System Security 2009, half removed

View previous topic View next topic Go down

Re: System Security 2009, half removed

Post by mitam101 on 20th July 2009, 6:18 pm

Combo fix ran smoothly this time. Here is the long:

ComboFix 09-07-19.04 - Mitam 07/20/2009 13:01.3.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1982.1199 [GMT -5:00]
Running from: c:\users\Mitam\Desktop\Combo-Fix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2954942239-3376670357-2783907261-500
c:\$recycle.bin\S-1-5-21-4003641115-3550914113-3698931782-500
C:\WinLogon
c:\winlogon\catch_k.dat
c:\winlogon\CfReboot.dat
c:\winlogon\d-del2A.dat
c:\winlogon\d-del4AV.dat
c:\winlogon\drev.dat
c:\winlogon\ErrTrap1
c:\winlogon\mtee.cfexe
c:\winlogon\MUI
c:\winlogon\MWindows.dat
c:\winlogon\mynul.dat
c:\winlogon\mypictures.folder.dat
c:\winlogon\n.pif
c:\winlogon\N_\11032
c:\winlogon\N_\11255
c:\winlogon\N_\12467
c:\winlogon\N_\12797
c:\winlogon\N_\15600
c:\winlogon\N_\17644
c:\winlogon\N_\17763
c:\winlogon\N_\1806
c:\winlogon\N_\18382
c:\winlogon\N_\19282
c:\winlogon\N_\21061
c:\winlogon\N_\23244
c:\winlogon\N_\24002
c:\winlogon\N_\25245
c:\winlogon\N_\27881
c:\winlogon\N_\30564
c:\winlogon\N_\31479
c:\winlogon\N_\31494
c:\winlogon\N_\4221
c:\winlogon\N_\7031
c:\winlogon\ND_.bat
c:\winlogon\ndis_combofix.dat
c:\winlogon\netsvc.bad.dat
c:\winlogon\netsvc.dat
c:\winlogon\NetworkService.dat
c:\winlogon\NirCmd.cfexe
c:\winlogon\NircmdB.exe
c:\winlogon\NirCmdC.cfexe
c:\winlogon\NlsLanguageDefault
c:\winlogon\notifykeys.dat
c:\winlogon\NT-OS.cmd
c:\winlogon\NULL
c:\winlogon\Ori04
c:\winlogon\OriO4
c:\winlogon\OsId.txt
c:\winlogon\OSid.vbs
c:\winlogon\OsVer
c:\winlogon\patched.af
c:\winlogon\PathSearch
c:\winlogon\pend.txt
c:\winlogon\pev.cfexe
c:\winlogon\pev.exe
c:\winlogon\Policies.dat
c:\winlogon\PreDIR
c:\winlogon\Prep.inf
c:\winlogon\Profiles.Folder.dat
c:\winlogon\progfile.dat
c:\winlogon\Purity.dat
c:\winlogon\PV.cfexe
c:\winlogon\RCLink.dat
c:\winlogon\RcVer00
c:\winlogon\REGDACL.sed
c:\winlogon\RegDo.sed
c:\winlogon\region.dat
c:\winlogon\RegScan.cmd
c:\winlogon\regt.cfexe
c:\winlogon\RenVDel.dat
c:\winlogon\Resident.txt
c:\winlogon\RkDetectAA_tdssserv.dat
c:\winlogon\Rkey.cmd
c:\winlogon\rogues.dat
c:\winlogon\run.sed
c:\winlogon\run2.sed
c:\winlogon\Rust.str
c:\winlogon\safeboot.dat
c:\winlogon\safeboot.def.dat
c:\winlogon\safeboot.def.vista.dat
c:\winlogon\sed.cfexe
c:\winlogon\SetEnvmt.bat
c:\winlogon\SetPath.bat
c:\winlogon\setpath.cfexe
c:\winlogon\sfx.cmd
c:\winlogon\SnapShot.cmd
c:\winlogon\SRestore.cmd
c:\winlogon\srizbi.md5
c:\winlogon\startup.folder.dat
c:\winlogon\SuppScan.cmd
c:\winlogon\SuspectB_netsvc.dat
c:\winlogon\SuspectLegacy
c:\winlogon\suspectSvc.dat
c:\winlogon\svc_wht.dat
c:\winlogon\SvcCovered
c:\winlogon\SvcDiff
c:\winlogon\SvcDrv.vbs
c:\winlogon\SvcDump
c:\winlogon\SvcDumpB
c:\winlogon\SvcDumpFull
c:\winlogon\SvcFull
c:\winlogon\svchost.dat
c:\winlogon\svclist.dat
c:\winlogon\SvcTarget.dat
c:\winlogon\SWREG.cfexe
c:\winlogon\swreg.exe
c:\winlogon\swsc.cfexe
c:\winlogon\swxcacls.cfexe
c:\winlogon\SysPath.dat
c:\winlogon\system_ini.dat
c:\winlogon\tail.cfexe
c:\winlogon\temp2000
c:\winlogon\temp4900
c:\winlogon\temp4901
c:\winlogon\templates.folder.dat
c:\winlogon\toolbar.sed
c:\winlogon\unhand.dat
c:\winlogon\UploadThese
c:\winlogon\V-FilesB.dat
c:\winlogon\v-tmp.dat
c:\winlogon\v_str.dat
c:\winlogon\v_wht.dat
c:\winlogon\version.txt
c:\winlogon\Vista.mac
c:\winlogon\vRun_DLL
c:\winlogon\w_sock.dll
c:\winlogon\whitedir.dat
c:\winlogon\whitedirCreated.dat
c:\winlogon\Windir.dat
c:\winlogon\Wmi_rem.vbs
c:\winlogon\WrgNameDLL
c:\winlogon\wtf_tdssservB
c:\winlogon\zDomain.dat
c:\winlogon\zhsvc.dat
c:\winlogon\zip.cfexe
c:\winlogon\Zlob01

