Hi All
I got a blue screen which had a stop code:
STOP 0x0000050
The computer wentoff and restarted this kept happening and couldnt go onto safe mode.
In here it showed me different blue screen.
STOP 0x000007B
I removed evrything and did a Flea Power
It started fine then but there were a lot of other troubles with my computer:
1. Cannot copy any files
I thought I would copy some of the important files to external drive. There is a message
"File Integrity violated"
2. Cannot Unhide Hidden files and folders
I was trying to locate rouge files in AppData. But i show hidden files through folder options, it disappears again.
The same trhough Control Panel.
3. Get an error while opening most programs
Microsoft Visual C++ Error
R6002
floating point support not loaded
4. Cannot update malware bytes after installing
5. Downloads get redirected.
6. Task manager is disabled. Get a message "It is disabled by your admin"
7. Same with Regedit "Registery editing disabled by your admin"
Here are the logs of progrms that I ran:
(1)
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 06/23/2011 at 04:14 PM
Application Version : 4.49.1000
Core Rules Database Version : 7313
Trace Rules Database Version: 5125
Scan type : Complete Scan
Total Scan Time : 00:31:07
Memory items scanned : 443
Memory threats detected : 1
Registry items scanned : 6530
Registry threats detected : 32
File items scanned : 17000
File threats detected : 6
Disabled.RegistryEditor
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System#DisableRegistryTools
Disabled.TaskManager
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System#DisableTaskMgr
HKU\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM#DISABLETASKMGR
HKU\S-1-5-21-842925246-287218729-1177238915-1003\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM#DISABLETASKMGR
HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM#DISABLETASKMGR
Trojan.Agent/Gen-MailDrop/Spammer
C:\DOCUME~1\RAMMY\LOCALS~1\TEMP\FEFOR.EXE
C:\DOCUME~1\RAMMY\LOCALS~1\TEMP\FEFOR.EXE
C:\DOCUMENTS AND SETTINGS\RAMMY\LOCAL SETTINGS\TEMP\FEFOR.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E2CA3EB2-07A6-4423-B883-E274DE655E4C}\RP15\A0033436.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E2CA3EB2-07A6-4423-B883-E274DE655E4C}\RP15\A0033437.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E2CA3EB2-07A6-4423-B883-E274DE655E4C}\RP16\A0033565.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E2CA3EB2-07A6-4423-B883-E274DE655E4C}\RP16\A0033708.EXE
Disabled.SecurityCenterOption
HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER#ANTIVIRUSDISABLENOTIFY
HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER#FIREWALLDISABLENOTIFY
HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER#UPDATESDISABLENOTIFY
Malware.Sality
HKLM\SYSTEM\CurrentControlSet\Services\amsint32
HKLM\SYSTEM\CurrentControlSet\Services\amsint32#Type
HKLM\SYSTEM\CurrentControlSet\Services\amsint32#Start
HKLM\SYSTEM\CurrentControlSet\Services\amsint32#ErrorControl
HKLM\SYSTEM\CurrentControlSet\Services\amsint32#ImagePath
HKLM\SYSTEM\CurrentControlSet\Services\amsint32#DisplayName
HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Security
HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Security#Security
HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Enum
HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Enum#0
HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Enum#Count
HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Enum#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#DeviceDesc
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#Capabilities
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000\Control
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000\Control#ActiveService
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
(2)
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org
Database version: 6923
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
23/06/2011 16:58:53
mbam-log-2011-06-23 (16-58-53).txt
Scan type: Full scan (C:\|D:\|E:\|G:\|)
Objects scanned: 246654
Time elapsed: 26 minute(s), 11 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 5
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32 (Virus.Sality) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amsint32 (Virus.Sality) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DISABLETASKMGR (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (PUM.Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
(3)
ComboFix 11-06-22.03 - Rammy 23/06/2011 17:24:41.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2038.1575 [GMT 5.5:30]
Running from: c:\documents and settings\Rammy\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\ALCMTR.EXE
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_AMSINT32
-------\Service_amsint32
.
.
((((((((((((((((((((((((( Files Created from 2011-05-23 to 2011-06-23 )))))))))))))))))))))))))))))))
.
.
2011-06-23 10:47 . 2011-06-23 10:52 -------- d-----w- c:\windows\system32\wbem\Logs
2011-06-22 17:47 . 2011-06-22 17:47 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-06-22 17:45 . 2011-06-22 17:46 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2011-06-22 17:24 . 2011-06-22 18:11 -------- d-----w- c:\program files\Temp File Cleaner DB Toolbar
2011-06-22 17:22 . 2011-06-22 17:22 -------- d-----w- c:\program files\Temp File Cleaner
2011-06-22 16:18 . 2011-06-22 17:29 -------- d-----w- c:\documents and settings\JUST DO IT
2011-06-22 16:11 . 2011-06-22 16:11 -------- d-----w- c:\program files\Avira
2011-06-22 15:11 . 2011-06-22 15:11 -------- d-----w- c:\program files\Common Files\ParetoLogic
2011-06-22 15:11 . 2011-06-22 15:11 -------- d-----w- c:\program files\ParetoLogic
2011-06-22 14:13 . 2011-06-22 14:13 -------- d-----w- c:\documents and settings\Rammy\Application Data\DriverCure
2011-06-22 14:13 . 2011-06-22 14:13 -------- d-----w- c:\documents and settings\Rammy\Application Data\ParetoLogic
2011-06-22 14:13 . 2011-06-22 15:11 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2011-06-22 13:51 . 2008-04-13 17:45 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys
2011-06-22 13:50 . 2008-04-13 23:12 73832 -c--a-w- c:\windows\system32\dllcache\slcoinst.dll
2011-06-22 13:49 . 2001-08-17 07:37 19840 -c--a-w- c:\windows\system32\dllcache\philtune.sys
2011-06-22 13:48 . 2001-08-17 07:22 17280 -c--a-w- c:\windows\system32\dllcache\mraid35x.sys
2011-06-22 13:47 . 2001-08-17 16:06 372824 -c--a-w- c:\windows\system32\dllcache\iconf32.dll
2011-06-22 13:46 . 2001-08-17 05:50 334208 -c--a-w- c:\windows\system32\dllcache\ds1wdm.sys
2011-06-22 13:45 . 2008-04-13 17:46 36480 -c--a-w- c:\windows\system32\dllcache\bthprint.sys
2011-06-22 13:44 . 2008-04-13 17:36 43008 -c--a-w- c:\windows\system32\dllcache\amdagp.sys
