c:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [8/21/2012 3:29 PM 763840]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [7/2/2012 7:56 AM 250056]
S3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [5/6/2011 4:57 PM 13904]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [12/27/2010 11:50 PM 31124344]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 9:37 PM 4640000]
S3 PCTBD;PC Tools Browser Defender Driver;c:\windows\system32\drivers\PCTBD.sys [8/30/2012 9:06 AM 70768]
S3 PSEXESVC;PsExec;c:\windows\PSEXESVC.EXE [11/9/2011 3:00 PM 181064]
S3 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-11-19 21:47451872----a-w-c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-02 13:39]
.
2012-09-10 c:\windows\Tasks\User_Feed_Synchronization-{0E861FB1-C66E-45CF-9406-7D9D1560DBDE}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 01:36]
.
2012-09-10 c:\windows\Tasks\User_Feed_Synchronization-{522A8A50-1244-4CDE-A5EC-ED570D15BF57}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 01:36]
.
2012-09-10 c:\windows\Tasks\User_Feed_Synchronization-{64A7070F-64BE-43B6-B469-5D22F7B68FF5}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 01:36]
.
.
------- Supplementary Scan -------
.
uStart Page = https://www.dmacafe.com/
uInternet Settings,ProxyOverride = <local>
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a}
TCP: DhcpNameServer = 10.1.2.217 10.1.2.215
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-10 07:42
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(688)
c:\program files\Citrix\GoToAssist Remote Support Customer\430\g2ax_winlogon.dll
.
Completion time: 2012-09-10 07:43:48
ComboFix-quarantined-files.txt 2012-09-10 11:43
.
Pre-Run: 127,956,733,952 bytes free
Post-Run: 130,656,681,984 bytes free
.
- - End Of File - - BD3F9D93B4614AE744F858E138453041

Jay Pfoutz · Sep 10, 2012

ComboFix Script

Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open notepad and copy/paste the text in the codebox below into it:

ClearJavaCache::

Click to expand...
Save this as CFScript.txt, in the same location as ComboFix.exe
Referring to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at C:\ComboFix.txt
Please post the contents of the log in your next reply.

ESET Online Scan

Please run a free online scan with the ESET Online Scanner

Tick the box next to YES, I accept the Terms of Use
Click Start
When asked, allow the ActiveX control to install, or it will ask to download an installer. Please do so an install it.
Click Start or wait for the scanner to load.
Make sure that the options Remove found threats and the option Scan unwanted applications are checked.
Click Scan (This scan can take several hours, so please be patient)
Once the scan is completed, there are a couple of things to keep in mind:
1. If NO threats were found, allow the scanner to Uninstall on close and then close the Window.
2. If threats WERE detected, click on List of Threats Found, Export to Text File...save it as ESET-Scan-Log.txt. Click the back button/link, put a checkmark to Uninstall Application on Close and then close the window.
Open the logfile from wherever you saved it
Copy and paste the contents in your next reply.