.
((((((((((((((((((((((((( Files Created from 2009-06-20 to 2009-07-20 )))))))))))))))))))))))))))))))
.

2009-07-20 18:07 . 2009-07-20 18:07 -------- d-----w- c:\users\Mitam\AppData\Local\temp
2009-07-20 18:07 . 2009-07-20 18:07 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2009-07-18 19:02 . 2009-07-18 19:02 3775176 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-18 19:00 . 2009-07-18 19:00 -------- d-----w- C:\_OTM
2009-07-16 14:34 . 2009-06-15 15:24 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-16 14:34 . 2009-06-15 15:20 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-16 14:34 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-16 14:34 . 2009-06-15 12:52 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-07-12 23:47 . 2009-07-12 23:52 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-12 23:47 . 2009-07-12 23:47 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-07-11 19:08 . 2009-07-11 19:08 -------- d-----w- c:\users\Mitam\AppData\Roaming\Malwarebytes
2009-07-11 19:07 . 2009-07-13 18:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-11 19:07 . 2009-07-18 19:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-11 19:07 . 2009-07-13 18:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-11 19:07 . 2009-07-11 19:07 -------- d-----w- c:\programdata\Malwarebytes
2009-07-11 19:02 . 2009-07-11 19:02 680 ----a-w- c:\users\Mitam\AppData\Local\d3d9caps.dat
2009-07-10 04:30 . 2009-07-10 04:30 127872 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\uninstall.exe
2009-07-10 04:30 . 2009-07-10 04:31 -------- d-----w- c:\users\Mitam\AppData\Roaming\Move Networks
2009-07-09 15:45 . 2009-07-09 15:45 81 ----a-w- C:\CTX.DAT
2009-07-09 15:45 . 2009-07-09 15:45 -------- d-----w- c:\users\Mitam\Citrix
2009-07-08 08:20 . 2009-07-08 08:20 -------- d-----w- c:\program files\AviSynth 2.5
2009-07-08 08:20 . 2009-07-08 08:20 -------- d-----w- c:\program files\Red Kawa
2009-07-08 08:18 . 2009-07-08 08:18 -------- d-----w- c:\users\Mitam\AppData\Roaming\AVS4YOU
2009-07-08 08:18 . 2009-07-08 08:18 -------- d-----w- c:\programdata\AVS4YOU
2009-07-08 08:17 . 2009-07-08 08:18 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-07-08 08:17 . 2008-08-13 16:22 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-07-08 08:17 . 2009-07-08 08:20 -------- d-----w- c:\program files\AVS4YOU
2009-07-08 08:17 . 2008-08-13 16:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2009-07-08 08:17 . 2008-08-13 16:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2009-06-25 17:30 . 2009-06-25 17:40 4506256 ----a-w- c:\users\Mitam\AppData\Roaming\LimeWire\.NetworkShare\LimeWireWin4.16.6.exe
2009-06-24 23:02 . 2009-06-24 23:02 -------- d-----w- c:\users\Mitam\AppData\Roaming\acccore
2009-06-24 23:01 . 2009-06-24 23:01 -------- d-----w- c:\users\Mitam\AppData\Local\AOL OCP
2009-06-24 23:00 . 2009-06-24 23:00 -------- d-----w- c:\programdata\acccore
2009-06-24 22:59 . 2009-06-24 23:00 -------- d-----w- c:\program files\AIM6
2009-06-24 16:03 . 2009-06-24 19:00 -------- d-----w- c:\program files\CamStudio
2009-06-23 19:38 . 2009-06-23 19:41 -------- d-----w- c:\users\Mitam\AppData\Roaming\Pamela
2009-06-23 19:38 . 2009-06-23 19:38 176128 ----a-w- c:\windows\system32\RemoteControl.dll
2009-06-23 19:38 . 2009-06-23 19:38 -------- d-----w- c:\program files\Pamela
2009-06-23 18:50 . 2009-06-23 18:50 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-06-23 18:50 . 2009-07-11 18:24 -------- d-----w- c:\users\Mitam\AppData\Roaming\skypePM
2009-06-23 18:48 . 2009-07-10 21:27 -------- d-----w- c:\users\Mitam\AppData\Roaming\Skype
2009-06-23 18:48 . 2009-06-23 18:48 -------- d-----w- c:\program files\Common Files\Skype
2009-06-23 18:48 . 2009-06-23 18:48 -------- d-----r- c:\program files\Skype
2009-06-23 18:47 . 2009-06-23 18:48 -------- d-----w- c:\programdata\Skype

.

