I have a Compaq Presario C700 desktop, about 3 months old. About a week ago, I came back to my room after being gone for the day and the screen was black. Nothing responded, so I powered it down. I powered it back up, and the fan would run at a high speed for about 2-3 seconds, but then nothing. Same result after trying a few more times. Took the battery out, waited, put it back in, and it booted fine. Since then, there has been about 4-5 times where my computer will freeze. Usually it's once it has been idle for a while. I'll come back and discover nothing works. The screen goes to black, then the single gray cursor appears in the top left as if it's re-booting. Sometimes it re-boots (slowly) and sometimes it just sits at black and I have to power down and re-boot. This is getting quite annoying. Norton finds nothing wrong with the computer. Is this some sort of virus or infection? Or do I have a bad computer and I should take it back?
Also, about a month ago I started getting a message on start up that something was wrong with a DLL file. Tried Registry Mechanic, to no avail. I still get the message every time I restart.
Hi h0tb0y2k1 Before we begin the cleanup process, it is important to do a little analysis first. We will analyze your computer with a tool called HijackThis. Please download the HijackThis zip file. Save it onto a convenient place in your computer, and then unzip the file. Rename HijackThis(.exe) to scanner(.exe). Next, run scanner(.exe). A window will pop up. • Click on the button which says Main Menu, then Do a system scan and save a logfile. • Please wait for the scan to be completed. • After the scan has completed, a text window will pop up. Please post the contents of this window here. This will also be located at hijackthis(.txt) in the same folder that HijackThis was originally saved. NOTE:: Do not fix anything using HijackThis, as this may also damage legitimate components of your computer. Best Regards
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:52:10, on 26/11/2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe C:\Program Files\HP\QuickPlay\QPService.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\AIM6\aim6.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\ehome\ehtray.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Windows Media Player\wmplayer.exe C:\Windows\system32\taskeng.exe C:\Windows\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Windows\system32\SearchFilterHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Presario&pf=laptop R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cnn.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Presario&pf=laptop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_gb&c=81&bd=Presario&pf=laptop R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file) O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: HP Print Clips - {FFFFFFFF-FF12-44C5-91EC-068E3AA1B2D7} - c:\Program Files\HP\Smart Web Printing\hpswp_framework.dll O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file) O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp /HIDEBL O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Ben\AppData\Local\Temp\byXNeCtq.dll,#1 O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-GB\local\search.html O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll O9 - Extra button: HP Smart Select - {58ECB495-38F0-49cb-A538-10282ABF65E7} - c:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O13 - Gopher Prefix: O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe O23 - Service: Basics Service - Seagate Technology LLC - C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 11539 bytes