Mike in IT · Sep 10, 2012

ComboFix 12-09-10.02 - mmcnair 09/10/2012 10:23:54.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2031.1204 [GMT -4:00]
Running from: c:\documents and settings\mmcnair\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\mmcnair\Desktop\CFScript.txt
.
.
((((((((((((((((((((((((( Files Created from 2012-08-10 to 2012-09-10 )))))))))))))))))))))))))))))))
.
.
2012-09-07 15:20 . 2012-09-07 15:20--------d-----w-c:\documents and settings\mmcnair\Application Data\Malwarebytes
2012-09-07 13:46 . 2012-09-07 13:46--------d-----w-c:\documents and settings\mmcnair\Local Settings\Application Data\Sun
2012-09-07 13:42 . 2012-09-07 13:42--------d-----w-c:\documents and settings\mmcnair\Tracing
2012-09-07 13:41 . 2012-09-07 13:41--------d-----w-c:\documents and settings\mmcnair\Application Data\ShoreWare Client
2012-08-30 20:26 . 2012-08-30 20:26--------d-----w-c:\documents and settings\lmathews.DMAINC\Local Settings\Application Data\Threat Expert
2012-08-30 13:32 . 2012-08-30 13:32--------d-----w-c:\documents and settings\lmathews.DMAINC\Application Data\Malwarebytes
2012-08-30 13:27 . 2012-08-30 13:27--------d-----w-c:\documents and settings\All Users\Application Data\XoftSpySE
2012-08-30 13:25 . 2012-08-30 13:25--------d-----w-c:\documents and settings\Administrator\Local Settings\Application Data\Threat Expert
2012-08-30 13:06 . 2012-06-22 15:3970768----a-w-c:\windows\system32\drivers\PCTBD.sys
2012-08-30 13:06 . 2012-06-22 15:38767960----a-w-c:\windows\BDTSupport.dll
2012-08-30 13:06 . 2012-06-22 15:39149464----a-w-c:\windows\SGDetectionTool.dll
2012-08-30 13:06 . 2012-06-22 15:392267096----a-w-c:\windows\PCTBDCore.dll
2012-08-30 13:06 . 2012-06-22 15:391689560----a-w-c:\windows\PCTBDRes.dll
2012-08-30 13:01 . 2012-06-22 19:34203120----a-w-c:\windows\system32\drivers\PCTSD.sys
2012-08-30 13:01 . 2012-08-30 14:05--------d-----w-c:\program files\Common Files\PC Tools
2012-08-30 13:01 . 2012-08-30 13:25--------d-----w-c:\program files\PC Tools
2012-08-30 13:00 . 2012-08-30 13:26--------d-----w-c:\documents and settings\All Users\Application Data\PC Tools
2012-08-30 13:00 . 2012-08-30 13:00--------d-----w-c:\documents and settings\Administrator\Application Data\TestApp
2012-08-30 12:23 . 2012-08-30 12:23110080----a-r-c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{ADAFC0B4-FC15-45D9-BAB3-BC7A8829D0C4}\IconF7A21AF7.exe
2012-08-30 12:23 . 2012-08-30 12:23110080----a-r-c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{ADAFC0B4-FC15-45D9-BAB3-BC7A8829D0C4}\IconD7F16134.exe
2012-08-30 12:23 . 2012-08-30 12:23110080----a-r-c:\documents and settings\Administrator\Application Data\Microsoft\Installer\{ADAFC0B4-FC15-45D9-BAB3-BC7A8829D0C4}\IconCF33A0CE.exe
2012-08-30 12:23 . 2012-08-30 12:24--------d-----w-C:\sh4ldr
2012-08-30 12:23 . 2012-08-30 12:23--------d-----w-c:\program files\Enigma Software Group
2012-08-30 12:23 . 2012-08-30 12:23--------d-----w-c:\windows\ADAFC0B4FC1545D9BAB3BC7A8829D0C4.TMP
2012-08-29 14:00 . 2012-08-29 14:06--------d-----w-c:\program files\stinger
2012-08-29 13:30 . 2012-08-29 13:30--------d-----w-c:\documents and settings\genadmin\Application Data\Malwarebytes
2012-08-29 13:30 . 2012-08-29 13:30--------d-----w-c:\documents and settings\All Users\Application Data\Malwarebytes
2012-08-29 13:30 . 2012-08-29 13:31--------d-----w-c:\program files\Malwarebytes' Anti-Malware
2012-08-29 13:30 . 2012-07-03 17:4622344----a-w-c:\windows\system32\drivers\mbam.sys
2012-08-27 13:24 . 2012-08-27 13:24--------d-----w-c:\program files\Microsoft Synchronization Services
2012-08-27 13:23 . 2012-08-27 13:23--------d-----w-c:\program files\Microsoft Sync Framework
2012-08-27 13:23 . 2012-08-27 13:23--------d-----w-c:\program files\Microsoft SQL Server Compact Edition
2012-08-27 13:23 . 2012-08-27 13:23--------d-----w-c:\documents and settings\All Users\Microsoft
2012-08-27 13:13 . 2012-08-27 13:13--------d-----w-c:\program files\Microsoft Visual Studio 8
2012-08-27 13:11 . 2012-08-27 13:11--------d-----w-c:\program files\Microsoft Analysis Services
2012-08-17 13:37 . 2012-08-17 13:37--------d-----w-c:\documents and settings\LocalService\13973