2011-06-22 10:53 . 2011-06-22 10:53 -------- d-----w- c:\program files\Common Files\Java
2011-06-22 10:48 . 2011-06-22 10:48 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2011-06-22 10:48 . 2011-06-22 10:48 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-06-22 10:48 . 2011-06-22 10:48 -------- d-----w- c:\program files\Java
2011-06-22 03:43 . 2011-06-22 03:43 -------- d-----w- c:\windows\BUVC_AP
2011-06-22 03:43 . 2011-06-22 03:43 -------- d-----w- c:\documents and settings\Rammy\Application Data\InstallShield
2011-06-21 20:21 . 2011-06-22 13:00 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\FLVService
2011-06-21 20:21 . 2011-06-21 20:21 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2011-06-21 17:35 . 2011-06-21 17:35 -------- d-----w- c:\documents and settings\Rammy\Local Settings\Application Data\Mozilla
2011-06-21 17:32 . 2011-06-21 12:15 -------- d-----w- c:\windows\SHELLNEW
2011-06-21 17:32 . 2011-06-21 17:32 -------- d-----w- c:\documents and settings\Rammy\Local Settings\Application Data\Microsoft Help
2011-06-21 17:31 . 2011-06-21 13:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2011-06-21 17:31 . 2011-06-21 17:31 -------- d-----r- C:\MSOCache
2011-06-21 17:26 . 2011-06-21 17:27 -------- d-----w- c:\program files\Common Files\Adobe
2011-06-21 17:25 . 2011-06-21 14:51 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-21 17:25 . 2011-06-22 10:48 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-21 14:44 . 2011-06-21 14:44 -------- d-----w- c:\documents and settings\Rammy\AppData
2011-06-21 14:38 . 2011-06-22 12:15 -------- d-----w- c:\documents and settings\Rammy\Local Settings\Application Data\FLVService
2011-06-21 14:38 . 2011-06-21 14:38 -------- d-----w- c:\windows\Freecorder
2011-06-21 14:31 . 2011-06-22 03:46 -------- d-----w- c:\documents and settings\Rammy\Application Data\BitComet
2011-06-21 14:08 . 2011-06-21 14:08 -------- d-----w- c:\windows\Sun
2011-06-21 14:04 . 2011-06-22 17:39 -------- d-----w- C:\Downloads
2011-06-21 13:33 . 2011-06-22 03:43 -------- d-----w- c:\program files\InstallShield Installation Information
2011-06-21 13:33 . 2011-06-21 13:33 -------- d-----w- c:\program files\Seagate
2011-06-21 13:33 . 2011-06-21 13:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Seagate
2011-06-21 13:32 . 2011-06-21 13:32 -------- d-----w- c:\documents and settings\Rammy\Local Settings\Application Data\Downloaded Installations
2011-06-21 13:32 . 2011-06-21 13:32 -------- d-sh--w- c:\windows\ftpcache
2011-06-21 13:30 . 2011-06-22 17:17 -------- d-----w- c:\program files\BitComet
2011-06-21 13:29 . 2011-06-21 13:35 -------- d-----w- c:\documents and settings\Rammy\Application Data\TeraCopy
2011-06-21 13:29 . 2011-06-21 13:29 -------- d-----w- c:\program files\TeraCopy
2011-06-21 12:45 . 2011-06-22 07:58 -------- d-----w- c:\documents and settings\Rammy\Application Data\vlc
2011-06-21 12:38 . 2011-06-21 13:22 -------- d-----w- c:\program files\XP Disk Cleaner
2011-06-21 12:38 . 2011-06-21 12:38 -------- d-----w- c:\windows\system32\XPToolsLicenseComponent
2011-06-21 12:17 . 2006-10-26 14:26 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2011-06-21 12:17 . 2006-10-26 14:26 32592 ----a-w- c:\windows\system32\msonpmon.dll
2011-06-21 12:16 . 2011-06-21 12:16 -------- d-----w- c:\program files\Microsoft Works
2011-06-21 12:15 . 2011-06-21 12:15 -------- d-----w- c:\program files\MSBuild
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-04-27 16:00 . 2007-04-27 16:00 1275455 ----a-w- c:\program files\Common Files\unins000.exe
2011-04-28 18:01 . 2011-06-22 09:57 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-09-23 . 9425B72F40257B45D45D24773273DAD0 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
.
[-] 2009-09-23 . 5A8E28037289FCCBF7AD3FC57DF7048F . 502272 . . [1.0626.6002.18005] . . c:\windows\system32\usp10.dll
.
[-] 2009-09-23 . 87F6E1E3202E85AC083AC64D84115C44 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
[-] 2009-09-23 . 24D516507C5DD80F2A3F7BF28B931141 . 2163712 . . [5.1.2600.5755] . . c:\windows\system32\ntkrnlpa.exe
.
.
[-] 2009-09-23 . 0DB420DBBAC999ED43DE0162FBA07269 . 2285056 . . [5.1.2600.5755] . . c:\windows\system32\ntoskrnl.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 332520]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-05-01 263464]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-21 212480]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-21 240640]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-21 216576]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-09-09 128512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^Rammy^Start Menu^Programs^Startup^Seagate Product Registration.lnk]
path=c:\documents and settings\Rammy\Start Menu\Programs\Startup\Seagate Product Registration.lnk
backup=c:\windows\pss\Seagate Product Registration.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-11-10 07:19 1001920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-30 15:45 113560 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 03:42 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 19:17 100648 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-04-10 14:52 16940032 ----a-w- c:\windows\RTHDCPL.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Reader_sl.exe"=
"c:\\Program Files\\Seagate\\SeagateManager\\FreeAgent Status\\StxMenuMgr.exe"=
"c:\\Program Files\\Seagate\\SeagateManager\\Backup\\MaxBackServiceInt.exe"=
"c:\\WINDOWS\\system32\\igfxtray.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\WINDOWS\\system32\\hkcmd.exe"=
"c:\\Program Files\\Windows Media Player\\wmdbexport.exe"=
"c:\\WINDOWS\\system32\\igfxpers.exe"=
"c:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe"=
"c:\\Program Files\\MBlaze UI\\bin\\App.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\POWERPNT.EXE"=
"c:\\WINDOWS\\system32\\igfxsrvc.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"18803:TCP"= 18803:TCP:BitComet 18803 TCP
"18803:UDP"= 18803:UDP:BitComet 18803 UDP
.
R0 iastor78;iastor78;c:\windows\system32\drivers\iastor78.sys [23/09/2009 18:14 308248]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [01/05/2009 14:35 181544]
R2 UDisk Monitor;UDisk Monitor;c:\program files\MBlaze UI\bin\MonServiceUDisk.exe [27/04/2007 21:51 512000]
R3 ztemtusbser;ZTEMT Legacy Serial Communication;c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys [27/04/2007 21:51 104704]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - AMSINT32
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-22 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2011-03-29 23:17]
.
2011-06-22 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2011-03-29 23:17]
.
2011-06-22 c:\windows\Tasks\PC Health Advisor Defrag.job
- c:\program files\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]
.