Hey h0tb0y2k1 Please download Malwarebytes Anti-Malware and install it. Follow the prompts and reboot if required. Launch Malwarebytes either by running C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe or double-click the Malwarebytes' Anti-Malware shortcut on your Desktop. Configuring Malwarebytes • Click on the tab Settings. • Make sure only these boxes are checked: Code: Terminate Internet Explorer Automatically save and display logfile after removal Always scan memory objects Always scan registry objects Always scan filesystem Always scan extra and heuristics objects Updating Malwarebytes • Click on the tab Update. • Press the button Check for Updates • Wait for Malwarebytes to be fully updated. Scanning Time • Click on the tab Scanner. • Check Perform full scan and click on Scan • Wait for the scan to complete, and then click on Show Results. • Make sure all items are checked, then click on Remove Selected. **If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If you are asked to restart the computer, please do so immediately. Post A Log • A text box will pop up after the removal process is over. Post the contents of the text here. • If no text box pops up, launch Malwarebytes, and click on the tab Logs. • The logs will appear as mbam-log-*date-*time.txt. Select the latest one, and then click on Open. • Post the log here. Best Regards
Malwarebytes' Anti-Malware 1.30 Database version: 1434 Windows 6.0.6001 Service Pack 1 29/11/2008 18:42:59 mbam-log-2008-11-29 (18-42-59).txt Scan type: Full Scan (C:\|D:\|E:\|F:\|H:\|) Objects scanned: 245780 Time elapsed: 2 hour(s), 49 minute(s), 52 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
Hey h0tb0y2k1 Now, please download ComboFix. With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it. Save it to your Desktop. Please disable all security programs, such as antiviruses, antispywares, and firewalls. • Run Combo-Fix.exe and follow the prompts. • Accept the End-User License Agreement. • Allow the Recovery Console to be installed. • When you see the window below, click on Yes. • When the Recovery Console has been installed, click on Yes to start the scan. **Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later. • Wait for the scan to be fully completed. • If it requires a reboot, please do so. • After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt) Do not click on the ComoboFix window, as it may cause it to stall. Best Regards
FYI - I did not get any of the prompts you mentioned in your last post, it went right in to a scan... ComboFix 08-11-29.03 - Ben 2008-11-30 12:56:08.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.836 [GMT 0:00] Running from: c:\users\Ben\Desktop\Combo-Fix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\KBL.LOG H:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-10-28 to 2008-11-30 ))))))))))))))))))))))))))))))) . 2008-11-29 12:20 . 2008-11-29 12:20 <DIR> d-------- c:\users\Ben\AppData\Roaming\DivX 2008-11-29 12:18 . 2008-11-29 15:39 <DIR> d-------- c:\program files\DivX 2008-11-27 16:45 . 2008-11-27 16:45 <DIR> d-------- c:\users\Ben\AppData\Roaming\Malwarebytes 2008-11-27 16:45 . 2008-11-27 16:45 <DIR> d-------- c:\users\All Users\Malwarebytes 2008-11-27 16:45 . 2008-11-27 16:45 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2008-11-27 16:45 . 2008-11-27 16:45 <DIR> d-------- c:\progra~2\Malwarebytes 2008-11-27 16:45 . 2008-10-22 16:10 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys 2008-11-27 16:45 . 2008-10-22 16:10 15,504 --a------ c:\windows\System32\drivers\mbam.sys 2008-11-26 10:37 . 2008-10-21 05:25 1,645,568 --a------ c:\windows\System32\connect.dll 2008-11-26 10:37 . 2008-08-28 03:40 712,704 --a------ c:\windows\System32\WindowsCodecs.dll 2008-11-26 10:37 . 2008-08-28 03:40 425,472 --a------ c:\windows\System32\PhotoMetadataHandler.dll 2008-11-26 10:37 . 2008-08-28 03:40 347,136 --a------ c:\windows\System32\WindowsCodecsExt.dll 2008-11-26 10:37 . 2008-10-22 03:57 241,152 --a------ c:\windows\System32\PortableDeviceApi.dll 2008-11-26 09:51 . 