2012-08-16 13:11 . 2012-08-16 13:11--------d-----w-c:\documents and settings\lmathews.DMAINC\Lync Recordings
2012-08-15 18:10 . 2012-09-05 11:39--------d-----w-c:\documents and settings\lmathews.DMAINC\Tracing
2012-08-15 16:25 . 2012-08-16 15:01--------d-----w-c:\program files\Microsoft Lync
2012-08-15 16:24 . 2012-08-15 16:25--------d-----w-c:\program files\OCSetup
2012-08-15 16:24 . 2012-08-15 16:25--------d-----w-c:\documents and settings\LocalService\Tracing
2012-08-15 13:57 . 2012-07-06 13:5878336------w-c:\windows\system32\dllcache\browser.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-09 13:39 . 2012-07-02 11:55426184----a-w-c:\windows\system32\FlashPlayerApp.exe
2012-08-09 13:39 . 2012-07-02 11:5570344----a-w-c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-06 13:58 . 2004-08-04 07:5678336----a-w-c:\windows\system32\browser.dll
2012-07-06 02:07 . 2008-04-09 16:12143872----a-w-c:\windows\system32\javacpl.cpl
2012-07-06 02:06 . 2012-07-23 13:19772544----a-w-c:\windows\system32\npDeployJava1.dll
2012-07-06 02:06 . 2012-07-23 13:19687544----a-w-c:\windows\system32\deployJava1.dll
2012-07-04 14:05 . 2004-08-04 08:01139784----a-w-c:\windows\system32\drivers\rdpwd.sys
2012-07-03 15:07 . 2004-08-04 07:56832512----a-w-c:\windows\system32\wininet.dll
2012-07-03 15:07 . 2004-08-04 07:561830912------w-c:\windows\system32\inetcpl.cpl
2012-07-03 15:07 . 2004-08-04 07:5678336----a-w-c:\windows\system32\ieencode.dll
2012-07-03 15:07 . 2004-08-04 07:5617408------w-c:\windows\system32\corpol.dll
2012-07-03 13:40 . 2004-08-04 06:171866112----a-w-c:\windows\system32\win32k.sys
2012-06-28 01:08 . 2012-06-28 01:089226440----a-w-c:\documents and settings\Default User\InstallAX.exe
2012-06-22 14:43 . 2012-08-30 13:063488----a-w-c:\windows\UDB.zip
2012-06-22 14:43 . 2012-08-30 13:06131----a-w-c:\windows\IDB.zip
.
.
((((((((((((((((((((((((((((( SnapShot@2012-09-10_11.42.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-09-10 14:27 . 2012-09-10 14:2753248 c:\windows\Temp\catchme.dll
- 2012-09-10 11:42 . 2012-09-10 11:4253248 c:\windows\Temp\catchme.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-07 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-07 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-07 137752]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-07-10 1036288]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"AAWTray"="c:\program files\Lavasoft\Ad-Aware 2007\AAWTray.exe" [2007-08-08 88024]
"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-10-30 1116920]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-05 8523776]
"nwiz"="nwiz.exe" [2007-12-05 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-05 81920]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2011-06-06 36760]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2011-06-06 2903448]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"Communicator"="c:\program files\Microsoft Lync\communicator.exe" [2012-05-16 12098648]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"SpyHunter Security Suite"="c:\program files\Enigma Software Group\SpyHunter\SpyHunter4.exe" [2012-08-21 5158848]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"TSClientMSIUninstaller"="c:\windows\Installer\TSClientMsiTrans\tscuinst.vbs" [2007-10-30 13801]
"TSClientAXDisabler"="c:\windows\Installer\TSClientMsiTrans\tscdsbl.bat" [2008-01-19 2247]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"disablecad"= 1 (0x1)
"consentpromptbehavioradmin"= 0 (0x0)
"consentpromptbehavioruser"= 3 (0x3)
"enableuiadesktoptoggle"= 0 (0x0)
"promptonsecuredesktop"= 0 (0x0)
"MaxGPOScriptWait"= 60 (0x3c)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoAutorun"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist Express Customer]
2012-08-22 11:39610448----a-w-c:\program files\Citrix\GoToAssist Remote Support Customer\430\g2ax_winlogon.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-24657\Scripts\Logon\0\0]
"Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-24657\Scripts\Logon\1\0]
"Script"=INDProxy.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29634\Scripts\Logon\0\0]
"Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29634\Scripts\Logon\1\0]