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27085
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 20th July 2009, 6:19 pm

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-20 17:42 . 2009-06-19 17:54 55918 ----a-w- c:\programdata\nvModes.dat
2009-07-20 04:06 . 2009-02-07 15:53 12 ----a-w- c:\windows\bthservsdp.dat
2009-07-17 01:28 . 2008-10-24 06:58 -------- d-----w- c:\program files\LimeWire
2009-07-16 14:42 . 2008-10-24 06:14 -------- d-----w- c:\users\Mitam\AppData\Roaming\Azureus
2009-07-12 06:32 . 2008-10-24 07:42 -------- d-----w- c:\program files\Warcraft III
2009-07-10 04:30 . 2009-06-16 06:35 4183416 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
2009-06-24 23:00 . 2008-10-29 20:05 -------- d-----w- c:\programdata\Viewpoint
2009-06-24 22:59 . 2008-10-29 20:05 -------- d-----w- c:\program files\Common Files\AOL
2009-06-20 08:02 . 2008-10-24 03:34 76984 ----a-w- c:\users\Mitam\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-19 18:50 . 2008-10-24 07:55 -------- d-----w- c:\programdata\NVIDIA
2009-06-19 18:03 . 2008-07-14 02:57 -------- d-----w- c:\programdata\Microsoft Help
2009-06-19 18:00 . 2008-07-14 02:55 -------- d-----w- c:\program files\Microsoft Works
2009-06-19 06:03 . 2008-10-24 07:57 13025 ----a-w- c:\users\Mitam\AppData\Roaming\nvModes.dat
2009-06-17 04:45 . 2009-06-17 04:45 -------- d-----w- c:\program files\Microsoft Silverlight
2009-06-16 06:35 . 2009-06-16 06:35 97144 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\ie_bin\MovePlayerUpgrade.exe
2009-06-10 22:05 . 2008-10-24 06:58 -------- d-----w- c:\users\Mitam\AppData\Roaming\LimeWire
2009-06-09 17:00 . 2009-06-02 19:58 -------- d-----w- c:\programdata\FLEXnet
2009-06-02 19:54 . 2008-07-14 03:17 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-02 19:50 . 2009-06-02 19:50 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-06-02 19:50 . 2009-06-02 19:50 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-09 05:50 . 2009-06-19 18:18 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-09 05:34 . 2009-06-19 18:18 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-04-23 12:43 . 2009-06-11 06:46 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-23 12:42 . 2009-06-11 06:46 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-12 19:30 . 2008-10-24 06:03 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Mitam^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Mitam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{9D7A51B4-1ADE-4856-B496-3C398698BF01}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{80DD3954-7E43-49A8-A599-BD740C0EACDE}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{73F8EB6E-7E17-4725-9182-B38B7283DA0C}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{A7DB3633-1AA8-4129-8FC4-53D2B15DDCBD}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{859BFBF2-8299-4F19-8F89-638C280BC252}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{56C3BF16-0580-478A-9DB5-C2D10146020E}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{5E8A0479-9B27-452D-AAEC-37D0C4F6AFC8}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{17E010E9-F214-46EB-ADB8-593154CA519E}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{606E5035-9832-4170-9280-9B9B79044CE1}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{19373767-1236-480A-8416-4909E02376F1}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{0D5F17B6-FB99-4C45-8A27-095A18602B7C}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{0F232F3B-E633-456A-8794-0C458C5DAA85}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{DBBD76F9-6810-40BC-A156-BCA1C7CC0F7B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{9F6F4509-14D8-4693-8582-7B5AE64F6B48}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{AF7C0D04-74D2-4711-ACB9-203BFFE75E6B}c:\\program files\\vuze\\azureus.exe"= UDP:c:\program files\vuze\azureus.exe:Azureus
"UDP Query User{577555FB-3FBC-4F43-84F1-406D41ACFE61}c:\\program files\\vuze\\azureus.exe"= TCP:c:\program files\vuze\azureus.exe:Azureus
"{DE4314D7-2351-4345-A1BA-A4400E245E94}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{0BD380BC-B3EB-4564-9A6F-1FF263735333}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{5518BBB3-AFFE-4D97-9DDC-D1FDA0DEDF5A}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{374C5C6B-D5E9-4FF4-8301-01D549041FF7}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III