2008-11-26 09:51 <DIR> d-------- c:\program files\Trend Micro 2008-11-24 18:49 . 2008-11-24 18:49 227,908,516 --a------ c:\windows\MEMORY.DMP 2008-11-24 14:47 . 2008-11-24 14:47 <DIR> d-------- c:\program files\ffdshow 2008-11-24 14:47 . 2006-10-02 13:44 5,120 --a------ c:\windows\System32\ff_vfw.dll 2008-11-24 14:47 . 2006-08-05 12:06 547 --a------ c:\windows\System32\ff_vfw.dll.manifest 2008-11-23 16:23 . 2008-11-23 16:23 <DIR> d-------- c:\windows\Sun 2008-11-23 16:23 . 2008-11-23 16:22 410,976 --a------ c:\windows\System32\deploytk.dll 2008-11-23 15:00 . 2008-10-16 21:13 1,809,944 --a------ c:\windows\System32\wuaueng.dll 2008-11-23 15:00 . 2008-10-16 20:56 1,524,736 --a------ c:\windows\System32\wucltux.dll 2008-11-23 15:00 . 2008-10-16 21:09 51,224 --a------ c:\windows\System32\wuauclt.exe 2008-11-23 15:00 . 2008-10-16 21:09 43,544 --a------ c:\windows\System32\wups2.dll 2008-11-23 14:59 . 2008-10-16 14:08 162,064 --a------ c:\windows\System32\wuwebv.dll 2008-11-23 14:59 . 2008-10-16 13:56 31,232 --a------ c:\windows\System32\wuapp.exe 2008-11-23 14:25 . 2008-11-23 14:25 <DIR> d-------- c:\users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-11-23 14:25 . 2008-11-23 14:25 <DIR> d-------- c:\program files\iTunes 2008-11-23 14:25 . 2008-11-23 14:25 <DIR> d-------- c:\program files\iPod 2008-11-23 14:25 . 2008-11-23 14:25 <DIR> d-------- c:\progra~2\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-11-23 14:22 . 2008-11-23 14:22 <DIR> d-------- c:\program files\QuickTime 2008-11-16 20:19 . 2008-11-16 20:23 <DIR> d-------- c:\program files\Norton AntiVirus 2008-11-16 20:18 . 2008-11-23 04:48 <DIR> d-------- c:\program files\Symantec 2008-11-16 20:18 . 2008-11-23 04:48 123,952 --a------ c:\windows\System32\drivers\SYMEVENT.SYS 2008-11-11 22:00 . 2008-09-05 05:14 1,191,936 --a------ c:\windows\System32\msxml3.dll 2008-11-11 22:00 . 2008-08-27 01:05 212,480 --a------ c:\windows\System32\drivers\mrxsmb10.sys 2008-11-11 21:55 . 2008-09-10 03:40 1,334,272 --a------ c:\windows\System32\msxml6.dll 2008-11-04 10:30 . 2008-11-04 10:30 90,112 --a------ c:\windows\System32\QuickTimeVR.qtx 2008-11-04 10:30 . 2008-11-04 10:30 57,344 --a------ c:\windows\System32\QuickTime.qts 2008-10-31 04:14 . 2008-08-05 09:49 428,544 --a------ c:\windows\System32\EncDec.dll 2008-10-31 04:14 . 2008-08-05 09:49 293,376 --a------ c:\windows\System32\psisdecd.dll 2008-10-31 04:14 . 2008-08-05 09:48 217,088 --a------ c:\windows\System32\psisrndr.ax 2008-10-31 04:14 . 2008-08-05 09:48 177,664 --a------ c:\windows\System32\mpg2splt.ax 2008-10-31 04:14 . 2008-08-05 09:48 80,896 --a------ c:\windows\System32\MSNP.ax 2008-10-29 06:43 . 2008-08-12 03:39 443,392 --a------ c:\windows\System32\win32spl.dll 2008-10-29 06:43 . 2008-09-18 04:56 147,456 --a------ c:\windows\System32\Faultrep.dll 2008-10-29 06:43 . 2008-09-18 04:56 125,952 --a------ c:\windows\System32\wersvc.dll 2008-10-28 22:36 . 2008-10-28 22:36 823,296 --a------ c:\windows\System32\divx_xx0c.dll 2008-10-28 22:36 . 2008-10-28 22:36 823,296 --a------ c:\windows\System32\divx_xx07.dll 2008-10-28 22:35 . 2008-10-28 22:35 815,104 --a------ c:\windows\System32\divx_xx0a.dll 2008-10-28 22:35 . 2008-10-28 22:35 802,816 --a------ c:\windows\System32\divx_xx11.dll 2008-10-28 22:35 . 2008-10-28 22:35 729,088 --a------ c:\windows\System32\divxdec.ax 2008-10-28 22:35 . 2008-10-28 22:35 684,032 --a------ c:\windows\System32\DivX.dll 2008-10-20 00:29 . 2008-10-20 00:29 <DIR> d-------- c:\users\Ben\AppData\Roaming\Apple Computer 2008-10-20 00:28 . 2008-10-20 00:28 <DIR> d----c--- c:\windows\System32\DRVSTORE 2008-10-20 00:28 . 2008-04-17 12:12 107,368 --a------ c:\windows\System32\GEARAspi.dll 2008-10-20 00:28 . 2008-04-17 12:12 15,464 --a------ c:\windows\System32\drivers\GEARAspiWDM.sys 2008-10-20 00:26 . 