"Script"=INDProxy.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29866\Scripts\Logon\0\0]
"Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29866\Scripts\Logon\1\0]
"Script"=FWAProxy.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-29866\Scripts\Logon\1\1]
"Script"=firefox_login.vbs
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34298\Scripts\Logon\0\0]
"Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34298\Scripts\Logon\1\0]
"Script"=INDProxy.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34300\Scripts\Logon\0\0]
"Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34300\Scripts\Logon\1\0]
"Script"=INDProxy.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34416\Scripts\Logon\0\0]
"Script"=\\dmainc.loc\SysVol\dmainc.loc\scripts\run_dma_logon.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34416\Scripts\Logon\1\0]
"Script"=FWAProxy.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1644491937-1343024091-839522115-34416\Scripts\Logon\1\1]
"Script"=firefox_login.vbs
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Lync\\UcMapi.exe"=
"c:\\Program Files\\Microsoft Lync\\communicator.exe"=
.
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe [8/30/2012 9:06 AM 575448]
R2 GoToAssist Remote Support Customer;GoToAssist Remote Support Customer;c:\program files\Citrix\GoToAssist Remote Support Customer\430\g2ax_service.exe [8/22/2012 7:40 AM 610960]
R2 msoidsvc;Microsoft Online Services Sign-in Assistant;c:\program files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE [4/28/2011 6:14 AM 1577376]
R2 Security Scheduler;ScriptLogic Remote Scheduler Service;c:\windows\ProPatches\Scheduler\stSchedEx.exe [12/4/2008 3:33 PM 980312]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [4/9/2008 2:54 PM 36608]
S2 SpyHunter 4 Service;SpyHunter 4 Service;c:\progra~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [8/21/2012 3:29 PM 763840]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [7/2/2012 7:56 AM 250056]
S3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [5/6/2011 4:57 PM 13904]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [12/27/2010 11:50 PM 31124344]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [1/9/2010 9:37 PM 4640000]
S3 PCTBD;PC Tools Browser Defender Driver;c:\windows\system32\drivers\PCTBD.sys [8/30/2012 9:06 AM 70768]
S3 PSEXESVC;PsExec;c:\windows\PSEXESVC.EXE [11/9/2011 3:00 PM 181064]
S3 SBRE;SBRE;\??\c:\windows\system32\drivers\SBREdrv.sys --> c:\windows\system32\drivers\SBREdrv.sys [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-11-19 21:47451872----a-w-c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder
.
2012-09-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-02 13:39]
.
2012-09-10 c:\windows\Tasks\User_Feed_Synchronization-{0E861FB1-C66E-45CF-9406-7D9D1560DBDE}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 01:36]
.
2012-09-10 c:\windows\Tasks\User_Feed_Synchronization-{522A8A50-1244-4CDE-A5EC-ED570D15BF57}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 01:36]
.
2012-09-10 c:\windows\Tasks\User_Feed_Synchronization-{64A7070F-64BE-43B6-B469-5D22F7B68FF5}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 01:36]
.
.
------- Supplementary Scan -------
.
uStart Page = https://www.dmacafe.com/
uInternet Settings,ProxyOverride = <local>
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a}
TCP: DhcpNameServer = 10.1.2.217 10.1.2.215
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-10 10:27
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(688)
c:\program files\Citrix\GoToAssist Remote Support Customer\430\g2ax_winlogon.dll
.
- - - - - - - > 'explorer.exe'(2860)
c:\windows\system32\WININET.dll
c:\progra~1\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
c:\progra~1\MICROS~2\Office14\1033\GrooveIntlResource.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2012-09-10 10:28:19
ComboFix-quarantined-files.txt 2012-09-10 14:28
ComboFix2.txt 2012-09-10 11:43
.
Pre-Run: 130,660,487,168 bytes free
Post-Run: 130,667,532,288 bytes free
.
- - End Of File - - A6FF0A9642EAA4A4AD06D35D88BDA007
I'm running the other scanner, the ESET scanner, right now.