"{CDF50E01-77A5-4FF1-A8DF-4D0089D9D37B}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{7485E0E5-5A0B-4C0B-9D2E-C13AA7AA1316}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{F81C8404-E972-4213-816F-9D2AC8D95575}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{501D2856-05FC-487B-9686-11011CDB682A}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{E5AFD565-800F-4FF1-B3CF-F65F9A4F1A09}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{969F0BA1-AA22-46AF-96B8-C33449FB0BB5}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"TCP Query User{A3B9F169-42F4-4A8E-9E6A-A9B4CC9A990D}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{B3B4CA29-05CC-47A8-843E-6284A9DF4ABF}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{73DA009F-4370-4D31-8E5C-2D4A8E13CAF7}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B3535CEF-7740-4B21-8FC9-269A4EE51717}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{441013F6-DEB1-4C4E-B611-8DDD4A2D6E40}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{51CAFA8E-73A8-4220-A3AD-FD729A765304}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{91644312-00F8-41DA-925B-D15DC7A41F48}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CB4A6135-FC6A-4645-B657-40DA3D9471A4}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C79DB1F1-7277-4487-9F8B-0ADE5C9EB14A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F6405534-88E5-4EA2-9698-01D75031CC00}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B11E90E3-0245-4E8C-B22C-7D51C1748B0F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{352DB064-03A4-40E8-8A34-774910FA7BBA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{11420C5A-AC8E-4FA4-9A2A-B09D2113ED9E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6C659DDF-DBB2-40E4-BD24-65181AA1835A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6210DD36-0D54-481E-BCD7-28B50923CAD1}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{8AB07A11-330B-446A-A638-C7FB7BFDC22F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{3785C76A-AA33-443C-9447-CE2A4A5AA3DE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{0465D557-C130-4C98-B986-671BCBC96E83}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{571A3EC3-FEEC-4EF9-91D6-226076CE6DAA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{96119DC4-3517-409C-BD3A-B4AE2510F6DC}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{608EAB65-E4A8-4B61-887B-8D7939DE4955}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{FC525F68-15FD-4412-83AF-41B62F7E3A88}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{8A4B07E3-F3C8-4B7E-8A3B-89BC5B675F24}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EAACC13B-D578-43AD-BE37-CBF2D1E8632D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EACA67FC-9A53-4B47-BEEF-98DCAF9255E7}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B269906B-3804-469B-93AA-74BE7B4FE88D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6F62F350-7962-4A39-AB7D-23E8DB5654EE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F2A5861F-37D8-4B75-8D5A-BFB43F7FA6BD}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A760EAAA-D37C-432C-B71A-E9046ED64450}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{26A6B476-0055-4021-851B-CF2FD0B8BB17}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1C8C36E5-A389-4843-AAF0-480023103836}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C8BC1E25-FDC3-4285-9D8F-15AD5B985C43}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1DE5C24D-6790-4B79-9471-11A836398E98}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A3F35C3A-DE3D-4204-AE6B-35A73B6D2A91}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EEA1B18F-5CB6-47F6-8692-9CC6360CC4DF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F230D5BC-21BE-4F5B-B6E6-E3BDE32DE202}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{7F645FE1-5621-481E-A6F0-29E43299D856}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B1E6354F-15D5-4C49-9D42-0D3DE86E68EB}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{D9E1E4BF-2807-4F0E-B3FE-7D9AC37F2B6F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{32CEC970-7B9D-4C97-AD99-36F62F2F027A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CF28384C-A20B-4379-AF2C-72754BB16B5C}"= c:\program files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 5:45 AM 13088]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [8/2/2005 4:10 PM 32512]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/29/2008 3:05 PM 24652]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27085
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 20th July 2009, 6:20 pm