2011-06-22 c:\windows\Tasks\PC Health Advisor.job
- c:\program files\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bigseekpro.com/tempcleaner/{587BF97A-3CE5-44C8-BD22-5DFD9D006DEA}
mStart Page = hxxp://www.bigseekpro.com/tempcleaner/{587BF97A-3CE5-44C8-BD22-5DFD9D006DEA}
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: Interfaces\{AB31D87D-B04D-43A7-903C-29E2E158B0E4}: NameServer = 10.216.254.140 10.216.254.141
FF - ProfilePath - c:\documents and settings\Rammy\Application Data\Mozilla\Firefox\Profiles\xaevdg6j.default\
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-10 - (no file)
MSConfigStartUp-Alcmtr - ALCMTR.EXE
MSConfigStartUp-DATAMNGR - c:\progra~1\WI0498~1\Datamngr\DATAMN~1.EXE
MSConfigStartUp-Freecorder FLV Service - c:\program files\Freecorder\FLVSrvc.exe
MSConfigStartUp-Google Update - c:\documents and settings\Rammy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-23 17:28
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1872)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4028_x-ww_e69378d1\MSVCR80.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Completion time: 2011-06-23 17:31:06 - machine was rebooted
ComboFix-quarantined-files.txt 2011-06-23 12:01
.
Pre-Run: 14,317,383,680 bytes free
Post-Run: 14,243,508,224 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - DDB7C020C5C70856D49188A21436E7FB
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
(4)
I ram GMER. It didn't show anything under Rootkit-Malware. So I disabled devices, no go.
Ran it in safe mode.
Got BLUE SCREEN STOP ERROR 0x000007B
So I restarted in normal mode.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
(5)
.
DDS (Ver_2011-06-12.02) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26
Run by Rammy at 17:47:16 on 2011-06-23
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2038.1571 [GMT 5.5:30]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\MBlaze UI\bin\MonServiceUDisk.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\MBlaze UI\bin\App.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.bigseekpro.com/tempcleaner/{587BF97A-3CE5-44C8-BD22-5DFD9D006DEA}
mStart Page = hxxp://www.bigseekpro.com/tempcleaner/{587BF97A-3CE5-44C8-BD22-5DFD9D006DEA}
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.5.4.11.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SMTTB2009 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\temp file cleaner db toolbar\tbcore3.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe"
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
uPolicies-system: DisableTaskMgr = 1 (0x1)
uPolicies-system: DisableRegistryTools = 1 (0x1)
mPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
mPolicies-system: EnableLUA = 0 (0x0)
dPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
dPolicies-system: DisableTaskMgr = 1 (0x1)
dPolicies-system: DisableRegistryTools = 1 (0x1)
IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm
IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.5.4.11.dll/206
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: Interfaces\{AB31D87D-B04D-43A7-903C-29E2E158B0E4} : NameServer = 10.216.254.140 10.216.254.141
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\rammy\application data\mozilla\firefox\profiles\xaevdg6j.default\
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
.
============= SERVICES / DRIVERS ===============
.
R0 iastor78;iastor78;c:\windows\system32\drivers\iastor78.sys [2009-9-23 308248]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2009-5-1 181544]
R2 UDisk Monitor;UDisk Monitor;c:\program files\mblaze ui\bin\MonServiceUDisk.exe [2007-4-27 512000]
R3 amsint32;amsint32;\??\c:\windows\system32\drivers\rpggk.sys --> c:\windows\system32\drivers\rpggk.sys [?]
R3 ztemtusbser;ZTEMT Legacy Serial Communication;c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys [2007-4-27 104704]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
.
=============== Created Last 30 ================
.
2011-06-23 12:04:41 -------- d-----w- c:\documents and settings\rammy\application data\Toolbar4
2011-06-23 11:54:07 -------- d-sha-r- C:\cmdcons
2011-06-23 11:48:10 98816 ----a-w- c:\windows\sed.exe
2011-06-23 11:48:10 518144 ----a-w- c:\windows\SWREG.exe
2011-06-23 11:48:10 256512 ----a-w- c:\windows\PEV.exe
2011-06-23 11:48:10 208896 ----a-w- c:\windows\MBR.exe
2011-06-23 10:47:59 -------- d-----w- c:\windows\system32\wbem\Logs
2011-06-22 17:47:28 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2011-06-22 17:24:20 -------- d-----w- c:\program files\Temp File Cleaner DB Toolbar
2011-06-22 17:22:15 -------- d-----w- c:\program files\Temp File Cleaner
2011-06-22 16:11:00 -------- d-----w- c:\program files\Avira
2011-06-22 15:11:24 -------- d-----w- c:\program files\common files\ParetoLogic
2011-06-22 15:11:23 -------- d-----w- c:\program files\ParetoLogic
2011-06-22 14:13:42 -------- d-----w- c:\documents and settings\rammy\application data\DriverCure
2011-06-22 14:13:41 -------- d-----w- c:\documents and settings\rammy\application data\ParetoLogic
2011-06-22 14:13:30 -------- d-----w- c:\documents and settings\all users\application data\ParetoLogic
2011-06-22 13:51:59 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys
2011-06-22 13:50:59 73832 -c--a-w- c:\windows\system32\dllcache\slcoinst.dll
2011-06-22 13:49:59 92416 -c--a-w- c:\windows\system32\dllcache\phildec.sys
2011-06-22 13:48:57 17280 -c--a-w- c:\windows\system32\dllcache\mraid35x.sys
2011-06-22 13:47:58 38528 -c--a-w- c:\windows\system32\dllcache\ibmvcap.sys
2011-06-22 13:46:58 334208 -c--a-w- c:\windows\system32\dllcache\ds1wdm.sys
2011-06-22 13:45:56 36480 -c--a-w- c:\windows\system32\dllcache\bthprint.sys
2011-06-22 13:44:59 5248 -c--a-w- c:\windows\system32\dllcache\aliide.sys
2011-06-22 10:48:38 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-06-22 10:48:38 476904 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
2011-06-22 10:11:39 -------- d-----w- c:\windows\system32\appmgmt
2011-06-22 03:43:37 -------- d-----w- c:\windows\BUVC_AP
2011-06-21 17:35:11 -------- d-----w- c:\documents and settings\rammy\local settings\application data\Mozilla
2011-06-21 17:32:50 -------- d-----w- c:\windows\SHELLNEW
2011-06-21 17:32:12 -------- d-----w- c:\documents and settings\rammy\local settings\application data\Microsoft Help
2011-06-21 17:25:47 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-21 17:25:28 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-21 14:44:19 -------- d-----w- c:\documents and settings\rammy\AppData
2011-06-21 14:38:40 -------- d-----w- c:\documents and settings\rammy\local settings\application data\FLVService
2011-06-21 14:38:37 -------- d-----w- c:\windows\Freecorder
2011-06-21 14:31:20 -------- d-----w- c:\documents and settings\rammy\application data\BitComet
2011-06-21 14:04:44 -------- d-----w- C:\Downloads
2011-06-21 13:33:40 -------- d-----w- c:\program files\Seagate
2011-06-21 13:33:40 -------- d-----w- c:\documents and settings\all users\application data\Seagate
2011-06-21 13:32:37 -------- d-----w- c:\documents and settings\rammy\local settings\application data\Downloaded Installations
2011-06-21 13:32:03 -------- d-sh--w- c:\windows\ftpcache
2011-06-21 13:30:06 -------- d-----w- c:\program files\BitComet
2011-06-21 13:29:31 -------- d-----w- c:\documents and settings\rammy\application data\TeraCopy
2011-06-21 13:29:28 -------- d-----w- c:\program files\TeraCopy
2011-06-21 12:38:28 -------- d-----w- c:\windows\system32\XPToolsLicenseComponent
2011-06-21 12:38:28 -------- d-----w- c:\program files\XP Disk Cleaner
2011-06-21 12:17:59 33104 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\msonpppr.dll
2011-06-21 12:17:59 32592 ----a-w- c:\windows\system32\msonpmon.dll
.