2008-10-20 00:26 <DIR> d-------- c:\program files\Bonjour 2008-10-20 00:22 . 2008-10-20 00:27 <DIR> d-------- c:\users\All Users\Apple Computer 2008-10-20 00:22 . 2008-10-20 00:27 <DIR> d-------- c:\progra~2\Apple Computer 2008-10-20 00:21 . 2008-10-20 00:21 <DIR> d-------- c:\program files\Apple Software Update 2008-10-20 00:19 . 2008-10-20 00:19 <DIR> d-------- c:\users\All Users\Apple 2008-10-20 00:19 . 2008-11-23 14:25 <DIR> d-------- c:\program files\Common Files\Apple 2008-10-20 00:19 . 2008-10-20 00:19 <DIR> d-------- c:\progra~2\Apple 2008-10-14 21:27 . 2008-10-02 01:32 1,383,424 --a------ c:\windows\System32\mshtml.tlb 2008-10-14 21:27 . 2008-10-02 03:49 827,392 --a------ c:\windows\System32\wininet.dll 2008-10-14 21:26 . 2008-09-18 02:16 2,032,640 --a------ c:\windows\System32\win32k.sys 2008-10-14 21:21 . 2008-09-18 05:09 3,601,464 --a------ c:\windows\System32\ntkrnlpa.exe 2008-10-14 21:21 . 2008-09-18 05:09 3,549,240 --a------ c:\windows\System32\ntoskrnl.exe 2008-10-14 21:21 . 2008-08-27 01:06 288,768 --a------ c:\windows\System32\drivers\srv.sys 2008-10-11 16:57 . 2008-10-11 16:57 <DIR> d-------- c:\users\All Users\FLEXnet 2008-10-11 16:57 . 2008-10-11 16:57 <DIR> d-------- c:\progra~2\FLEXnet 2008-10-11 16:41 . 2008-10-11 16:41 <DIR> d-------- c:\program files\Common Files\Macrovision Shared 2008-10-11 16:31 . 2008-09-19 21:57 120,056 --------- c:\windows\System32\pxcpyi64.exe 2008-10-11 16:31 . 2008-09-19 21:57 118,520 --------- c:\windows\System32\pxinsi64.exe 2008-10-11 16:29 . 2008-10-11 16:29 209 --a------ c:\windows\ODBCINST.INI 2008-10-11 16:20 . 2008-10-11 16:20 <DIR> d-------- c:\program files\PowerISO 2008-10-10 19:04 . 2004-08-04 07:00 506,368 --a------ c:\windows\System32\msxml.dll 2008-10-10 18:41 . 2008-10-10 18:47 <DIR> d-------- c:\program files\RegistryCure 2008-10-09 19:10 . 2008-10-09 19:10 <DIR> d-------- c:\users\Not Ben\AppData\Roaming\Symantec 2008-10-09 19:09 . 2008-10-09 19:09 <DIR> dr------- c:\users\Not Ben\Searches 2008-10-09 19:09 . 2008-10-09 19:09 <DIR> dr------- c:\users\Not Ben\Contacts 2008-10-09 19:08 . 2008-10-09 19:09 <DIR> dr------- c:\users\Not Ben\Videos 2008-10-09 19:08 . 2008-10-09 19:09 <DIR> dr------- c:\users\Not Ben\Saved Games 2008-10-09 19:08 . 2008-10-09 19:09 <DIR> dr------- c:\users\Not Ben\Pictures 2008-10-09 19:08 . 2008-10-09 19:09 <DIR> dr------- c:\users\Not Ben\Music 2008-10-09 19:08 . 2008-10-09 19:09 <DIR> dr------- c:\users\Not Ben\Links 2008-10-09 19:08 . 2008-10-09 19:09 <DIR> dr------- c:\users\Not Ben\Downloads 2008-10-09 19:08 . 2008-10-09 19:09 <DIR> dr------- c:\users\Not Ben\Documents 2008-10-09 19:08 . 2006-11-02 12:37 <DIR> d-------- c:\users\Not Ben\AppData\Roaming\Media Center Programs 2008-10-09 19:08 . 2008-10-09 19:09 <DIR> d--h----- c:\users\Not Ben\AppData 2008-10-09 19:08 . 2008-10-09 19:09 <DIR> d-------- c:\users\Not Ben 2008-10-06 21:53 . 2008-11-30 01:47 <DIR> d-------- c:\program files\Microsoft LifeCam . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-30 12:59 --------- d-----w c:\users\Ben\AppData\Roaming\Skype 2008-11-30 12:54 6,736 ----a-w c:\windows\system32\drivers\PROCEXP90.SYS 2008-11-30 08:05 --------- d-----w c:\users\Ben\AppData\Roaming\skypePM 2008-11-30 02:05 --------- d-----w c:\users\Ben\AppData\Roaming\BitTorrent 2008-11-29 15:38 --------- d-----w c:\program files\Common Files\PX Storage Engine 2008-11-26 00:05 1,150 ----a-w c:\users\Ben\AppData\Roaming\wklnhst.dat 2008-11-24 17:09 --------- d-----w c:\progra~2\Symantec 2008-11-23 16:22 --------- d-----w c:\program files\Java 2008-11-23 14:38 --------- d-----w c:\program files\Common Files\Symantec Shared 2008-11-23 04:48 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF 2008-11-23 04:48 10,671 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT 2008-11-22 03:01 --------- d-----w c:\progra~2\Microsoft Help 2008-11-16 20:23 --------- d-----w