------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Mitam\AppData\Roaming\Mozilla\Firefox\Profiles\r1utmayd.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\users\Mitam\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-07-20 13:07
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-07-20 13:10
ComboFix-quarantined-files.txt 2009-07-20 18:10

Pre-Run: 43,290,333,184 bytes free
Post-Run: 43,300,876,288 bytes free

388 --- E O F --- 2009-07-20 17:31

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27085
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 21st July 2009, 5:55 pm

Now open a new notepad file.
Input this into the notepad file:

Folder::
c:\program files\LimeWire
c:\programdata\Viewpoint

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{AF7C0D04-74D2-4711-ACB9-203BFFE75E6B}c:\\program files\\vuze\\azureus.exe"=-
"UDP Query User{577555FB-3FBC-4F43-84F1-406D41ACFE61}c:\\program files\\vuze\\azureus.exe"=-
"{DE4314D7-2351-4345-A1BA-A4400E245E94}"=-
"{0BD380BC-B3EB-4564-9A6F-1FF263735333}"=-


Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31513
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 21st July 2009, 7:16 pm

ComboFix 09-07-20.05 - Mitam 07/21/2009 14:06.4.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1982.1077 [GMT -5:00]
Running from: c:\users\Mitam\Desktop\Combo-Fix.exe
Command switches used :: c:\users\Mitam\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\LimeWire
c:\program files\LimeWire\clink.jar
c:\program files\LimeWire\commons-httpclient.jar
c:\program files\LimeWire\commons-logging.jar
c:\program files\LimeWire\commons-net.jar
c:\program files\LimeWire\COPYING
c:\program files\LimeWire\daap.jar
c:\program files\LimeWire\data.ser
c:\program files\LimeWire\donotremove.htm
c:\program files\LimeWire\GenericWindowsUtils.dll
c:\program files\LimeWire\hashes
c:\program files\LimeWire\hs_err_pid3624.log
c:\program files\LimeWire\hs_err_pid3920.log
c:\program files\LimeWire\hs_err_pid3984.log
c:\program files\LimeWire\hs_err_pid4072.log
c:\program files\LimeWire\i18n.jar
c:\program files\LimeWire\icu4j.jar
c:\program files\LimeWire\id3v2.jar
c:\program files\LimeWire\install.log
c:\program files\LimeWire\jcraft.jar
c:\program files\LimeWire\jl011.jar
c:\program files\LimeWire\jmdns.jar
c:\program files\LimeWire\language.prop
c:\program files\LimeWire\LimeWire On Startup.lnk
c:\program files\LimeWire\LimeWire.exe
c:\program files\LimeWire\LimeWire.ico
c:\program files\LimeWire\LimeWire.jar
c:\program files\LimeWire\LimeWire20.dll
c:\program files\LimeWire\log4j.jar
c:\program files\LimeWire\log4j.properties
c:\program files\LimeWire\looks.jar
c:\program files\LimeWire\MessagesBundle.properties
c:\program files\LimeWire\MessagesBundles.jar
c:\program files\LimeWire\mp3sp14.jar
c:\program files\LimeWire\pmf.ico
c:\program files\LimeWire\ProgressTabs.jar
c:\program files\LimeWire\root\magnet10\badge.img
c:\program files\LimeWire\root\magnet10\canHandle.img
c:\program files\LimeWire\root\magnet10\limewire.gif
c:\program files\LimeWire\root\magnet10\options.js
c:\program files\LimeWire\root\magnet10\silentdetect.js
c:\program files\LimeWire\SOURCE
c:\program files\LimeWire\spacer.gif
c:\program files\LimeWire\themes.jar
c:\program files\LimeWire\tritonus.jar
c:\program files\LimeWire\uninstall.exe
c:\program files\LimeWire\update.ver
c:\program files\LimeWire\vorbis.jar
c:\program files\LimeWire\WindowsFirewall.dll
c:\program files\LimeWire\WindowsV5PlusUtils.dll
c:\program files\LimeWire\xerces.jar
c:\program files\LimeWire\xml-apis.jar
c:\program files\LimeWire\xml.war
c:\programdata\Viewpoint

.
((((((((((((((((((((((((( Files Created from 2009-06-21 to 2009-07-21 )))))))))))))))))))))))))))))))
.