==================== Find3M ====================
.
2007-04-27 16:00:03 1275455 ----a-w- c:\program files\common files\unins000.exe
.
============= FINISH: 17:47:49.93 ===============
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
(6)
DDS ATTACH (Ver_2011-06-12.02)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 27/04/2007 21:32:07
System Uptime: 23/06/2011 17:44:28 (0 hours ago)
.
Motherboard: Acer, Inc. | | Nestos
Processor: Intel(R) Core(TM)2 Duo CPU T5250 @ 1.50GHz | U2E1 | 1499/166mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 24 GiB total, 13.262 GiB free.
D: is FIXED (NTFS) - 59 GiB total, 28.898 GiB free.
E: is FIXED (NTFS) - 66 GiB total, 37.211 GiB free.
F: is CDROM ()
G: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Modem Device on High Definition Audio Bus
Device ID: HDAUDIO\FUNC_02&VEN_11C1&DEV_1040&SUBSYS_1025011D&REV_1002\4&23A3DF2F&0&0101
Manufacturer:
Name: Modem Device on High Definition Audio Bus
PNP Device ID: HDAUDIO\FUNC_02&VEN_11C1&DEV_1040&SUBSYS_1025011D&REV_1002\4&23A3DF2F&0&0101
Service:
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Base System Device
Device ID: PCI\VEN_1180&DEV_0843&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4AF0
Manufacturer:
Name: Base System Device
PNP Device ID: PCI\VEN_1180&DEV_0843&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4AF0
Service:
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Base System Device
Device ID: PCI\VEN_1180&DEV_0592&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4BF0
Manufacturer:
Name: Base System Device
PNP Device ID: PCI\VEN_1180&DEV_0592&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4BF0
Service:
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Base System Device
Device ID: PCI\VEN_1180&DEV_0852&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4CF0
Manufacturer:
Name: Base System Device
PNP Device ID: PCI\VEN_1180&DEV_0852&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4CF0
Service:
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: ACPI\WEC1023\4&2FFE84EA&0
Manufacturer:
Name:
PNP Device ID: ACPI\WEC1023\4&2FFE84EA&0
Service:
.
==== System Restore Points ===================
.
RP12: 22/06/2011 16:18:19 - Installed Java(TM) 6 Update 26
RP13: 22/06/2011 20:43:53 - PC Health Advisor Backup
RP14: 22/06/2011 22:51:30 - Removed Microsoft Visual C++ 2005 Redistributable
RP15: 22/06/2011 23:15:52 - Installed WinZip 15.5
RP16: 23/06/2011 00:23:35 - Removed Kaspersky Security Scan
.
==== Installed Programs ======================
.
Acer Crystal Eye Webcam
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X (10.0.1)
Adobe Shockwave Player 11.5
BitComet 1.27
CCleaner
DirectX 10 NE (New Edition)
Intel(R) Graphics Media Accelerator Driver
Java Auto Updater
Java(TM) 6 Update 26
MBlaze UI
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Mozilla Firefox 5.0 (x86 en-US)
ParetoLogic PC Health Advisor
Realtek High Definition Audio Driver
Seagate Manager Installer
Temp File Cleaner
Temp File Cleaner DB Toolbar
TeraCopy 2.0 beta 4
VLC media player 1.1.10
WebFldrs XP
WinZip 15.5
XP Disk Cleaner 2.0
.
==== Event Viewer Messages From Past Week ========
.
23/06/2011 17:24:34, error: Service Control Manager [7034] - The UDisk Monitor service terminated unexpectedly. It has done this 1 time(s).
23/06/2011 16:11:39, error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period.
22/06/2011 23:42:38, error: ACPIEC [1] - \Device\ACPIEC: The embedded controller (EC) hardware didn't respond within the timeout period. This may indicate an error in the EC hardware or firmware, or possibly a poorly designed BIOS which accesses the EC in an unsafe manner. The EC driver will retry the failed transaction if possible.
22/06/2011 21:41:46, error: Service Control Manager [7034] - The Avira AntiVir Guard service terminated unexpectedly. It has done this 3 time(s).
22/06/2011 21:41:38, error: Service Control Manager [7031] - The Avira AntiVir Guard service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
22/06/2011 21:41:30, error: Service Control Manager [7031] - The Avira AntiVir Guard service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
22/06/2011 19:02:45, error: ztemtusbser [43] -
22/06/2011 18:53:41, error: Service Control Manager [7000] - The amsint32 service failed to start due to the following error: The system cannot find the file specified.
22/06/2011 18:48:23, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
22/06/2011 15:34:37, error: PlugPlayManager [11] - The device Root\LEGACY_AMSINT32\0000 disappeared from the system without first being prepared for removal.
22/06/2011 09:17:48, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
22/06/2011 09:17:44, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: iastor78
21/06/2011 18:46:13, error: LDMS [3023] - The Logical Disk Manager Service failed while registering for device handle notifications on device \\?\usbstor#cdrom&ven_zte&prod_usb_storage_fff1&rev_2.31#000000000002&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}. Win32 Error: 2.
21/06/2011 18:46:12, error: LDMS [3023] - The Logical Disk Manager Service failed while registering for device handle notifications on device \\?\storage#removablemedia#7&242f9386&0&rm#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}. Win32 Error: 2.
.
==== End Of File ===========================
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
I got a blue screen which had a stop code:
STOP 0x0000050
The computer wentoff and restarted this kept happening and couldnt go onto safe mode.
In here it showed me different blue screen.
STOP 0x000007B
I removed evrything and did a Flea Power
It started fine then but there were a lot of other troubles with my computer:
1. Cannot copy any files
I thought I would copy some of the important files to external drive. There is a message
"File Integrity violated"
2. Cannot Unhide Hidden files and folders
I was trying to locate rouge files in AppData. But i show hidden files through folder options, it disappears again.
The same trhough Control Panel.