c:\users\Ben\AppData\Roaming\Symantec 2008-11-16 19:13 --------- d-----w c:\program files\Norton Internet Security 2008-11-07 12:44 --------- d-----w c:\program files\Common Files\Adobe 2008-10-19 18:34 --------- d-----w c:\users\Ben\AppData\Roaming\Template 2008-10-15 06:15 --------- d-----w c:\users\Ben\AppData\Roaming\DNA 2008-10-15 06:15 --------- d-----w c:\program files\Windows Mail 2008-10-11 19:57 --------- d-----w c:\users\Ben\AppData\Roaming\CyberLink 2008-10-10 18:54 --------- d---a-w c:\progra~2\TEMP 2008-09-30 16:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll 2008-09-25 08:03 81,920 ----a-w c:\windows\System32\dpl100.dll 2008-09-25 08:03 593,920 ----a-w c:\windows\System32\dpuGUI11.dll 2008-09-25 08:03 57,344 ----a-w c:\windows\System32\dpv11.dll 2008-09-25 08:03 53,248 ----a-w c:\windows\System32\dpuGUI10.dll 2008-09-25 08:03 524,288 ----a-w c:\windows\System32\DivXsm.exe 2008-09-25 08:03 344,064 ----a-w c:\windows\System32\dpus11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\System32\dpu11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\System32\dpu10.dll 2008-09-25 08:03 196,608 ----a-w c:\windows\System32\dtu100.dll 2008-09-25 08:03 161,096 ----a-w c:\windows\System32\DivXCodecVersionChecker.exe 2008-09-19 21:57 3,596,288 ----a-w c:\windows\System32\qt-dx331.dll 2008-09-19 21:57 129,784 ------w c:\windows\System32\pxafs.dll 2008-09-19 21:55 200,704 ----a-w c:\windows\System32\ssldivx.dll 2008-09-19 21:55 1,044,480 ----a-w c:\windows\System32\libdivx.dll 2008-09-19 21:54 12,288 ----a-w c:\windows\System32\DivXWMPExtType.dll 2008-09-02 20:53 56 ---ha-w c:\users\All Users\ezsidmv.dat 2008-09-02 20:53 56 ---ha-w c:\progra~2\ezsidmv.dat 2008-08-29 17:18 2,302,017 ----a-w c:\windows\System32\GPhotos.scr 2008-08-29 09:18 87,336 ----a-w c:\windows\System32\dns-sd.exe 2008-08-29 08:53 61,440 ----a-w c:\windows\System32\dnssd.dll 2008-08-04 15:22 185,360 ----a-w c:\windows\System32\LCCoin20.dll 2008-08-02 03:26 36,864 ----a-w c:\windows\System32\cdd.dll 2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-09-23 21755688] "Aim6"="c:\program files\AIM6\aim6.exe" [2007-09-29 50528] "swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-08-29 171448] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-21 c:\windows\System32\oobefldr.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-08-28 141848] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-08-28 154136] "Persistence"="c:\windows\system32\igfxpers.exe" [2007-08-28 137752] "IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712] "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-12-20 468264] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-12-06 202032] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-23 80896] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-09 54840] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-23 136600] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3codecp"= l3codecp.acm [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 "InternetSettingsDisableNotify"=dword:00000001 "AutoUpdateDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{09EF94DC-ACB8-4E2D-B74E-8A2BD7C9154D}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{9D6B7519-1520-48FB-AF26-18D4E4DDEB8C}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader "{5E66FD85-E4DD-4282-A960-63A599574477}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{CB8E5433-1536-41EA-9D39-63612E2C6842}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{DC8556BE-7202-420F-B169-40E21FAF90A1}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector "{152A25A7-DCB2-4DE9-8C34-5C9FCC4F3497}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{2A1A24FA-B14A-4329-987E-390D55A05FCC}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{01CA4C70-B84A-412A-A500-A0FEE55BAFDA}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{B3CF36D9-405C-4A85-A083-EAD92E2B16C1}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{70C37D40-BB13-4C3F-9637-F9C08D8EBAED}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{07F0ED00-9FD9-4691-ACF1-14513B50A265}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl "{4CA02685-BF83-475E-94C3-B674C715B7C0}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play "{21536CD1-554A-41A2-AB92-3FD12BA8B194}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program "{E9123355-C582-4D58-9964-1D204BE66491}"= c:\program files\Skype\Phone\Skype.exe:Skype "{C8AC0DC0-06F9-43C0-A987-D8925CE13F16}"= UDP:c:\program files\AIM6\aim6.exe:AIM "{40B936B6-46DC-401A-B669-359965EE994D}"= TCP:c:\program files\AIM6\aim6.exe:AIM "{F1D8C5D6-DBFB-43F9-BA2B-BE4DC593EC83}"= UDP:c:\program files\DNA\btdna.exeNA (TCP-In) "{A56A559D-EEA9-4C09-9367-763FB3002538}"= TCP:c:\program files\DNA\btdna.exeNA (UDP-In) "TCP Query User{59AE5210-A401-48A9-AEEF-ABFCA84E7FCC}c:\\program files\\bittorrent\\bittorrent.exe"= UDP:c:\program files\bittorrent\bittorrent.exe:µTorrent "UDP Query User{174C764D-6975-4EFE-8E92-4DE7F81DD3DF}c:\\program files\\bittorrent\\bittorrent.exe"= TCP:c:\program files\bittorrent\bittorrent.exe:µTorrent "TCP Query User{0261E056-2D46-4A40-AF9C-F51F0C639980}c:\\users\\ben\\program files\\dna\\btdna.exe"= UDP:c:\users\ben\program files\dna\btdna.exe:btdna.exe "UDP Query User{7A514BD5-66EC-4FFD-9E2C-9E23BCA376E6}c:\\users\\ben\\program files\\dna\\btdna.exe"= TCP:c:\users\ben\program files\dna\btdna.exe:btdna.exe "{9B4F3002-D7E3-4C74-ABAD-067BC932AA8D}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{DE7C25E0-2BB9-4FE5-A9A1-268ABB4230C1}"= UDP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe "{668DFDE0-8E28-40E8-B746-98C342611DCA}"= TCP:c:\program files\Microsoft LifeCam\LifeCam.exe:LifeCam.exe "{48248708-BFA8-4969-9DC9-DEC23351541F}"= UDP:c:\program files\Microsoft LifeCam\LifeEnC2.exe:LifeEnC2.exe "{ED371C9F-9C70-473C-AB05-930FDABBBFFF}"= TCP:c:\program files\Microsoft LifeCam\LifeEnC2.exe:LifeEnC2.exe "{F80A3EBE-2FE6-442F-903B-249E07C8765C}"= UDP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe "{EB166594-2023-4069-B5D1-1A195D3BE8CC}"= TCP:c:\program files\Microsoft LifeCam\LifeExp.exe:LifeExp.exe "{CBE4ABC4-A17F-480A-9934-BD332333A963}"= UDP:c:\program files\Microsoft LifeCam\LifeTray.exe:LifeTray.exe "{8B430CB6-8F80-40FE-8135-C762B6DE0DAB}"= TCP:c:\program files\Microsoft LifeCam\LifeTray.exe:LifeTray.exe "{9E8C5BA0-50E5-4323-87A9-C878544B55D8}"= Disabled:UDP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server "{E29A753E-D8CF-42ED-9C6B-05DD97CFBF59}"= Disabled:TCP:c:\program files\Adobe\Photoshop Elements 6.0\AdobePhotoshopElementsMediaServer.exe:Adobe Photoshop Elements Media Server "{DB8B84E2-AB49-448C-B4B4-8068760C5E84}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{BF9C0007-04D9-41A8-B5A7-7EB2A1CF8426}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{13AE9F55-94A4-4AE6-AEFA-23DAE089D851}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{839E660D-10CA-421F-AAA0-02675A8BCBD7}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List] "c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink "c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent R1 IDSvix86;Symantec Intrusion Prevention Driver;\??\c:\progra~2\Symantec\DEFINI~1\SymcData\ipsdefs\20081127.002\IDSvix86.sys [2008-11-29 270384] R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\program files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [2007-09-10 124832] R2 Basics Service;Basics Service;"c:\program files\Seagate\Basics\Service\SyncServicesBasics.exe" [2007-10-09 124280] R2 LiveUpdate Notice;LiveUpdate Notice;"c:\program files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [2008-01-25 149352] R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" [2008-08-29 24652] R3 MSHUSBVideo;NX6000/NX3000/VX5000/VX5500/VX7000 Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2008-08-04 33808] R3 RTSTOR;USB Mass Storage Device;c:\windows\system32\drivers\RTSTOR.SYS [2008-06-19 56832] R3 SYMNDISV;SYMNDISV;c:\windows\system32\Drivers\SYMNDISV.SYS [2008-06-13 41008] S3 COH_Mon;COH_Mon;\??\c:\windows\system32\Drivers\COH_Mon.sys [2008-01-12 23888] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I] \shell\AutoRun\command - I:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{26e9ae54-73c3-11dd-848a-001eec765f72}] \shell\AutoRun\command - I:\LaunchU3.exe *Newly Created Service* - PROCEXP90 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Common Files\LightScribe\LSRunOnce.exe" . Contents of the 'Scheduled Tasks' folder 2008-11-24 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Ben.job - c:\program files\Norton AntiVirus\Navw32.exe [2008-02-07 06:05] 2008-11-28 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Ben.job - c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [] 2008-11-30 c:\windows\Tasks\User_Feed_Synchronization-{B9BF2E70-DBE2-4254-AE81-49D378F41977}.job - c:\windows\system32\msfeedssync.exe [2008-01-21 02:24] . - - - - ORPHANS REMOVED - - - - HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe HKLM-Run-RegistryMechanic - (no file) . ------- Supplementary Scan ------- . FireFox -: Profile - c:\users\Ben\AppData\Roaming\Mozilla\Firefox\Profiles\oo00sceb.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.cnn.com/ FF -: plugin - c:\program files\DNA\plugins\npbtdna.dll FF -: plugin - c:\program files\Google\Picasa3\npPicasa3.dll FF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll FF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll FF -: plugin - c:\users\Ben\Program Files\DNA\plugins\npbtdna.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-30 12:59:45 Windows 6.0.6001 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... c:\users\Ben\AppData\Local\Temp\catchme.dll 53248 bytes executable scan completed successfully hidden files: 1 ************************************************************************** . Completion time: 2008-11-30 13:01:13 ComboFix-quarantined-files.txt 2008-11-30 13:01:09 Pre-Run: 87,038,930,944 bytes free Post-Run: 87,352,541,184 bytes free 303 --- E O F --- 2008-11-27 03:01:14
Hey h0tb0y2k1 As far as I can see, there's no infection in your computer. Perhaps you can download this program and give it a shot: Advanced Systemcare Best Regards
Hello cdavfrew, After your last message, all appeared to be working normally with my computer, so I figured things had been taken care of and no further action was needed. However, yesterday and today my computer again started acting up in a similar manner to how it was before as I originally described. Here is what happened: I returned to my computer after being away for quite some time. The power scheme had pretty much put the computer on 'stand-by'. I pressed the space bar button to wake the computer up, and when the log-in screen came on, I got only 1-3 letters typed of my password before the keyboard stopped working. At that point, no buttons on the keyboard worked. One of the times I logged in with the on-screen keyboard, the other I did not. Either way, the keyboard continued to be inoperable. I restarted the computer and both times, it did not re-boot. Screen went black, the fan revved at a high speed, then stopped and nothing happened. Both times I had to take the battery out, press the power button down for 10 seconds, put the battery back in, and power up. Computer booted fine after. I'm wondering if you would be willing to run me through the scans of my computer again to see if there might be anything you could see that is causing this, since you are partially familiar with what was going on before? Please let me know.