2009-07-21 19:12 . 2009-07-21 19:12 -------- d-----w- c:\users\Mitam\AppData\Local\temp
2009-07-21 19:12 . 2009-07-21 19:12 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2009-07-21 00:19 . 2008-12-03 05:41 38200 ----a-w- c:\users\Mitam\AppData\Roaming\Macromedia\Flash Player\[You must be registered and logged in to see this link.]
2009-07-18 19:02 . 2009-07-18 19:02 3775176 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-18 19:00 . 2009-07-18 19:00 -------- d-----w- C:\_OTM
2009-07-16 14:34 . 2009-06-15 15:24 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-16 14:34 . 2009-06-15 15:20 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-16 14:34 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-16 14:34 . 2009-06-15 12:52 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-07-12 23:47 . 2009-07-12 23:52 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-12 23:47 . 2009-07-12 23:47 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-07-11 19:08 . 2009-07-11 19:08 -------- d-----w- c:\users\Mitam\AppData\Roaming\Malwarebytes
2009-07-11 19:07 . 2009-07-13 18:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-11 19:07 . 2009-07-18 19:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-11 19:07 . 2009-07-13 18:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-11 19:07 . 2009-07-11 19:07 -------- d-----w- c:\programdata\Malwarebytes
2009-07-11 19:02 . 2009-07-11 19:02 680 ----a-w- c:\users\Mitam\AppData\Local\d3d9caps.dat
2009-07-10 04:30 . 2009-07-10 04:30 127872 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\uninstall.exe
2009-07-10 04:30 . 2009-07-10 04:31 -------- d-----w- c:\users\Mitam\AppData\Roaming\Move Networks
2009-07-09 15:45 . 2009-07-09 15:45 81 ----a-w- C:\CTX.DAT
2009-07-09 15:45 . 2009-07-09 15:45 -------- d-----w- c:\users\Mitam\Citrix
2009-07-08 08:20 . 2009-07-08 08:20 -------- d-----w- c:\program files\AviSynth 2.5
2009-07-08 08:20 . 2009-07-08 08:20 -------- d-----w- c:\program files\Red Kawa
2009-07-08 08:18 . 2009-07-08 08:18 -------- d-----w- c:\users\Mitam\AppData\Roaming\AVS4YOU
2009-07-08 08:18 . 2009-07-08 08:18 -------- d-----w- c:\programdata\AVS4YOU
2009-07-08 08:17 . 2009-07-08 08:18 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-07-08 08:17 . 2008-08-13 16:22 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-07-08 08:17 . 2009-07-08 08:20 -------- d-----w- c:\program files\AVS4YOU
2009-07-08 08:17 . 2008-08-13 16:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2009-07-08 08:17 . 2008-08-13 16:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2009-06-25 17:30 . 2009-06-25 17:40 4506256 ----a-w- c:\users\Mitam\AppData\Roaming\LimeWire\.NetworkShare\LimeWireWin4.16.6.exe
2009-06-24 23:02 . 2009-06-24 23:02 -------- d-----w- c:\users\Mitam\AppData\Roaming\acccore
2009-06-24 23:01 . 2009-06-24 23:01 -------- d-----w- c:\users\Mitam\AppData\Local\AOL OCP
2009-06-24 23:00 . 2009-06-24 23:00 -------- d-----w- c:\programdata\acccore
2009-06-24 22:59 . 2009-06-24 23:00 -------- d-----w- c:\program files\AIM6
2009-06-24 16:03 . 2009-06-24 19:00 -------- d-----w- c:\program files\CamStudio
2009-06-23 19:38 . 2009-06-23 19:41 -------- d-----w- c:\users\Mitam\AppData\Roaming\Pamela
2009-06-23 19:38 . 2009-06-23 19:38 176128 ----a-w- c:\windows\system32\RemoteControl.dll
2009-06-23 19:38 . 2009-06-23 19:38 -------- d-----w- c:\program files\Pamela
2009-06-23 18:50 . 2009-06-23 18:50 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-06-23 18:50 . 2009-07-11 18:24 -------- d-----w- c:\users\Mitam\AppData\Roaming\skypePM
2009-06-23 18:48 . 2009-07-10 21:27 -------- d-----w- c:\users\Mitam\AppData\Roaming\Skype
2009-06-23 18:48 . 2009-06-23 18:48 -------- d-----w- c:\program files\Common Files\Skype
2009-06-23 18:48 . 2009-06-23 18:48 -------- d-----r- c:\program files\Skype
2009-06-23 18:47 . 2009-06-23 18:48 -------- d-----w- c:\programdata\Skype

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-21 18:59 . 2009-06-19 17:54 55918 ----a-w- c:\programdata\nvModes.dat
2009-07-21 15:50 . 2009-02-07 15:53 12 ----a-w- c:\windows\bthservsdp.dat
2009-07-16 14:42 . 2008-10-24 06:14 -------- d-----w- c:\users\Mitam\AppData\Roaming\Azureus
2009-07-12 06:32 . 2008-10-24 07:42 -------- d-----w- c:\program files\Warcraft III
2009-07-10 04:30 . 2009-06-16 06:35 4183416 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
2009-06-24 22:59 . 2008-10-29 20:05 -------- d-----w- c:\program files\Common Files\AOL
2009-06-20 08:02 . 2008-10-24 03:34 76984 ----a-w- c:\users\Mitam\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-19 18:50 . 2008-10-24 07:55 -------- d-----w- c:\programdata\NVIDIA
2009-06-19 18:03 . 2008-07-14 02:57 -------- d-----w- c:\programdata\Microsoft Help
2009-06-19 18:00 . 2008-07-14 02:55 -------- d-----w- c:\program files\Microsoft Works
2009-06-19 06:03 . 2008-10-24 07:57 13025 ----a-w- c:\users\Mitam\AppData\Roaming\nvModes.dat
2009-06-17 04:45 . 2009-06-17 04:45 -------- d-----w- c:\program files\Microsoft Silverlight
2009-06-16 06:35 . 2009-06-16 06:35 97144 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\ie_bin\MovePlayerUpgrade.exe
2009-06-10 22:05 . 2008-10-24 06:58 -------- d-----w- c:\users\Mitam\AppData\Roaming\LimeWire
2009-06-09 17:00 . 2009-06-02 19:58 -------- d-----w- c:\programdata\FLEXnet
2009-06-02 19:54 . 2008-07-14 03:17 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-02 19:50 . 2009-06-02 19:50 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-06-02 19:50 . 2009-06-02 19:50 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-09 05:50 . 2009-06-19 18:18 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-09 05:34 . 2009-06-19 18:18 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-04-23 12:43 . 2009-06-11 06:46 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-23 12:42 . 2009-06-11 06:46 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-12 19:30 . 2008-10-24 06:03 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((( [You must be registered and logged in to see this link.] )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-20 16:20 . 2009-07-20 16:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-07-21 16:17 . 2009-07-21 16:17 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-07-21 16:17 . 2009-07-21 16:17 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-20 16:20 . 2009-07-20 16:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
.