3. Get an error while opening most programs
Microsoft Visual C++ Error
R6002
floating point support not loaded
4. Cannot update malware bytes after installing
5. Downloads get redirected.
6. Task manager is disabled. Get a message "It is disabled by your admin"
7. Same with Regedit "Registery editing disabled by your admin"
Here are the logs of progrms that I ran:
(1)
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 06/23/2011 at 04:14 PM
Application Version : 4.49.1000
Core Rules Database Version : 7313
Trace Rules Database Version: 5125
Scan type : Complete Scan
Total Scan Time : 00:31:07
Memory items scanned : 443
Memory threats detected : 1
Registry items scanned : 6530
Registry threats detected : 32
File items scanned : 17000
File threats detected : 6
Disabled.RegistryEditor
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System#DisableRegistryTools
Disabled.TaskManager
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System#DisableTaskMgr
HKU\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM#DISABLETASKMGR
HKU\S-1-5-21-842925246-287218729-1177238915-1003\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM#DISABLETASKMGR
HKU\S-1-5-18\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM#DISABLETASKMGR
Trojan.Agent/Gen-MailDrop/Spammer
C:\DOCUME~1\RAMMY\LOCALS~1\TEMP\FEFOR.EXE
C:\DOCUME~1\RAMMY\LOCALS~1\TEMP\FEFOR.EXE
C:\DOCUMENTS AND SETTINGS\RAMMY\LOCAL SETTINGS\TEMP\FEFOR.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E2CA3EB2-07A6-4423-B883-E274DE655E4C}\RP15\A0033436.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E2CA3EB2-07A6-4423-B883-E274DE655E4C}\RP15\A0033437.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E2CA3EB2-07A6-4423-B883-E274DE655E4C}\RP16\A0033565.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E2CA3EB2-07A6-4423-B883-E274DE655E4C}\RP16\A0033708.EXE
Disabled.SecurityCenterOption
HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER#ANTIVIRUSDISABLENOTIFY
HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER#FIREWALLDISABLENOTIFY
HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER#UPDATESDISABLENOTIFY
Malware.Sality
HKLM\SYSTEM\CurrentControlSet\Services\amsint32
HKLM\SYSTEM\CurrentControlSet\Services\amsint32#Type
HKLM\SYSTEM\CurrentControlSet\Services\amsint32#Start
HKLM\SYSTEM\CurrentControlSet\Services\amsint32#ErrorControl
HKLM\SYSTEM\CurrentControlSet\Services\amsint32#ImagePath
HKLM\SYSTEM\CurrentControlSet\Services\amsint32#DisplayName
HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Security
HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Security#Security
HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Enum
HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Enum#0
HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Enum#Count
HKLM\SYSTEM\CurrentControlSet\Services\amsint32\Enum#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32#NextInstance
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#Service
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#Legacy
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#ConfigFlags
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#Class
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#ClassGUID
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#DeviceDesc
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000#Capabilities
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000\Control
HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32\0000\Control#ActiveService
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
(2)
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org
Database version: 6923
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
23/06/2011 16:58:53
mbam-log-2011-06-23 (16-58-53).txt
Scan type: Full scan (C:\|D:\|E:\|G:\|)
Objects scanned: 246654
Time elapsed: 26 minute(s), 11 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 5
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32 (Virus.Sality) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amsint32 (Virus.Sality) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DISABLETASKMGR (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (PUM.Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
(3)
ComboFix 11-06-22.03 - Rammy 23/06/2011 17:24:41.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2038.1575 [GMT 5.5:30]
Running from: c:\documents and settings\Rammy\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\ALCMTR.EXE
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_AMSINT32
-------\Service_amsint32
.
.
((((((((((((((((((((((((( Files Created from 2011-05-23 to 2011-06-23 )))))))))))))))))))))))))))))))
.
.
2011-06-23 10:47 . 2011-06-23 10:52 -------- d-----w- c:\windows\system32\wbem\Logs
2011-06-22 17:47 . 2011-06-22 17:47 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-06-22 17:45 . 2011-06-22 17:46 -------- d-----w- c:\documents and settings\All Users\Application Data\WinZip
2011-06-22 17:24 . 2011-06-22 18:11 -------- d-----w- c:\program files\Temp File Cleaner DB Toolbar
2011-06-22 17:22 . 2011-06-22 17:22 -------- d-----w- c:\program files\Temp File Cleaner
2011-06-22 16:18 . 2011-06-22 17:29 -------- d-----w- c:\documents and settings\JUST DO IT
2011-06-22 16:11 . 2011-06-22 16:11 -------- d-----w- c:\program files\Avira
2011-06-22 15:11 . 2011-06-22 15:11 -------- d-----w- c:\program files\Common Files\ParetoLogic
2011-06-22 15:11 . 2011-06-22 15:11 -------- d-----w- c:\program files\ParetoLogic
2011-06-22 14:13 . 2011-06-22 14:13 -------- d-----w- c:\documents and settings\Rammy\Application Data\DriverCure
2011-06-22 14:13 . 2011-06-22 14:13 -------- d-----w- c:\documents and settings\Rammy\Application Data\ParetoLogic
2011-06-22 14:13 . 2011-06-22 15:11 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2011-06-22 13:51 . 2008-04-13 17:45 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys
2011-06-22 13:50 . 2008-04-13 23:12 73832 -c--a-w- c:\windows\system32\dllcache\slcoinst.dll
2011-06-22 13:49 . 2001-08-17 07:37 19840 -c--a-w- c:\windows\system32\dllcache\philtune.sys
2011-06-22 13:48 . 2001-08-17 07:22 17280 -c--a-w- c:\windows\system32\dllcache\mraid35x.sys
2011-06-22 13:47 . 2001-08-17 16:06 372824 -c--a-w- c:\windows\system32\dllcache\iconf32.dll
2011-06-22 13:46 . 2001-08-17 05:50 334208 -c--a-w- c:\windows\system32\dllcache\ds1wdm.sys
2011-06-22 13:45 . 2008-04-13 17:46 36480 -c--a-w- c:\windows\system32\dllcache\bthprint.sys
2011-06-22 13:44 . 2008-04-13 17:36 43008 -c--a-w- c:\windows\system32\dllcache\amdagp.sys
2011-06-22 10:53 . 2011-06-22 10:53 -------- d-----w- c:\program files\Common Files\Java
2011-06-22 10:48 . 2011-06-22 10:48 476904 ----a-w- c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2011-06-22 10:48 . 2011-06-22 10:48 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-06-22 10:48 . 2011-06-22 10:48 -------- d-----w- c:\program files\Java