Mike in IT · Sep 10, 2012

It said no threats were found.

Jay Pfoutz · Sep 11, 2012

Any more issues?

We need to know any other issues that are plaguing your computer. Kindly give a summary so we know how to continue from here.

Many of the things to note for us would be:

Slow computer
Error messages
Fake antivirus alerts or the icon in the system tray
svchost.exe running at 100%
System crashes or blue screen of death

Mike in IT · Sep 11, 2012

There don't seem to be any other problems. Isn't svchost.exe the ComboFix.exe you had me download? Is it supposed to still be running? It appeared to run fine when you had me run it.

Jay Pfoutz · Sep 12, 2012

Svchost.exe as a regular Windows process is a legitimate critical part of Windows. I had you rename ComboFix.exe to svchost.exe to mask the malware removal tool so it would not be blocked from running.

Your logs appear to be clean. If there are no more issues, then we shall finish up!

Clean up System Restore

Now, to get you off to a clean start, we will be creating a new Restore Point, then clearing the old ones to make sure you do not get reinfected, in case you need to "restore back."

Select Start > All Programs > Accessories > System tools > System Restore.
On the dialogue box that appears select Create a Restore Point
Click NEXT
Enter a name e.g. Clean
Click CREATE

You now have a clean restore point, to get rid of the bad ones:

Select Start > All Programs > Accessories > System tools > Disk Cleanup.
In the Drop down box that appears select your main drive e.g. C
Click OK
The System will do some calculation and the display a dialogue box with TABS
Select the More Options Tab.
At the bottom will be a system restore box with a CLEANUP button click this
Accept the Warning and select OK again, the program will close and you are done

Run OTC to remove our tools

To remove all of the tools we used and the files and folders they created, please do the following:
Please download OTC.exe by OldTimer:

Save it to your Desktop.
Double click OTC.exe.
Click the CleanUp! button.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes.

Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

Purge old temporary files

Download CCleaner Slim and save it to your Desktop - Alternate download link

When the file has been saved, go to your Desktop and double-click on ccsetupxxx_slim.exe
Follow the prompts to install the program.

* Double-click the CCleaner shortcut on the desktop to start the program.
* Click on the Options block on the left, then choose Cookies.
* Under Cookies to Delete, highlight any cookies you would like to retain permanently
* Click the right arrow > to move them to the Cookies to Keep window.
* Go into Options > Advanced & uncheck Only delete files in Windows Temp folders older than 48 hours
* Click Cleaner on the left then Run Cleaner on the right to run the program.
* Important: Make sure that ALL browser windows are closed before selecting Run Cleaner

Caution: Only use the Registry feature if you are very familiar with the registry.
Always back up your registry before making any changes. Exit CCleaner after it has completed it's process.

Security Check

Please download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Mike in IT · Sep 12, 2012

Results of screen317's Security Check version 0.99.50
Windows XP Service Pack 3 x86 (UAC is enabled)
Internet Explorer 7 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Disabled!
Please wait while WMIC compiles updated MOF files.
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
`````````Anti-malware/Other Utilities Check:`````````
SpyHunter
Malwarebytes Anti-Malware version 1.62.0.1300
CCleaner
JavaFX 2.1.1
Java 7 Update 7
Java(TM) 6 Update 2
Adobe Reader 8 Adobe Reader out of Date!
Adobe Reader X 10.1.3 Adobe Reader out of Date!
````````Process Check: objlist.exe by Laurent````````
Ad-Aware AAWTray.exe
Common Files Microsoft Shared Microsoft Online Services MSOIDSVC.EXE
Common Files Microsoft Shared Microsoft Online Services MSOIDSvcm.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:: 8%
````````````````````End of Log``````````````````````

Jay Pfoutz · Sep 12, 2012

Uninstall old versions of plugins

Please go to Start > Control Panel > Add or Remove Programs and remove the following (if present):

Java(TM) 6 Update 2
Adobe Reader 8
Adobe Reader X 10.1.3

Adobe Reader Update!

Please download and install the newest version of Adobe Acrobat Reader from Adobe.com

Personal Tips on Preventing Malware

See this page for more info about malware and prevention.

Read more about "FAQ: How did Sirefef or ZeroAccess Infect You?"

Any other questions before I mark this topic solved?

Mike in IT · Sep 12, 2012

Nope you did a great job thanks!

Jay Pfoutz · Sep 12, 2012

Excellent. You did a good job too!

Marked as solved. √

Solved I have a user with the sirefef virus

Mike in IT

Posts: 9 +0

Jay Pfoutz

Posts: 4,279 +49

Jay Pfoutz

Posts: 4,279 +49

Mike in IT

Posts: 9 +0

Jay Pfoutz

Posts: 4,279 +49

Mike in IT

Posts: 9 +0

Jay Pfoutz

Posts: 4,279 +49

Mike in IT

Posts: 9 +0

Jay Pfoutz

Posts: 4,279 +49

Mike in IT

Posts: 9 +0

Mike in IT

Posts: 9 +0

Jay Pfoutz

Posts: 4,279 +49

Mike in IT

Posts: 9 +0

Jay Pfoutz

Posts: 4,279 +49

Mike in IT

Posts: 9 +0

Jay Pfoutz

Posts: 4,279 +49

Mike in IT

Posts: 9 +0

Jay Pfoutz

Posts: 4,279 +49

Similar threads

Latest posts