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27085
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 21st July 2009, 7:16 pm

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Mitam^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Mitam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{9D7A51B4-1ADE-4856-B496-3C398698BF01}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{80DD3954-7E43-49A8-A599-BD740C0EACDE}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{73F8EB6E-7E17-4725-9182-B38B7283DA0C}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{A7DB3633-1AA8-4129-8FC4-53D2B15DDCBD}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{859BFBF2-8299-4F19-8F89-638C280BC252}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{56C3BF16-0580-478A-9DB5-C2D10146020E}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{5E8A0479-9B27-452D-AAEC-37D0C4F6AFC8}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{17E010E9-F214-46EB-ADB8-593154CA519E}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{606E5035-9832-4170-9280-9B9B79044CE1}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{19373767-1236-480A-8416-4909E02376F1}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{0D5F17B6-FB99-4C45-8A27-095A18602B7C}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{0F232F3B-E633-456A-8794-0C458C5DAA85}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{DBBD76F9-6810-40BC-A156-BCA1C7CC0F7B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{9F6F4509-14D8-4693-8582-7B5AE64F6B48}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{5518BBB3-AFFE-4D97-9DDC-D1FDA0DEDF5A}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{374C5C6B-D5E9-4FF4-8301-01D549041FF7}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III
"{CDF50E01-77A5-4FF1-A8DF-4D0089D9D37B}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{7485E0E5-5A0B-4C0B-9D2E-C13AA7AA1316}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{F81C8404-E972-4213-816F-9D2AC8D95575}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{501D2856-05FC-487B-9686-11011CDB682A}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{E5AFD565-800F-4FF1-B3CF-F65F9A4F1A09}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{969F0BA1-AA22-46AF-96B8-C33449FB0BB5}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"TCP Query User{A3B9F169-42F4-4A8E-9E6A-A9B4CC9A990D}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{B3B4CA29-05CC-47A8-843E-6284A9DF4ABF}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{73DA009F-4370-4D31-8E5C-2D4A8E13CAF7}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B3535CEF-7740-4B21-8FC9-269A4EE51717}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{441013F6-DEB1-4C4E-B611-8DDD4A2D6E40}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{51CAFA8E-73A8-4220-A3AD-FD729A765304}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{91644312-00F8-41DA-925B-D15DC7A41F48}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CB4A6135-FC6A-4645-B657-40DA3D9471A4}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C79DB1F1-7277-4487-9F8B-0ADE5C9EB14A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F6405534-88E5-4EA2-9698-01D75031CC00}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B11E90E3-0245-4E8C-B22C-7D51C1748B0F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{352DB064-03A4-40E8-8A34-774910FA7BBA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{11420C5A-AC8E-4FA4-9A2A-B09D2113ED9E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6C659DDF-DBB2-40E4-BD24-65181AA1835A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6210DD36-0D54-481E-BCD7-28B50923CAD1}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{8AB07A11-330B-446A-A638-C7FB7BFDC22F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{3785C76A-AA33-443C-9447-CE2A4A5AA3DE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{0465D557-C130-4C98-B986-671BCBC96E83}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{571A3EC3-FEEC-4EF9-91D6-226076CE6DAA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{96119DC4-3517-409C-BD3A-B4AE2510F6DC}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{608EAB65-E4A8-4B61-887B-8D7939DE4955}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{FC525F68-15FD-4412-83AF-41B62F7E3A88}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{8A4B07E3-F3C8-4B7E-8A3B-89BC5B675F24}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EAACC13B-D578-43AD-BE37-CBF2D1E8632D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EACA67FC-9A53-4B47-BEEF-98DCAF9255E7}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B269906B-3804-469B-93AA-74BE7B4FE88D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6F62F350-7962-4A39-AB7D-23E8DB5654EE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F2A5861F-37D8-4B75-8D5A-BFB43F7FA6BD}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A760EAAA-D37C-432C-B71A-E9046ED64450}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{26A6B476-0055-4021-851B-CF2FD0B8BB17}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1C8C36E5-A389-4843-AAF0-480023103836}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C8BC1E25-FDC3-4285-9D8F-15AD5B985C43}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1DE5C24D-6790-4B79-9471-11A836398E98}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A3F35C3A-DE3D-4204-AE6B-35A73B6D2A91}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EEA1B18F-5CB6-47F6-8692-9CC6360CC4DF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F230D5BC-21BE-4F5B-B6E6-E3BDE32DE202}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{7F645FE1-5621-481E-A6F0-29E43299D856}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B1E6354F-15D5-4C49-9D42-0D3DE86E68EB}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{D9E1E4BF-2807-4F0E-B3FE-7D9AC37F2B6F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{32CEC970-7B9D-4C97-AD99-36F62F2F027A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CF28384C-A20B-4379-AF2C-72754BB16B5C}"= c:\program files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 5:45 AM 13088]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [8/2/2005 4:10 PM 32512]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/29/2008 3:05 PM 24652]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
mStart Page = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Mitam\AppData\Roaming\Mozilla\Firefox\Profiles\r1utmayd.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\users\Mitam\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-07-21 14:12
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-07-21 14:14
ComboFix-quarantined-files.txt 2009-07-21 19:14
ComboFix2.txt 2009-07-20 18:10