2011-06-22 03:43 . 2011-06-22 03:43 -------- d-----w- c:\windows\BUVC_AP
2011-06-22 03:43 . 2011-06-22 03:43 -------- d-----w- c:\documents and settings\Rammy\Application Data\InstallShield
2011-06-21 20:21 . 2011-06-22 13:00 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\FLVService
2011-06-21 20:21 . 2011-06-21 20:21 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2011-06-21 17:35 . 2011-06-21 17:35 -------- d-----w- c:\documents and settings\Rammy\Local Settings\Application Data\Mozilla
2011-06-21 17:32 . 2011-06-21 12:15 -------- d-----w- c:\windows\SHELLNEW
2011-06-21 17:32 . 2011-06-21 17:32 -------- d-----w- c:\documents and settings\Rammy\Local Settings\Application Data\Microsoft Help
2011-06-21 17:31 . 2011-06-21 13:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2011-06-21 17:31 . 2011-06-21 17:31 -------- d-----r- C:\MSOCache
2011-06-21 17:26 . 2011-06-21 17:27 -------- d-----w- c:\program files\Common Files\Adobe
2011-06-21 17:25 . 2011-06-21 14:51 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-21 17:25 . 2011-06-22 10:48 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-21 14:44 . 2011-06-21 14:44 -------- d-----w- c:\documents and settings\Rammy\AppData
2011-06-21 14:38 . 2011-06-22 12:15 -------- d-----w- c:\documents and settings\Rammy\Local Settings\Application Data\FLVService
2011-06-21 14:38 . 2011-06-21 14:38 -------- d-----w- c:\windows\Freecorder
2011-06-21 14:31 . 2011-06-22 03:46 -------- d-----w- c:\documents and settings\Rammy\Application Data\BitComet
2011-06-21 14:08 . 2011-06-21 14:08 -------- d-----w- c:\windows\Sun
2011-06-21 14:04 . 2011-06-22 17:39 -------- d-----w- C:\Downloads
2011-06-21 13:33 . 2011-06-22 03:43 -------- d-----w- c:\program files\InstallShield Installation Information
2011-06-21 13:33 . 2011-06-21 13:33 -------- d-----w- c:\program files\Seagate
2011-06-21 13:33 . 2011-06-21 13:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Seagate
2011-06-21 13:32 . 2011-06-21 13:32 -------- d-----w- c:\documents and settings\Rammy\Local Settings\Application Data\Downloaded Installations
2011-06-21 13:32 . 2011-06-21 13:32 -------- d-sh--w- c:\windows\ftpcache
2011-06-21 13:30 . 2011-06-22 17:17 -------- d-----w- c:\program files\BitComet
2011-06-21 13:29 . 2011-06-21 13:35 -------- d-----w- c:\documents and settings\Rammy\Application Data\TeraCopy
2011-06-21 13:29 . 2011-06-21 13:29 -------- d-----w- c:\program files\TeraCopy
2011-06-21 12:45 . 2011-06-22 07:58 -------- d-----w- c:\documents and settings\Rammy\Application Data\vlc
2011-06-21 12:38 . 2011-06-21 13:22 -------- d-----w- c:\program files\XP Disk Cleaner
2011-06-21 12:38 . 2011-06-21 12:38 -------- d-----w- c:\windows\system32\XPToolsLicenseComponent
2011-06-21 12:17 . 2006-10-26 14:26 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2011-06-21 12:17 . 2006-10-26 14:26 32592 ----a-w- c:\windows\system32\msonpmon.dll
2011-06-21 12:16 . 2011-06-21 12:16 -------- d-----w- c:\program files\Microsoft Works
2011-06-21 12:15 . 2011-06-21 12:15 -------- d-----w- c:\program files\MSBuild
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-04-27 16:00 . 2007-04-27 16:00 1275455 ----a-w- c:\program files\Common Files\unins000.exe
2011-04-28 18:01 . 2011-06-22 09:57 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2009-09-23 . 9425B72F40257B45D45D24773273DAD0 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
.
[-] 2009-09-23 . 5A8E28037289FCCBF7AD3FC57DF7048F . 502272 . . [1.0626.6002.18005] . . c:\windows\system32\usp10.dll
.
[-] 2009-09-23 . 87F6E1E3202E85AC083AC64D84115C44 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
[-] 2009-09-23 . 24D516507C5DD80F2A3F7BF28B931141 . 2163712 . . [5.1.2600.5755] . . c:\windows\system32\ntkrnlpa.exe
.
.
[-] 2009-09-23 . 0DB420DBBAC999ED43DE0162FBA07269 . 2285056 . . [5.1.2600.5755] . . c:\windows\system32\ntoskrnl.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 332520]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-05-01 263464]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-01-21 212480]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-01-21 240640]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-01-21 216576]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_3"="advpack.dll" [2009-09-09 128512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKLM\~\startupfolder\C:^Documents and Settings^Rammy^Start Menu^Programs^Startup^Seagate Product Registration.lnk]
path=c:\documents and settings\Rammy\Start Menu\Programs\Startup\Seagate Product Registration.lnk
backup=c:\windows\pss\Seagate Product Registration.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-11-10 07:19 1001920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-01-30 15:45 113560 ----a-w- c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 03:42 15360 ----a-w- c:\windows\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-26 19:17 100648 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2008-04-10 14:52 16940032 ----a-w- c:\windows\RTHDCPL.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\Adobe\\Reader 10.0\\Reader\\Reader_sl.exe"=
"c:\\Program Files\\Seagate\\SeagateManager\\FreeAgent Status\\StxMenuMgr.exe"=
"c:\\Program Files\\Seagate\\SeagateManager\\Backup\\MaxBackServiceInt.exe"=
"c:\\WINDOWS\\system32\\igfxtray.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\WINDOWS\\system32\\hkcmd.exe"=
"c:\\Program Files\\Windows Media Player\\wmdbexport.exe"=
"c:\\WINDOWS\\system32\\igfxpers.exe"=
"c:\\Program Files\\Common Files\\Java\\Java Update\\jusched.exe"=
"c:\\Program Files\\MBlaze UI\\bin\\App.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\POWERPNT.EXE"=
"c:\\WINDOWS\\system32\\igfxsrvc.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"18803:TCP"= 18803:TCP:BitComet 18803 TCP
"18803:UDP"= 18803:UDP:BitComet 18803 UDP
.
R0 iastor78;iastor78;c:\windows\system32\drivers\iastor78.sys [23/09/2009 18:14 308248]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [01/05/2009 14:35 181544]
R2 UDisk Monitor;UDisk Monitor;c:\program files\MBlaze UI\bin\MonServiceUDisk.exe [27/04/2007 21:51 512000]
R3 ztemtusbser;ZTEMT Legacy Serial Communication;c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys [27/04/2007 21:51 104704]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - AMSINT32
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-22 c:\windows\Tasks\ParetoLogic Registration3.job
- c:\program files\Common Files\ParetoLogic\UUS3\UUS3.dll [2011-03-29 23:17]
.
2011-06-22 c:\windows\Tasks\ParetoLogic Update Version3.job
- c:\program files\Common Files\ParetoLogic\UUS3\Pareto_Update3.exe [2011-03-29 23:17]
.
2011-06-22 c:\windows\Tasks\PC Health Advisor Defrag.job
- c:\program files\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]
.
2011-06-22 c:\windows\Tasks\PC Health Advisor.job
- c:\program files\ParetoLogic\PCHA\PCHA.exe [2011-03-29 23:17]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.bigseekpro.com/tempcleaner/{587BF97A-3CE5-44C8-BD22-5DFD9D006DEA}
mStart Page = hxxp://www.bigseekpro.com/tempcleaner/{587BF97A-3CE5-44C8-BD22-5DFD9D006DEA}
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: Interfaces\{AB31D87D-B04D-43A7-903C-29E2E158B0E4}: NameServer = 10.216.254.140 10.216.254.141
FF - ProfilePath - c:\documents and settings\Rammy\Application Data\Mozilla\Firefox\Profiles\xaevdg6j.default\
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-10 - (no file)
MSConfigStartUp-Alcmtr - ALCMTR.EXE
MSConfigStartUp-DATAMNGR - c:\progra~1\WI0498~1\Datamngr\DATAMN~1.EXE
MSConfigStartUp-Freecorder FLV Service - c:\program files\Freecorder\FLVSrvc.exe
MSConfigStartUp-Google Update - c:\documents and settings\Rammy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-23 17:28
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'explorer.exe'(1872)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4028_x-ww_e69378d1\MSVCR80.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Completion time: 2011-06-23 17:31:06 - machine was rebooted
ComboFix-quarantined-files.txt 2011-06-23 12:01
.
Pre-Run: 14,317,383,680 bytes free
Post-Run: 14,243,508,224 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - DDB7C020C5C70856D49188A21436E7FB
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
(4)
I ram GMER. It didn't show anything under Rootkit-Malware. So I disabled devices, no go.
Ran it in safe mode.
Got BLUE SCREEN STOP ERROR 0x000007B
So I restarted in normal mode.
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
(5)
.
DDS (Ver_2011-06-12.02) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26
Run by Rammy at 17:47:16 on 2011-06-23
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2038.1571 [GMT 5.5:30]
.
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\MBlaze UI\bin\MonServiceUDisk.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\MBlaze UI\bin\App.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.bigseekpro.com/tempcleaner/{587BF97A-3CE5-44C8-BD22-5DFD9D006DEA}
mStart Page = hxxp://www.bigseekpro.com/tempcleaner/{587BF97A-3CE5-44C8-BD22-5DFD9D006DEA}
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.5.4.11.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: SMTTB2009 Class: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\program files\temp file cleaner db toolbar\tbcore3.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe"
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
uPolicies-system: DisableTaskMgr = 1 (0x1)
uPolicies-system: DisableRegistryTools = 1 (0x1)
mPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
mPolicies-system: EnableLUA = 0 (0x0)
dPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
dPolicies-system: DisableTaskMgr = 1 (0x1)
dPolicies-system: DisableRegistryTools = 1 (0x1)
IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm
IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.5.4.11.dll/206
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
TCP: Interfaces\{AB31D87D-B04D-43A7-903C-29E2E158B0E4} : NameServer = 10.216.254.140 10.216.254.141
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\rammy\application data\mozilla\firefox\profiles\xaevdg6j.default\
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
.
============= SERVICES / DRIVERS ===============
.
R0 iastor78;iastor78;c:\windows\system32\drivers\iastor78.sys [2009-9-23 308248]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2009-5-1 181544]
R2 UDisk Monitor;UDisk Monitor;c:\program files\mblaze ui\bin\MonServiceUDisk.exe [2007-4-27 512000]
R3 amsint32;amsint32;\??\c:\windows\system32\drivers\rpggk.sys --> c:\windows\system32\drivers\rpggk.sys [?]
R3 ztemtusbser;ZTEMT Legacy Serial Communication;c:\windows\system32\drivers\CT_ZTEMT_U_USBSER.sys [2007-4-27 104704]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]
.
=============== Created Last 30 ================
.
2011-06-23 12:04:41 -------- d-----w- c:\documents and settings\rammy\application data\Toolbar4
2011-06-23 11:54:07 -------- d-sha-r- C:\cmdcons
2011-06-23 11:48:10 98816 ----a-w- c:\windows\sed.exe
2011-06-23 11:48:10 518144 ----a-w- c:\windows\SWREG.exe
2011-06-23 11:48:10 256512 ----a-w- c:\windows\PEV.exe
2011-06-23 11:48:10 208896 ----a-w- c:\windows\MBR.exe
2011-06-23 10:47:59 -------- d-----w- c:\windows\system32\wbem\Logs
2011-06-22 17:47:28 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2011-06-22 17:24:20 -------- d-----w- c:\program files\Temp File Cleaner DB Toolbar
2011-06-22 17:22:15 -------- d-----w- c:\program files\Temp File Cleaner
2011-06-22 16:11:00 -------- d-----w- c:\program files\Avira
2011-06-22 15:11:24 -------- d-----w- c:\program files\common files\ParetoLogic
2011-06-22 15:11:23 -------- d-----w- c:\program files\ParetoLogic
2011-06-22 14:13:42 -------- d-----w- c:\documents and settings\rammy\application data\DriverCure
2011-06-22 14:13:41 -------- d-----w- c:\documents and settings\rammy\application data\ParetoLogic
2011-06-22 14:13:30 -------- d-----w- c:\documents and settings\all users\application data\ParetoLogic
2011-06-22 13:51:59 26112 -c--a-w- c:\windows\system32\dllcache\usbser.sys
2011-06-22 13:50:59 73832 -c--a-w- c:\windows\system32\dllcache\slcoinst.dll
2011-06-22 13:49:59 92416 -c--a-w- c:\windows\system32\dllcache\phildec.sys
2011-06-22 13:48:57 17280 -c--a-w- c:\windows\system32\dllcache\mraid35x.sys
2011-06-22 13:47:58 38528 -c--a-w- c:\windows\system32\dllcache\ibmvcap.sys
2011-06-22 13:46:58 334208 -c--a-w- c:\windows\system32\dllcache\ds1wdm.sys
2011-06-22 13:45:56 36480 -c--a-w- c:\windows\system32\dllcache\bthprint.sys
2011-06-22 13:44:59 5248 -c--a-w- c:\windows\system32\dllcache\aliide.sys
2011-06-22 10:48:38 73728 ----a-w- c:\windows\system32\javacpl.cpl
2011-06-22 10:48:38 476904 ----a-w- c:\program files\mozilla firefox\plugins\npdeployJava1.dll
2011-06-22 10:11:39 -------- d-----w- c:\windows\system32\appmgmt
2011-06-22 03:43:37 -------- d-----w- c:\windows\BUVC_AP
2011-06-21 17:35:11 -------- d-----w- c:\documents and settings\rammy\local settings\application data\Mozilla
2011-06-21 17:32:50 -------- d-----w- c:\windows\SHELLNEW
2011-06-21 17:32:12 -------- d-----w- c:\documents and settings\rammy\local settings\application data\Microsoft Help
2011-06-21 17:25:47 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-06-21 17:25:28 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-06-21 14:44:19 -------- d-----w- c:\documents and settings\rammy\AppData
2011-06-21 14:38:40 -------- d-----w- c:\documents and settings\rammy\local settings\application data\FLVService
2011-06-21 14:38:37 -------- d-----w- c:\windows\Freecorder
2011-06-21 14:31:20 -------- d-----w- c:\documents and settings\rammy\application data\BitComet
2011-06-21 14:04:44 -------- d-----w- C:\Downloads
2011-06-21 13:33:40 -------- d-----w- c:\program files\Seagate
2011-06-21 13:33:40 -------- d-----w- c:\documents and settings\all users\application data\Seagate
2011-06-21 13:32:37 -------- d-----w- c:\documents and settings\rammy\local settings\application data\Downloaded Installations
2011-06-21 13:32:03 -------- d-sh--w- c:\windows\ftpcache
2011-06-21 13:30:06 -------- d-----w- c:\program files\BitComet
2011-06-21 13:29:31 -------- d-----w- c:\documents and settings\rammy\application data\TeraCopy
2011-06-21 13:29:28 -------- d-----w- c:\program files\TeraCopy
2011-06-21 12:38:28 -------- d-----w- c:\windows\system32\XPToolsLicenseComponent
2011-06-21 12:38:28 -------- d-----w- c:\program files\XP Disk Cleaner
2011-06-21 12:17:59 33104 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\msonpppr.dll
2011-06-21 12:17:59 32592 ----a-w- c:\windows\system32\msonpmon.dll
.
==================== Find3M ====================
.
2007-04-27 16:00:03 1275455 ----a-w- c:\program files\common files\unins000.exe
.
============= FINISH: 17:47:49.93 ===============
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
(6)
DDS ATTACH (Ver_2011-06-12.02)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 27/04/2007 21:32:07
System Uptime: 23/06/2011 17:44:28 (0 hours ago)
.
Motherboard: Acer, Inc. | | Nestos
Processor: Intel(R) Core(TM)2 Duo CPU T5250 @ 1.50GHz | U2E1 | 1499/166mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 24 GiB total, 13.262 GiB free.
D: is FIXED (NTFS) - 59 GiB total, 28.898 GiB free.
E: is FIXED (NTFS) - 66 GiB total, 37.211 GiB free.
F: is CDROM ()
G: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Modem Device on High Definition Audio Bus
Device ID: HDAUDIO\FUNC_02&VEN_11C1&DEV_1040&SUBSYS_1025011D&REV_1002\4&23A3DF2F&0&0101
Manufacturer:
Name: Modem Device on High Definition Audio Bus
PNP Device ID: HDAUDIO\FUNC_02&VEN_11C1&DEV_1040&SUBSYS_1025011D&REV_1002\4&23A3DF2F&0&0101
Service:
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Base System Device
Device ID: PCI\VEN_1180&DEV_0843&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4AF0
Manufacturer:
Name: Base System Device
PNP Device ID: PCI\VEN_1180&DEV_0843&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4AF0
Service:
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Base System Device
Device ID: PCI\VEN_1180&DEV_0592&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4BF0
Manufacturer:
Name: Base System Device
PNP Device ID: PCI\VEN_1180&DEV_0592&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4BF0
Service:
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Base System Device
Device ID: PCI\VEN_1180&DEV_0852&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4CF0
Manufacturer:
Name: Base System Device
PNP Device ID: PCI\VEN_1180&DEV_0852&SUBSYS_011D1025&REV_12\4&3B3A03B5&0&4CF0
Service:
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: ACPI\WEC1023\4&2FFE84EA&0
Manufacturer:
Name:
PNP Device ID: ACPI\WEC1023\4&2FFE84EA&0
Service:
.
==== System Restore Points ===================
.
RP12: 22/06/2011 16:18:19 - Installed Java(TM) 6 Update 26
RP13: 22/06/2011 20:43:53 - PC Health Advisor Backup
RP14: 22/06/2011 22:51:30 - Removed Microsoft Visual C++ 2005 Redistributable
RP15: 22/06/2011 23:15:52 - Installed WinZip 15.5
RP16: 23/06/2011 00:23:35 - Removed Kaspersky Security Scan
.
==== Installed Programs ======================
.
Acer Crystal Eye Webcam
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader X (10.0.1)
Adobe Shockwave Player 11.5
BitComet 1.27
CCleaner
DirectX 10 NE (New Edition)
Intel(R) Graphics Media Accelerator Driver
Java Auto Updater
Java(TM) 6 Update 26
MBlaze UI
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Mozilla Firefox 5.0 (x86 en-US)
ParetoLogic PC Health Advisor
Realtek High Definition Audio Driver
Seagate Manager Installer
Temp File Cleaner
Temp File Cleaner DB Toolbar
TeraCopy 2.0 beta 4
VLC media player 1.1.10
WebFldrs XP
WinZip 15.5
XP Disk Cleaner 2.0
.
==== Event Viewer Messages From Past Week ========
.
23/06/2011 17:24:34, error: Service Control Manager [7034] - The UDisk Monitor service terminated unexpectedly. It has done this 1 time(s).
23/06/2011 16:11:39, error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period.
22/06/2011 23:42:38, error: ACPIEC [1] - \Device\ACPIEC: The embedded controller (EC) hardware didn't respond within the timeout period. This may indicate an error in the EC hardware or firmware, or possibly a poorly designed BIOS which accesses the EC in an unsafe manner. The EC driver will retry the failed transaction if possible.
22/06/2011 21:41:46, error: Service Control Manager [7034] - The Avira AntiVir Guard service terminated unexpectedly. It has done this 3 time(s).
22/06/2011 21:41:38, error: Service Control Manager [7031] - The Avira AntiVir Guard service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
22/06/2011 21:41:30, error: Service Control Manager [7031] - The Avira AntiVir Guard service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
22/06/2011 19:02:45, error: ztemtusbser [43] -
22/06/2011 18:53:41, error: Service Control Manager [7000] - The amsint32 service failed to start due to the following error: The system cannot find the file specified.
22/06/2011 18:48:23, error: DCOM [10005] - DCOM got error "%1058" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
22/06/2011 15:34:37, error: PlugPlayManager [11] - The device Root\LEGACY_AMSINT32\0000 disappeared from the system without first being prepared for removal.
22/06/2011 09:17:48, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
22/06/2011 09:17:44, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: iastor78
21/06/2011 18:46:13, error: LDMS [3023] - The Logical Disk Manager Service failed while registering for device handle notifications on device \\?\usbstor#cdrom&ven_zte&prod_usb_storage_fff1&rev_2.31#000000000002&0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}. Win32 Error: 2.
21/06/2011 18:46:12, error: LDMS [3023] - The Logical Disk Manager Service failed while registering for device handle notifications on device \\?\storage#removablemedia#7&242f9386&0&rm#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}. Win32 Error: 2.
.
==== End Of File ===========================
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