Pre-Run: 42,932,330,496 bytes free
Post-Run: 42,905,620,480 bytes free

308 --- E O F --- 2009-07-20 17:31

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27085
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 21st July 2009, 7:17 pm

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31513
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 21st July 2009, 7:28 pm

Malwarebytes' Anti-Malware 1.39
Database version: 2475
Windows 6.0.6001 Service Pack 1

7/21/2009 2:27:40 PM
mbam-log-2009-07-21 (14-27-40).txt

Scan type: Quick Scan
Objects scanned: 78181
Time elapsed: 3 minute(s), 20 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Smile

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27085
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 21st July 2009, 7:31 pm

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31513
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 22nd July 2009, 1:53 am

I don't know if it's because of the virus or something else, but my Internet seems to be running very slow.
Alot slower than usual

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27085
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 23rd July 2009, 6:54 pm


  • Open HijackThis.
  • When Hijack This opens, click "Open the Misc Tools section"
  • Then select "Open Uninstall Manager"
  • Click on "Save List..." (generates uninstall_list.txt)
  • Click Save, copy and paste the results in your next post.


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31513
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by mitam101 on 23rd July 2009, 8:04 pm

32 Bit HP CIO Components Installer
Adobe AIR
Adobe AIR
Adobe Anchor Service CS4
Adobe Captivate 4
Adobe Captivate 4
Adobe Captivate Reviewer 1.0
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Help Viewer 2
Adobe Reader 8
Adobe Setup
Adobe Update Manager CS4
AIM 6
AnswerWorks 5.0 English Runtime
Apple Mobile Device Support
Apple Software Update
Articulate Studio '09 Pro
AviSynth 2.5
Bonjour
CamStudio
Conexant HD Audio
dBpoweramp FLAC Codec
ESU for Microsoft Vista
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Active Support Library 32 bit components
HP Customer Experience Enhancements
HP Easy Setup - Frontend
HP Help and Support
HP Pavilion Webcam Driver for Vista v061.001.00005
HP Photosmart All-In-One Software 9.0
HP Photosmart Essential 2.0
HP Quick Launch Buttons 6.20 B1
HP QuickPlay 3.2
HP Total Care Advisor
HP Update
HP User Guides 0041
HP Wireless Assistant
HPNetworkAssistant
iTunes
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6
LimeWire PRO 4.12.4
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server Compact 3.5 ENU
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.12)
MP3 Player Utilities 4.19
MSCU for Microsoft Vista
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 Parser and SDK
NVIDIA Drivers
Pamela Pro 4.5
PocketNester
QuickTime
Recover Files 2.1
Rhapsody Player Engine
Roxio Activation Module
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office Word 2007 (KB969604)
Skype™ 4.0
Soft Data Fax Modem with SmartCP
Spybot - Search & Destroy
Suite Shared Configuration CS4
Synaptics Pointing Device Driver
System Requirements Lab
TurboTax 2008
TurboTax 2008 wiliper
TurboTax 2008 WinPerFedFormset
TurboTax 2008 WinPerProgramHelp
TurboTax 2008 WinPerReleaseEngine
TurboTax 2008 WinPerTaxSupport
TurboTax 2008 WinPerUserEducation
TurboTax 2008 wrapper
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
VDMSound 2.0.4
Videora iPod Converter 4.08
Viewpoint Media Player
VLC media player 0.9.4
Vuze
Warcraft III
WavePad Sound Editor
WC3Banlist
Windows Mobile Device Center
Windows Mobile Device Center Driver Update
WinPcap 3.1
WinRAR archiver
Yahoo! Messenger

mitam101
Novice
Novice

Posts Posts : 23
Joined Joined : 2009-07-13
OS OS : Windows Vista
Points Points : 27085
# Likes # Likes : 0

View user profile

Back to top Go down

Re: System Security 2009, half removed

Post by Origin on 23rd July 2009, 8:48 pm

I see that you are running Limewire.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

If Limewire is not removed, then I won't help you.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

  • Limewire
  • Java(TM) 6 Update 7
  • Java(TM) SE Runtime Environment 6
  • LimeWire PRO 4.12.4
  • Viewpoint Media Player
  • Vuze


There is a new version of Firefox out, version 3.5.1, please download it here:
[You must be registered and logged in to see this link.]

Did that fix your problem?


While my help is always free, please consider donating to keep this site alive: [You must be registered and logged in to see this link.]

[You must be registered and logged in to see this link.]

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31513
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum