Clicking on IE icon opens Firefox.

[mak_20789]

Hi,
I reinstalled XP SP2 and today I downloaded and installed Firefox. But when I click on IE icon (on desktop), Firefox opens. When I use icon from start menu, IE opens.
I am giving my HijackThis log.
Also please tell if my system is up-to-date.
Thank you.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:02:54 AM, on 5/18/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Trend Micro\TrendSecure\SecurityActivityDashboard\tmarsvc.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\ProToolbarUpdate.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\vsnp2std.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Trend Micro\TrendSecure\TSCFCommander.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\TrendSecure\TSCFPlatformCOMSvr.exe
C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\PlatformDependent\ProToolbarComm.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\Shreya\Desktop\HijackThis.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro Toolbar BHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O3 - Toolbar: Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKCU\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
O4 - HKUS\S-1-5-19\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - http://www-307.ibm.com/pc/support/acpir.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{80952285-645A-46D5-96A3-C76AB207D71C}: NameServer = 218.248.240.46,218.248.240.23
O18 - Protocol: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Security Activity Dashboard Service - Trend Micro Inc. - C:\Program Files\Trend Micro\TrendSecure\SecurityActivityDashboard\tmarsvc.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

--
End of file - 4751 bytes

[MWR 3 day Mod]

Hi,

We are sorry to see your topic is over three days old and no one has yet been able to respond and offer help.

If you still require assistance, please post a link to your topic in our Waiting for help with malware removal? forum, and our staff will make an effort to assist you as promptly as possible. Only post a LINK to this topic, DO NOT post your DDS log!

Please do not reply to this topic.

If you haven't posted within two days in the "Waiting for help with malware removal?" forum, we will assume you have been able to get assistance in other ways and this topic will be closed.

[turtledove]

Hello mak_20789 and welcome to the forums

I am turtledove, and will be assisting you with your log.
If you still need assistance, please do the following:

*Print all instructions or Copy to Notepad for reference.
*Please note, unless I'm notified ahead of time, this topic will close if there is not a response in 5 Days.
*Place a link to this thread in your Favorites/Bookmarks for easily returning here.
*Please respond until I give the all clear, as absence of symptoms does NOT always mean Clean.
*If you can do the above all should go well.
*Please do not run any other tools/scans unless requested*
**Please be sure you have read the Notice about Peer to Peer at the top of this forum**
Link: viewtopic.php?f=11&t=33112

**As I am an Undergrad, my responses will be approved by an Expert/Teacher before I post to you; therefore it may take a tad bit more time to reply.
Thanks for your patience.

Since it has been some time since your above post, please post the following logs. I will go over the new logs and return as soon as possible.

Step 1
Please make an Uninstall list :
To access the Uninstall Manager, please do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file.
Simply copy and paste the contents of that notepad here on your next reply.

Step 2
Rerun HijackThis and Save the log.

Post the HijackThis and the Uninstall list using the Reply button.

Thank you
turtledove

[mak_20789]

Hi turtledove,
thank you for your help.
Regarding P2P programmes, I dont have anything running on XP but ocassionally I use a torrent client thats inbuilt in Ubuntu. Now I want to know that do I need to stop using that as well.

While following your instructions, in step 1, I ran HijackThis, but didnt get any config button. The window that opened had a Misc. tools button, though.So I clicked it followed ahead.
Thank you.

Here is the uninstall list:

Acrobat.com
Adobe AIR
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Reader 9.1
Agere Systems HDA Modem
DriverMax 4
GNS3 0.6
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Java(TM) 6 Update 13
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.10)
Realtek High Definition Audio Driver
Skype™ 4.0
SpywareBlaster 4.2
Trend Micro Internet Security Pro
Trend Micro Internet Security Pro
Ubuntu
WinPcap 4.0.2
Yahoo! Messenger
Yahoo! Toolbar



HijackThis log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:57:04 PM, on 5/22/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Trend Micro\TrendSecure\SecurityActivityDashboard\tmarsvc.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\ProToolbarUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\TrendSecure\TSCFCommander.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Trend Micro\TrendSecure\TSCFPlatformCOMSvr.exe
C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\PlatformDependent\ProToolbarComm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Shreya\Desktop\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro Toolbar BHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - http://www-307.ibm.com/pc/support/acpir.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{80952285-645A-46D5-96A3-C76AB207D71C}: NameServer = 218.248.240.46,218.248.240.23
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Security Activity Dashboard Service - Trend Micro Inc. - C:\Program Files\Trend Micro\TrendSecure\SecurityActivityDashboard\tmarsvc.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

--
End of file - 6099 bytes

[turtledove]

Hello mak20789,

Thank you for the new logs.

First, your HijackThis log shows that an ISP being used is in New Delhi. Is this your Internet Service Provider?
The IP Address showing belongs to:
National Internet Backbone
Bharat Sanchar Nigam Limited
Sanchar Bhawan, 20, Ashoka Road, New Delhi-110001, India
Country: IN



The P2P in Ubuntu, I advise not using, as any Torrents (are P2P) are not guaranteed secure or safe as they are used by virus writers to get on your PC. Although the P2P client/Program may be clean, You do not know what the computer you get a file from has on it. I have seen Hackers use a song name .mp3 as a virus/trojan. If you use it, you risk re-infecting your computer.


Please Copy/Print out all instructions for reference.
Add this topic to your Favorites/Bookmarks for ease of locating.

Please do not download anything until we're certain you are clean.
Please do not use any scans or tools unless I have requested them. This saves confusion.

Let me know if any new problems arise during cleaning. As well as any other questions you may have, if you get .


First
You are in need of several updates for Windows, to avoid many serious infections.

Please go to Windows Update
Once scan is done, choose Custom
Please install all High-Priority Security and Critical updates only. Including XP Service Pack 3 and install Internet Explorer 7or 8 after the Service Pack is installed.


Second
Download and Run RSIT

• Please download Random's System Information Tool by random/random from here and save it to your desktop.
  
• Double click on RSIT.exe to run RSIT.
  
• Click Continue at the disclaimer screen.
  
• Once it has finished, two logs will open:
  
  • log.txt will be opened maximized.
    
  • info.txt will be opened minimized.
    
• Please post the contents of both log.txt and info.txt.
  

Please Post
log.txt and info.txt
Describe current/new symptoms

Thank you

TD

[mak_20789]

Hi turtledove,
thank you for your reply.

1) Yes, Bharat Sanchar Nigam Limited (BSNL) is my ISP
( I dont know hoe you got it as I dont see it anywhere is my hijackthis log )

2) regarding updates, I am facing a problem regarding 3 websites:
a) microsoft.com
b) cisco.com
c) download.com

I am unable to open these websites on my laptop. Even before the recent re-install I faced the same problem.


3) I am pasting the logs.
I noticed one thing while running RSIT:
After running it said it will run HijackThis, and it asked me permission to run shreya.exe. Name of account on laptop is shreya, not any programme on my laptop.

Info:


info.txt logfile of random's system information tool 1.06 2009-05-23 19:26:57

======Uninstall list======

-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Acrobat.com-->MsiExec.exe /X{287ECFA4-719A-2143-A09B-D6A12DE54E40}
Adobe AIR-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A91000000001}
Agere Systems HDA Modem-->agrsmdel
DriverMax 4-->"C:\Program Files\Innovative Solutions\DriverMax\unins000.exe"
GNS3 0.6-->C:\Program Files\GNS3\uninst.exe
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Documents and Settings\Shreya\Desktop\HijackThis.exe" /uninstall
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.0.10)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Skype™ 4.0-->MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}
SpywareBlaster 4.2-->"C:\Program Files\SpywareBlaster\unins000.exe"
Trend Micro Internet Security Pro-->C:\Program Files\Trend Micro\Internet Security\remove.exe
Trend Micro Internet Security Pro-->MsiExec.exe /X{40E12A55-C504-4223-AFAC-7672DBF1ACDE}
Ubuntu-->E:\ubuntu\Uninstall-Ubuntu.exe
WinPcap 4.0.2-->C:\Program Files\WinPcap\uninstall.exe
Yahoo! Messenger-->C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG
Yahoo! Toolbar-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE

======Security center information======

AV: Trend Micro Internet Security Pro
FW: Trend Micro Personal Firewall

======System event log======

Computer Name: MAHESH-743E9F62
Event Code: 17
Message: Time Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15
minutes.
The error was: A socket operation was attempted to an unreachable host. (0x80072751)

Record Number: 85
Source Name: W32Time
Time Written: 20090506072729.000000+330
Event Type: error
User:

Computer Name: MAHESH-743E9F62
Event Code: 29
Message: The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible.
No attempt to contact a source will be made for 15 minutes.
NtpClient has no source of accurate time.

Record Number: 84
Source Name: W32Time
Time Written: 20090506072729.000000+330
Event Type: error
User:

Computer Name: MAHESH-743E9F62
Event Code: 17
Message: Time Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15
minutes.
The error was: A socket operation was attempted to an unreachable host. (0x80072751)

Record Number: 83
Source Name: W32Time
Time Written: 20090506072729.000000+330
Event Type: error
User:

Computer Name: MAHESH-743E9F62
Event Code: 29
Message: The time provider NtpClient is configured to acquire time from one or more
time sources, however none of the sources are currently accessible.
No attempt to contact a source will be made for 14 minutes.
NtpClient has no source of accurate time.

Record Number: 82
Source Name: W32Time
Time Written: 20090506072356.000000+330
Event Type: error
User:

Computer Name: MAHESH-743E9F62
Event Code: 17
Message: Time Provider NtpClient: An error occurred during DNS lookup of the manually
configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15
minutes.
The error was: A socket operation was attempted to an unreachable host. (0x80072751)

Record Number: 81
Source Name: W32Time
Time Written: 20090506072356.000000+330
Event Type: error
User:

=====Application event log=====

Computer Name: MAHESH-743E9F62
Event Code: 5603
Message: A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Record Number: 18
Source Name: WinMgmt
Time Written: 20090504190123.000000+330
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: MAHESH-743E9F62
Event Code: 5603
Message: A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Record Number: 17
Source Name: WinMgmt
Time Written: 20090504190123.000000+330
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: MAHESH-743E9F62
Event Code: 63
Message: A provider, CmdTriggerConsumer, has been registered in the WMI namespace, Root\cimv2, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 13
Source Name: WinMgmt
Time Written: 20090504185844.000000+330
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: MAHESH-743E9F62
Event Code: 63
Message: A provider, CmdTriggerConsumer, has been registered in the WMI namespace, Root\cimv2, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 12
Source Name: WinMgmt
Time Written: 20090504185844.000000+330
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: MAHESH-743E9F62
Event Code: 63
Message: A provider, HiPerfCooker_v1, has been registered in the WMI namespace, Root\WMI, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 11
Source Name: WinMgmt
Time Written: 20090504185842.000000+330
Event Type: warning
User: NT AUTHORITY\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 14 Stepping 12, GenuineIntel
"PROCESSOR_REVISION"=0e0c
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------




log:


Logfile of random's system information tool 1.06 (written by random/random)
Run by Shreya at 2009-05-23 19:26:20
Microsoft Windows XP Professional Service Pack 2
System drive C: has 29 GB (73%) free of 40 GB
Total RAM: 1014 MB (50% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:26:52 PM, on 5/23/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Trend Micro\TrendSecure\SecurityActivityDashboard\tmarsvc.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\ProToolbarUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Trend Micro\TrendSecure\TSCFCommander.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\TrendSecure\TSCFPlatformCOMSvr.exe
C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\PlatformDependent\ProToolbarComm.exe
C:\Documents and Settings\Shreya\Desktop\RSIT.exe
C:\Documents and Settings\Shreya\Desktop\Shreya.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro Toolbar BHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - http://www-307.ibm.com/pc/support/acpir.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{80952285-645A-46D5-96A3-C76AB207D71C}: NameServer = 218.248.240.46,218.248.240.23
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Security Activity Dashboard Service - Trend Micro Inc. - C:\Program Files\Trend Micro\TrendSecure\SecurityActivityDashboard\tmarsvc.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

--
End of file - 6080 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28 882416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{43C6D902-A1C5-45c9-91F6-FD9E90337E18}]
TSToolbarBHO - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll [2009-02-12 144720]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-05-18 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-05-18 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll [2008-07-28 160496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{CCAC5586-44D7-4c43-B64A-F042461A97D2} - Trend Micro Toolbar - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll [2009-02-12 144720]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll [2008-07-28 882416]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2007-02-26 131072]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-02-26 155648]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-02-26 131072]
"snp2std"=C:\WINDOWS\vsnp2std.exe [2005-10-20 339968]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"UfSeAgnt.exe"=C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe [2009-04-01 995528]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-08-10 16384000]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2006-08-30 89542]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-05-18 148888]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"DriverMax"= []
"OE"=C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe [2009-05-17 497008]
"Messenger (Yahoo!)"=C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [2009-05-13 4351216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-02-26 204800]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\GNS3\Dynamips\dynamips-wxp.exe"="C:\Program Files\GNS3\Dynamips\dynamips-wxp.exe:*:Enabled:dynamips-wxp"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======List of files/folders created in the last 1 months======

2009-05-23 19:26:20 ----D---- C:\rsit
2009-05-20 06:55:00 ----D---- C:\Documents and Settings\Shreya\Application Data\Yahoo!
2009-05-20 06:55:00 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2009-05-20 06:51:41 ----D---- C:\Documents and Settings\All Users\Application Data\Yahoo!
2009-05-20 06:51:32 ----D---- C:\Program Files\Yahoo!
2009-05-19 22:43:35 ----D---- C:\Documents and Settings\Shreya\Application Data\skypePM
2009-05-19 22:41:31 ----D---- C:\Documents and Settings\Shreya\Application Data\Skype
2009-05-19 22:39:56 ----D---- C:\Program Files\Common Files\Skype
2009-05-19 22:39:53 ----RD---- C:\Program Files\Skype
2009-05-19 22:39:29 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
2009-05-18 10:09:42 ----D---- C:\WINDOWS\Sun
2009-05-18 09:57:27 ----A---- C:\WINDOWS\system32\javaws.exe
2009-05-18 09:57:27 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-05-18 09:57:26 ----A---- C:\WINDOWS\system32\javaw.exe
2009-05-18 09:57:26 ----A---- C:\WINDOWS\system32\java.exe
2009-05-18 09:57:07 ----D---- C:\Program Files\Java
2009-05-18 09:45:48 ----D---- C:\Documents and Settings\Shreya\Application Data\Sun
2009-05-18 09:09:26 ----D---- C:\Drivers
2009-05-18 00:37:39 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2009-05-18 00:37:35 ----A---- C:\WINDOWS\system32\MSSTDFMT.DLL
2009-05-18 00:37:33 ----D---- C:\Program Files\SpywareBlaster
2009-05-17 23:28:48 ----D---- C:\WINDOWS\system32\Lang
2009-05-17 23:26:33 ----D---- C:\WINDOWS\system32\RTCOM
2009-05-17 23:26:12 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-05-17 23:26:10 ----HDC---- C:\WINDOWS\$NtUninstallKB888111WXPSP2$
2009-05-17 22:11:49 ----D---- C:\Documents and Settings\Shreya\Application Data\Mozilla
2009-05-17 22:11:32 ----D---- C:\Program Files\Mozilla Firefox
2009-05-17 21:41:22 ----D---- C:\WINDOWS\system32\LogFiles
2009-05-17 17:01:17 ----A---- C:\WINDOWS\system32\kdfvmgr.exe
2009-05-17 17:01:17 ----A---- C:\WINDOWS\system32\Kdfhok.dll
2009-05-17 17:01:17 ----A---- C:\WINDOWS\system32\kdfapi.dll
2009-05-17 17:01:16 ----D---- C:\WINDOWS\kdefense
2009-05-17 17:01:16 ----A---- C:\WINDOWS\system32\kdfmgr.exe
2009-05-17 17:01:16 ----A---- C:\WINDOWS\system32\kdfinj.dll
2009-05-17 14:13:32 ----D---- C:\WINDOWS\LocalSSL
2009-05-17 14:11:56 ----D---- C:\Documents and Settings\All Users\Application Data\Trend Micro
2009-05-17 14:11:41 ----D---- C:\Program Files\Trend Micro
2009-05-11 11:05:24 ----D---- C:\Program Files\Common Files\Adobe AIR
2009-05-11 11:05:19 ----D---- C:\Documents and Settings\Shreya\Application Data\Macromedia
2009-05-11 11:05:18 ----D---- C:\Documents and Settings\Shreya\Application Data\Adobe
2009-05-11 11:04:57 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2009-05-11 11:04:42 ----D---- C:\Program Files\Common Files\Adobe
2009-05-11 11:04:42 ----D---- C:\Program Files\Adobe
2009-05-11 10:36:15 ----A---- C:\Documents and Settings\Shreya\Application Data\gns3.ini
2009-05-06 13:20:40 ----D---- C:\Program Files\WinPcap
2009-05-06 13:20:35 ----D---- C:\Program Files\GNS3
2009-05-06 08:07:27 ----A---- C:\WINDOWS\system32\igfxres.dll
2009-05-06 07:28:08 ----A---- C:\WINDOWS\system32\NETw3r32.dll
2009-05-06 07:28:08 ----A---- C:\WINDOWS\system32\NETw3c32.dll
2009-05-06 07:25:26 ----A---- C:\WINDOWS\AGRSMMSG.exe
2009-05-06 07:25:26 ----A---- C:\WINDOWS\agrsmdel.exe
2009-05-06 07:24:08 ----A---- C:\WINDOWS\RtlUpd.exe
2009-05-06 07:24:08 ----A---- C:\WINDOWS\MicCal.exe
2009-05-06 07:24:08 ----A---- C:\WINDOWS\ALCWZRD.EXE
2009-05-06 07:24:07 ----A---- C:\WINDOWS\SOUNDMAN.EXE
2009-05-06 07:24:07 ----A---- C:\WINDOWS\SkyTel.exe
2009-05-06 07:24:07 ----A---- C:\WINDOWS\RTLCPL.EXE
2009-05-06 07:24:07 ----A---- C:\WINDOWS\RTHDCPL.EXE
2009-05-06 07:24:07 ----A---- C:\WINDOWS\ALCMTR.EXE
2009-05-06 07:23:30 ----A---- C:\WINDOWS\system32\vfwwdm32.dll
2009-05-06 07:23:30 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-05-06 07:23:25 ----A---- C:\WINDOWS\vsnp2std.exe
2009-05-06 07:23:25 ----A---- C:\WINDOWS\system32\vsnp2std.dll
2009-05-06 07:23:25 ----A---- C:\WINDOWS\system32\rsnp2std.dll
2009-05-06 07:23:25 ----A---- C:\WINDOWS\system32\csnp2std.dll
2009-05-06 07:23:25 ----A---- C:\WINDOWS\snp2std.ini
2009-05-06 07:21:15 ----A---- C:\WINDOWS\system32\igxprd32.dll
2009-05-06 07:21:15 ----A---- C:\WINDOWS\system32\igxpdv32.dll
2009-05-06 07:21:15 ----A---- C:\WINDOWS\system32\igldev32.dll
2009-05-06 07:21:15 ----A---- C:\WINDOWS\system32\igfxtray.exe
2009-05-06 07:21:15 ----A---- C:\WINDOWS\system32\igfxsrvc.dll
2009-05-06 07:21:15 ----A---- C:\WINDOWS\system32\igfxpers.exe
2009-05-06 07:21:15 ----A---- C:\WINDOWS\system32\igfxext.exe
2009-05-06 07:21:15 ----A---- C:\WINDOWS\system32\igfxexps.dll
2009-05-06 07:21:15 ----A---- C:\WINDOWS\system32\igfxcfg.exe
2009-05-06 07:21:15 ----A---- C:\WINDOWS\system32\hccutils.dll
2009-05-06 07:21:14 ----A---- C:\WINDOWS\system32\igxpgd32.dll
2009-05-06 07:21:14 ----A---- C:\WINDOWS\system32\igxpdx32.dll
2009-05-06 07:21:14 ----A---- C:\WINDOWS\system32\iglicd32.dll
2009-05-06 07:21:14 ----A---- C:\WINDOWS\system32\igfxzoom.exe
2009-05-06 07:21:14 ----A---- C:\WINDOWS\system32\igfxsrvc.exe
2009-05-06 07:21:14 ----A---- C:\WINDOWS\system32\igfxress.dll
2009-05-06 07:21:14 ----A---- C:\WINDOWS\system32\igfxpph.dll
2009-05-06 07:21:14 ----A---- C:\WINDOWS\system32\igfxdo.dll
2009-05-06 07:21:14 ----A---- C:\WINDOWS\system32\igfxdev.dll
2009-05-06 07:21:14 ----A---- C:\WINDOWS\system32\igfxCoIn_v4785.dll
2009-05-06 07:21:14 ----A---- C:\WINDOWS\system32\hkcmd.exe
2009-05-06 07:20:32 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-05-06 07:20:30 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-05-06 07:08:19 ----D---- C:\Program Files\Innovative Solutions
2009-05-04 19:40:29 ----SHD---- C:\RECYCLER
2009-05-04 19:10:47 ----D---- C:\Documents and Settings\Shreya\Application Data\Identities
2009-05-04 19:10:45 ----HD---- C:\Program Files\Uninstall Information
2009-05-04 19:10:39 ----ASH---- C:\Documents and Settings\Shreya\Application Data\desktop.ini
2009-05-04 19:10:38 ----SD---- C:\Documents and Settings\Shreya\Application Data\Microsoft
2009-05-04 19:08:53 ----D---- C:\WINDOWS\SoftwareDistribution
2009-05-04 19:08:52 ----D---- C:\WINDOWS\Prefetch
2009-05-04 19:08:51 ----SD---- C:\WINDOWS\system32\Microsoft
2009-05-04 19:08:51 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-05-04 19:02:04 ----D---- C:\WINDOWS\system32\xircom
2009-05-04 19:02:04 ----D---- C:\Program Files\xerox
2009-05-04 19:02:04 ----D---- C:\Program Files\microsoft frontpage
2009-05-04 19:01:46 ----A---- C:\WINDOWS\control.ini
2009-05-04 19:01:46 ----A---- C:\AUTOEXEC.BAT
2009-05-04 19:01:37 ----A---- C:\WINDOWS\OEWABLog.txt
2009-05-04 19:01:32 ----A---- C:\WINDOWS\system32\mapi32.dll
2009-05-04 19:00:45 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-05-04 19:00:45 ----RD---- C:\WINDOWS\Offline Web Pages
2009-05-04 19:00:45 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-05-04 19:00:39 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-05-04 19:00:34 ----HD---- C:\Program Files\WindowsUpdate
2009-05-04 19:00:15 ----D---- C:\WINDOWS\system32\DirectX
2009-05-04 18:59:53 ----A---- C:\WINDOWS\system32\atrace.dll
2009-05-04 18:59:50 ----A---- C:\WINDOWS\system32\desktop.ini
2009-05-04 18:59:50 ----A---- C:\WINDOWS\desktop.ini
2009-05-04 18:59:42 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2009-05-04 18:59:40 ----A---- C:\WINDOWS\system32\acctres.dll
2009-05-04 18:59:39 ----D---- C:\Program Files\Common Files\Services
2009-05-04 18:59:36 ----SD---- C:\WINDOWS\Tasks
2009-05-04 18:59:36 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2009-05-04 18:59:35 ----D---- C:\Program Files\Common Files\MSSoap
2009-05-04 18:59:31 ----D---- C:\WINDOWS\srchasst
2009-05-04 18:59:30 ----D---- C:\WINDOWS\system32\Macromed
2009-05-04 18:59:27 ----A---- C:\WINDOWS\system32\wuweb.dll
2009-05-04 18:59:27 ----A---- C:\WINDOWS\system32\wucltui.dll
2009-05-04 18:59:26 ----A---- C:\WINDOWS\system32\wups.dll
2009-05-04 18:59:26 ----A---- C:\WINDOWS\system32\wuauserv.dll
2009-05-04 18:59:26 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2009-05-04 18:59:26 ----A---- C:\WINDOWS\system32\wuaueng.dll
2009-05-04 18:59:26 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2009-05-04 18:59:26 ----A---- C:\WINDOWS\system32\wuauclt.exe
2009-05-04 18:59:26 ----A---- C:\WINDOWS\system32\wuapi.dll
2009-05-04 18:59:25 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2009-05-04 18:59:25 ----A---- C:\WINDOWS\system32\qmgr.dll
2009-05-04 18:59:25 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2009-05-04 18:59:25 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2009-05-04 18:59:20 ----D---- C:\Program Files\Movie Maker
2009-05-04 18:59:16 ----A---- C:\WINDOWS\system32\safrslv.dll
2009-05-04 18:59:16 ----A---- C:\WINDOWS\system32\safrdm.dll
2009-05-04 18:59:16 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2009-05-04 18:59:16 ----A---- C:\WINDOWS\system32\racpldlg.dll
2009-05-04 18:59:12 ----A---- C:\WINDOWS\system32\fltMc.exe
2009-05-04 18:59:12 ----A---- C:\WINDOWS\system32\fltlib.dll
2009-05-04 18:59:11 ----D---- C:\WINDOWS\system32\Restore
2009-05-04 18:59:11 ----A---- C:\WINDOWS\system32\srsvc.dll
2009-05-04 18:59:11 ----A---- C:\WINDOWS\system32\srrstr.dll
2009-05-04 18:59:11 ----A---- C:\WINDOWS\system32\srclient.dll
2009-05-04 18:59:10 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2009-05-04 18:59:10 ----A---- C:\WINDOWS\system32\msconf.dll
2009-05-04 18:59:10 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2009-05-04 18:59:10 ----A---- C:\WINDOWS\system32\mnmdd.dll
2009-05-04 18:59:10 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2009-05-04 18:59:10 ----A---- C:\WINDOWS\system32\ils.dll
2009-05-04 18:59:06 ----D---- C:\Program Files\NetMeeting
2009-05-04 18:59:06 ----A---- C:\WINDOWS\system32\msoert2.dll
2009-05-04 18:59:06 ----A---- C:\WINDOWS\system32\msoeacct.dll
2009-05-04 18:59:05 ----A---- C:\WINDOWS\system32\inetres.dll
2009-05-04 18:59:05 ----A---- C:\WINDOWS\system32\inetcomm.dll
2009-05-04 18:59:03 ----D---- C:\Program Files\Outlook Express
2009-05-04 18:59:03 ----A---- C:\WINDOWS\system32\schedsvc.dll
2009-05-04 18:59:03 ----A---- C:\WINDOWS\system32\mstinit.exe
2009-05-04 18:59:03 ----A---- C:\WINDOWS\system32\mstask.dll
2009-05-04 18:59:02 ----A---- C:\WINDOWS\system32\isign32.dll
2009-05-04 18:59:02 ----A---- C:\WINDOWS\system32\inetcfg.dll
2009-05-04 18:59:02 ----A---- C:\WINDOWS\system32\icwphbk.dll
2009-05-04 18:59:02 ----A---- C:\WINDOWS\system32\icwdial.dll
2009-05-04 18:58:56 ----D---- C:\Program Files\Common Files\System
2009-05-04 18:58:50 ----D---- C:\Program Files\Internet Explorer
2009-05-04 18:58:11 ----D---- C:\Program Files\ComPlus Applications
2009-05-04 18:58:10 ----A---- C:\WINDOWS\vbaddin.ini
2009-05-04 18:58:10 ----A---- C:\WINDOWS\vb.ini
2009-05-04 18:58:05 ----D---- C:\WINDOWS\Registration
2009-05-04 18:57:59 ----D---- C:\Program Files\Windows Media Player
2009-05-04 18:57:59 ----D---- C:\Program Files\Online Services
2009-05-04 18:57:53 ----D---- C:\Program Files\Messenger
2009-05-04 18:57:48 ----D---- C:\Program Files\MSN Gaming Zone
2009-05-04 18:57:48 ----A---- C:\WINDOWS\system32\write.exe
2009-05-04 18:57:39 ----A---- C:\WINDOWS\system32\sndvol32.exe
2009-05-04 18:57:39 ----A---- C:\WINDOWS\system32\hticons.dll
2009-05-04 18:57:39 ----A---- C:\WINDOWS\system32\avwav.dll
2009-05-04 18:57:39 ----A---- C:\WINDOWS\system32\avtapi.dll
2009-05-04 18:57:39 ----A---- C:\WINDOWS\system32\avmeter.dll
2009-05-04 18:57:38 ----A---- C:\WINDOWS\system32\winchat.exe
2009-05-04 18:57:31 ----A---- C:\WINDOWS\system32\getuname.dll
2009-05-04 18:57:31 ----A---- C:\WINDOWS\system32\charmap.exe
2009-05-04 18:57:30 ----A---- C:\WINDOWS\system32\winmine.exe
2009-05-04 18:57:30 ----A---- C:\WINDOWS\system32\sol.exe
2009-05-04 18:57:30 ----A---- C:\WINDOWS\system32\calc.exe
2009-05-04 18:57:29 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2009-05-04 18:57:29 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2009-05-04 18:57:29 ----A---- C:\WINDOWS\system32\tslabels.ini
2009-05-04 18:57:29 ----A---- C:\WINDOWS\system32\tskill.exe
2009-05-04 18:57:29 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2009-05-04 18:57:29 ----A---- C:\WINDOWS\system32\tscon.exe
2009-05-04 18:57:29 ----A---- C:\WINDOWS\system32\reset.exe
2009-05-04 18:57:29 ----A---- C:\WINDOWS\system32\mshearts.exe
2009-05-04 18:57:29 ----A---- C:\WINDOWS\system32\freecell.exe
2009-05-04 18:57:28 ----A---- C:\WINDOWS\system32\shadow.exe
2009-05-04 18:57:28 ----A---- C:\WINDOWS\system32\rwinsta.exe
2009-05-04 18:57:28 ----A---- C:\WINDOWS\system32\regini.exe
2009-05-04 18:57:28 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2009-05-04 18:57:28 ----A---- C:\WINDOWS\system32\qwinsta.exe
2009-05-04 18:57:28 ----A---- C:\WINDOWS\system32\qappsrv.exe
2009-05-04 18:57:28 ----A---- C:\WINDOWS\system32\msg.exe
2009-05-04 18:57:28 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2009-05-04 18:57:28 ----A---- C:\WINDOWS\system32\logoff.exe
2009-05-04 18:57:28 ----A---- C:\WINDOWS\system32\cdmodem.dll
2009-05-04 18:57:27 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2009-05-04 18:57:26 ----A---- C:\WINDOWS\system32\stclient.dll
2009-05-04 18:57:26 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2009-05-04 18:57:26 ----A---- C:\WINDOWS\system32\mtxex.dll
2009-05-04 18:57:26 ----A---- C:\WINDOWS\system32\mtxdm.dll
2009-05-04 18:57:26 ----A---- C:\WINDOWS\system32\comsnap.dll
2009-05-04 18:57:26 ----A---- C:\WINDOWS\system32\comrepl.dll
2009-05-04 18:57:26 ----A---- C:\WINDOWS\system32\comaddin.dll
2009-05-04 18:57:21 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2009-05-04 18:57:06 ----D---- C:\Program Files\MSN
2009-05-04 18:57:05 ----A---- C:\WINDOWS\system32\sndrec32.exe
2009-05-04 18:57:05 ----A---- C:\WINDOWS\system32\mplay32.exe
2009-05-04 18:57:05 ----A---- C:\WINDOWS\system32\accwiz.exe
2009-05-04 18:57:04 ----D---- C:\Program Files\Windows NT
2009-05-04 18:57:04 ----A---- C:\WINDOWS\system32\mspaint.exe
2009-05-04 18:57:04 ----A---- C:\WINDOWS\system32\hypertrm.dll
2009-05-04 18:57:03 ----A---- C:\WINDOWS\system32\spider.exe
2009-05-04 18:57:03 ----A---- C:\WINDOWS\system32\clipbrd.exe
2009-05-04 18:57:02 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2009-05-04 18:57:02 ----A---- C:\WINDOWS\system32\remotepg.dll
2009-05-04 18:57:02 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2009-05-04 18:57:02 ----A---- C:\WINDOWS\system32\mstscax.dll
2009-05-04 18:57:02 ----A---- C:\WINDOWS\system32\mstsc.exe
2009-05-04 18:57:01 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2009-05-04 18:57:01 ----A---- C:\WINDOWS\system32\termsrv.dll
2009-05-04 18:57:01 ----A---- C:\WINDOWS\system32\sessmgr.exe
2009-05-04 18:57:01 ----A---- C:\WINDOWS\system32\rdshost.exe
2009-05-04 18:57:01 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2009-05-04 18:57:01 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2009-05-04 18:57:01 ----A---- C:\WINDOWS\system32\rdpclip.exe
2009-05-04 18:57:01 ----A---- C:\WINDOWS\system32\rdchost.dll
2009-05-04 18:57:01 ----A---- C:\WINDOWS\system32\qprocess.exe
2009-05-04 18:57:00 ----D---- C:\WINDOWS\system32\MsDtc
2009-05-04 18:57:00 ----A---- C:\WINDOWS\system32\mtxoci.dll
2009-05-04 18:57:00 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2009-05-04 18:57:00 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2009-05-04 18:57:00 ----A---- C:\WINDOWS\system32\icaapi.dll
2009-05-04 18:57:00 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2009-05-04 18:56:59 ----A---- C:\WINDOWS\system32\xolehlp.dll
2009-05-04 18:56:59 ----A---- C:\WINDOWS\system32\msdtctm.dll
2009-05-04 18:56:59 ----A---- C:\WINDOWS\system32\msdtclog.dll
2009-05-04 18:56:59 ----A---- C:\WINDOWS\system32\msdtc.exe
2009-05-04 18:56:58 ----D---- C:\WINDOWS\system32\Com
2009-05-04 18:56:58 ----A---- C:\WINDOWS\system32\colbact.dll
2009-05-04 18:56:58 ----A---- C:\WINDOWS\system32\clbcatex.dll
2009-05-04 18:56:58 ----A---- C:\WINDOWS\system32\catsrvut.dll
2009-05-04 18:56:58 ----A---- C:\WINDOWS\system32\catsrvps.dll
2009-05-04 18:56:57 ----A---- C:\WINDOWS\system32\comsvcs.dll
2009-05-04 18:56:57 ----A---- C:\WINDOWS\system32\catsrv.dll
2009-05-04 18:56:56 ----A---- C:\WINDOWS\system32\comuid.dll
2009-05-04 18:56:56 ----A---- C:\WINDOWS\system32\clbcatq.dll
2009-05-04 18:56:50 ----A---- C:\WINDOWS\system32\servdeps.dll
2009-05-04 18:56:49 ----A---- C:\WINDOWS\system32\mmfutil.dll
2009-05-04 18:56:49 ----A---- C:\WINDOWS\system32\licwmi.dll
2009-05-04 18:56:47 ----A---- C:\WINDOWS\system32\cmprops.dll
2009-05-04 14:42:36 ----A---- C:\WINDOWS\system32\h323log.txt
2009-05-04 14:30:08 ----A---- C:\WINDOWS\system32\usbui.dll
2009-05-04 14:28:49 ----A---- C:\WINDOWS\imsins.BAK
2009-05-04 14:28:46 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-05-04 14:28:45 ----SHD---- C:\WINDOWS\Installer
2009-05-04 14:28:45 ----D---- C:\Program Files\Common Files\ODBC
2009-05-04 14:28:45 ----A---- C:\WINDOWS\ODBCINST.INI
2009-05-04 14:28:41 ----D---- C:\Program Files\Common Files\SpeechEngines
2009-05-04 14:28:40 ----RD---- C:\Program Files
2009-05-04 14:28:40 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-05-04 14:28:40 ----D---- C:\Program Files\Common Files
2009-05-04 14:28:36 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2009-05-04 14:28:36 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2009-05-04 14:28:36 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2009-05-04 14:28:34 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2009-05-04 14:28:34 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2009-05-04 14:28:34 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2009-05-04 14:28:34 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2009-05-04 14:28:33 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2009-05-04 14:28:33 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2009-05-04 14:28:33 ----RA---- C:\WINDOWS\system32\kbdur.dll
2009-05-04 14:28:33 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2009-05-04 14:28:33 ----RA---- C:\WINDOWS\system32\kbdru.dll
2009-05-04 14:28:33 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2009-05-04 14:28:33 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2009-05-04 14:28:33 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2009-05-04 14:28:31 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2009-05-04 14:28:31 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2009-05-04 14:28:31 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2009-05-04 14:28:31 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2009-05-04 14:28:31 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2009-05-04 14:28:31 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2009-05-04 14:28:30 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2009-05-04 14:28:29 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2009-05-04 14:28:29 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2009-05-04 14:28:29 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2009-05-04 14:28:29 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2009-05-04 14:28:28 ----RA---- C:\WINDOWS\system32\kbdest.dll
2009-05-04 14:28:26 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2009-05-04 14:28:26 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2009-05-04 14:28:26 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2009-05-04 14:28:26 ----RA---- C:\WINDOWS\system32\kbdro.dll
2009-05-04 14:28:26 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2009-05-04 14:28:26 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2009-05-04 14:28:26 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2009-05-04 14:28:26 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2009-05-04 14:28:26 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2009-05-04 14:28:26 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2009-05-04 14:28:26 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2009-05-04 14:28:26 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2009-05-04 14:28:26 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2009-05-04 14:28:22 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-05-04 14:28:22 ----A---- C:\WINDOWS\system32\irclass.dll
2009-05-04 14:28:22 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2009-05-04 14:28:22 ----A---- C:\WINDOWS\system32\dgsetup.dll
2009-05-04 14:28:22 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2009-05-04 14:28:19 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2009-05-04 14:28:19 ----A---- C:\WINDOWS\TASKMAN.EXE
2009-05-04 14:28:18 ----A---- C:\WINDOWS\system32\batt.dll
2009-05-04 14:28:18 ----A---- C:\WINDOWS\NOTEPAD.EXE
2009-05-04 14:28:14 ----A---- C:\WINDOWS\system32\storprop.dll
2009-05-04 14:28:03 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2009-05-04 14:27:58 ----RA---- C:\WINDOWS\SET8.tmp
2009-05-04 14:27:55 ----RA---- C:\WINDOWS\SET4.tmp
2009-05-04 14:27:53 ----RA---- C:\WINDOWS\SET3.tmp
2009-05-04 14:27:48 ----D---- C:\WINDOWS\system32\CatRoot2
2009-05-04 14:27:48 ----D---- C:\WINDOWS\system32\CatRoot
2009-05-04 14:27:42 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-05-04 14:27:22 ----A---- C:\WINDOWS\setuplog.txt
2009-05-04 14:27:19 ----D---- C:\Documents and Settings
2009-05-04 14:27:18 ----SHD---- C:\System Volume Information
2009-05-04 14:26:25 ----RSH---- C:\boot.ini
2009-05-04 14:20:18 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-05-04 14:20:18 ----RSD---- C:\WINDOWS\Fonts
2009-05-04 14:20:18 ----RD---- C:\WINDOWS\Web
2009-05-04 14:20:18 ----HD---- C:\WINDOWS\inf
2009-05-04 14:20:18 ----D---- C:\WINDOWS\WinSxS
2009-05-04 14:20:18 ----D---- C:\WINDOWS\twain_32
2009-05-04 14:20:18 ----D---- C:\WINDOWS\Temp
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\wins
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\wbem
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\usmt
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\spool
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\ShellExt
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\Setup
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\ras
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\oobe
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\npp
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\mui
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\inetsrv
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\IME
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\icsxml
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\ias
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\export
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\drivers
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\dhcp
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\config
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\3com_dmi
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\3076
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\2052
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\1054
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\1042
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\1041
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\1037
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\1033
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\1031
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\1028
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32\1025
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system32
2009-05-04 14:20:18 ----D---- C:\WINDOWS\system
2009-05-04 14:20:18 ----D---- C:\WINDOWS\security
2009-05-04 14:20:18 ----D---- C:\WINDOWS\Resources
2009-05-04 14:20:18 ----D---- C:\WINDOWS\repair
2009-05-04 14:20:18 ----D---- C:\WINDOWS\Provisioning
2009-05-04 14:20:18 ----D---- C:\WINDOWS\PeerNet
2009-05-04 14:20:18 ----D---- C:\WINDOWS\pchealth
2009-05-04 14:20:18 ----D---- C:\WINDOWS\mui
2009-05-04 14:20:18 ----D---- C:\WINDOWS\msapps
2009-05-04 14:20:18 ----D---- C:\WINDOWS\msagent
2009-05-04 14:20:18 ----D---- C:\WINDOWS\Media
2009-05-04 14:20:18 ----D---- C:\WINDOWS\java
2009-05-04 14:20:18 ----D---- C:\WINDOWS\ime
2009-05-04 14:20:18 ----D---- C:\WINDOWS\Help
2009-05-04 14:20:18 ----D---- C:\WINDOWS\ehome
2009-05-04 14:20:18 ----D---- C:\WINDOWS\Driver Cache
2009-05-04 14:20:18 ----D---- C:\WINDOWS\Debug
2009-05-04 14:20:18 ----D---- C:\WINDOWS\Cursors
2009-05-04 14:20:18 ----D---- C:\WINDOWS\Connection Wizard
2009-05-04 14:20:18 ----D---- C:\WINDOWS\Config
2009-05-04 14:20:18 ----D---- C:\WINDOWS\AppPatch
2009-05-04 14:20:18 ----D---- C:\WINDOWS\addins
2009-05-04 14:20:18 ----D---- C:\WINDOWS

======List of files/folders modified in the last 1 months======

2009-05-04 19:01:46 ----A---- C:\WINDOWS\win.ini
2009-05-04 14:28:39 ----N---- C:\WINDOWS\system.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel Processor Driver; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-03 36096]
R1 tmtdi;Trend Micro TDI Driver; C:\WINDOWS\system32\DRIVERS\tmtdi.sys [2009-03-04 80400]
R2 tmactmon;tmactmon; \??\C:\WINDOWS\system32\drivers\tmactmon.sys []
R2 tmcomm;tmcomm; \??\C:\WINDOWS\system32\drivers\tmcomm.sys []
R2 tmevtmgr;tmevtmgr; \??\C:\WINDOWS\system32\drivers\tmevtmgr.sys []
R2 tmpreflt;tmpreflt; C:\WINDOWS\system32\DRIVERS\tmpreflt.sys [2009-03-06 36368]
R2 tmxpflt;tmxpflt; C:\WINDOWS\system32\DRIVERS\tmxpflt.sys [2009-03-06 205328]
R2 vsapint;vsapint; C:\WINDOWS\system32\DRIVERS\vsapint.sys [2009-03-06 1195512]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2006-08-30 1161152]
R3 Arp1394;1394 ARP Client Protocol; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-03 60800]
R3 CmBatt;Microsoft AC Adapter Driver; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2004-08-03 14080]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2007-02-26 5700096]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-08-10 4603904]
R3 NETw3x32;Intel(R) PRO/Wireless 3945ABG Adapter Driver for Windows XP 32 Bit; C:\WINDOWS\system32\DRIVERS\NETw3x32.sys [2006-07-02 1706752]
R3 NIC1394;1394 Net Driver; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-03 61824]
R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-02-27 81408]
R3 sdbus;sdbus; C:\WINDOWS\system32\DRIVERS\sdbus.sys [2004-08-03 67584]
R3 SNP2STD;USB2.0 PC Camera (SNP2STD); C:\WINDOWS\system32\DRIVERS\snp2sxp.sys [2005-10-17 10446592]
R3 tmcfw;Trend Micro Common Firewall Service; C:\WINDOWS\system32\DRIVERS\TM_CFW.sys [2009-03-03 335376]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 neokdss;neokdss; C:\WINDOWS\system32\Drivers\neokdss.sys []
S3 nm;Network Monitor Driver; C:\WINDOWS\system32\DRIVERS\NMnt.sys [2004-08-03 40320]
S3 NPF;NetGroup Packet Filter Driver; C:\WINDOWS\system32\drivers\npf.sys [2007-11-07 34064]
S3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-05-18 152984]
R2 Security Activity Dashboard Service;Security Activity Dashboard Service; C:\Program Files\Trend Micro\TrendSecure\SecurityActivityDashboard\tmarsvc.exe [2008-08-14 181584]
R2 SfCtlCom;Trend Micro Central Control Component; C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe [2009-04-01 711248]
R2 TMBMServer;Trend Micro Unauthorized Change Prevention Service; C:\Program Files\Trend Micro\BM\TMBMSRV.exe [2009-03-03 341256]
R2 TmPfw;Trend Micro Personal Firewall; C:\Program Files\Trend Micro\Internet Security\TmPfw.exe [2009-04-01 497008]
R2 TmProxy;Trend Micro Proxy Service; C:\Program Files\Trend Micro\Internet Security\TmProxy.exe [2009-04-01 677128]
S3 rpcapd;Remote Packet Capture Protocol v.0 (experimental); C:\Program Files\WinPcap\rpcapd.exe [2007-11-07 92792]

-----------------EOF-----------------

[turtledove]

Hello mak_20789,

Thanks for the logs. Yes RSIT renames the exe . That is normal.
When you did your last re install, did you do a complete reformat? And was that before or after the current symptoms?
Your ISP is shown in O17 of HijackThis log in number format.
Please Copy/Print all instructions.
*Stop if you have any questions or problems with a step.

Step 1

First, we need to check an important issue, that may be causing the access to updating your system.
1. Click Start, click Run, type services.msc, and then click OK.
2. Double-click Background Intelligent Transfer Service. If it is OFF:
3. In the Start up type box, click Automatic, and then click OK.
4. Restart Computer, repeat steps 1 and 2, let me know if it is now running.

Next, check if your System Restore has any Restore Points listed.
Do this by doing the following:
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.

Let me know if System Restore is On or Off.

Step 2

We will next run ComboFix.exe. Please visit this web page for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix


* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

**Let me know if you have any problems getting ComboFix.

**Be sure you have re enabled all anti virus and anti malware programs

POST:
Answers to Step 1
Did you do a complete Reformat before Re installing?
ComboFix.txt
Also any other issues you may have
Have you noticed any increase in Internet usage that is unusual?

Thank you
TD

[mak_20789]

Hi turtledove,
thank you for the reply.
I must admit that the steps you have told are a bit difficult for me and I need some really spare time to understand and go through all of it.
In the meantime what concerns me most is you have asked about unusual internet usage.
Do you suspect that my account/laptop is being used by someone else? Its on for some 10-12 hours a day, no one has physical access to it except me, and it has wireless and since it is unlimited download for me, I not even once have checked my usage. Please tell me if you have sufficient reasons to believe its being used/hijacked and I will do a re-install. Because for me, as for anyone, security is most important.
I am really waiting for your reply.
Thank you.

[turtledove]

Hello mak_20789,

The instructions for checking BITS are from Microsoft. Let me know where you have a hard time understanding them.

As to the question of unusual internet activity, it is precautionary, as well as seeing if you have noticed any difference. We want to be sure your system has not been hijacked, as you are behind and unable to get important updates. Without the updates, your system is vulnerable. We wish to prevent that or clear it so it is safe again.

Also, I need to know when you re installed, did you completely reformat (not a quick format or repair install) your hard drive? This may or may not explain current issues, but may help in finding the cause.

Thank you

TD

[mak_20789]

Hi,
first of all I want to thank you because after running combo fix, I did a restart and now when I click on IE icon, it opens IE and not Firefox.
Still I am posting the log.
And answers to yor questions are:
1) Step 1: I followed all steps but update still doesnt run.
2) System restore is on, but there were no restore points that I could see.
3) If I remember it correctly, when I did re-install, it was a complete format.

[ EDIT

Hi turtledove,
I am sorry I did a mistake. Actually there are 2 IE icons on my desktop. One is a shortcut ( it has that small arrow at the bottom) and other one doesnt have that arrow. Now when I told you that my problem has been solved, I had clicked the one without the arrow. When I click the icon with the arrow, Firefox opens. And when I right-click it ZI get following options:

Browse the Internet
Firefox Options
Firefox Safe Mode
Scan for Security Threats
Send To
Cut
Copy
Create Shortcut
Delete
Rename

When I right-click on one without arrow I get:
Open Home page
Create Shortcut
Delete
Rename
Properties


So the problem is still there.
Shall I just delete the icon that opens firefox?
]






And here is the log:


ComboFix 09-05-25.A2 - Shreya 05/26/2009 21:09.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.613 [GMT 5.5:30]
Running from: c:\documents and settings\Shreya\Desktop\ComboFix.exe
AV: Trend Micro Internet Security Pro *On-access scanning disabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}
FW: Trend Micro Personal Firewall *enabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}
.

((((((((((((((((((((((((( Files Created from 2009-04-26 to 2009-05-26 )))))))))))))))))))))))))))))))
.

2009-05-23 13:56 . 2009-05-23 13:56 -------- d-----w C:\rsit
2009-05-20 01:27 . 2009-05-20 01:27 -------- d-----w c:\documents and settings\Shreya\Local Settings\Application Data\Yahoo
2009-05-20 01:25 . 2009-05-20 01:25 -------- d-----w c:\documents and settings\Shreya\Application Data\Yahoo!
2009-05-20 01:25 . 2009-05-20 01:25 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-20 01:21 . 2009-05-20 01:27 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-20 01:21 . 2009-05-13 10:02 607472 ----a-w c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-20 01:21 . 2009-05-20 01:25 -------- d-----w c:\program files\Yahoo!
2009-05-19 17:13 . 2009-05-19 17:13 56 ---ha-w c:\windows\system32\ezsidmv.dat
2009-05-19 17:13 . 2009-05-19 17:13 -------- d-----w c:\documents and settings\Shreya\Application Data\skypePM
2009-05-19 17:11 . 2009-05-19 17:19 -------- d-----w c:\documents and settings\Shreya\Application Data\Skype
2009-05-19 17:09 . 2009-05-19 17:09 -------- d-----w c:\program files\Common Files\Skype
2009-05-19 17:09 . 2009-05-19 17:09 -------- d-----r c:\program files\Skype
2009-05-19 17:09 . 2009-05-19 17:09 -------- d-----w c:\documents and settings\All Users\Application Data\Skype
2009-05-19 17:01 . 2009-05-19 17:01 -------- d-----w c:\documents and settings\Shreya\Local Settings\Application Data\Identities
2009-05-18 04:39 . 2009-05-18 04:39 -------- d-----w c:\windows\Sun
2009-05-18 04:28 . 2009-05-18 04:28 57344 ----a-w c:\documents and settings\Shreya\Application Data\Sun\Java\Deployment\cache\6.0\50\5b902232-694c2ab5-n\Decora-SSE.dll
2009-05-18 04:28 . 2009-05-18 04:28 24064 ----a-w c:\documents and settings\Shreya\Application Data\Sun\Java\Deployment\cache\6.0\15\4e09eacf-16b4cfe0-n\Decora-D3D.dll
2009-05-18 04:28 . 2009-05-18 04:28 315392 ----a-w c:\documents and settings\Shreya\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-26da1487-n\jogl.dll
2009-05-18 04:28 . 2009-05-18 04:28 20480 ----a-w c:\documents and settings\Shreya\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-26da1487-n\jogl_awt.dll
2009-05-18 04:28 . 2009-05-18 04:28 114688 ----a-w c:\documents and settings\Shreya\Application Data\Sun\Java\Deployment\cache\6.0\62\6baea4fe-26da1487-n\jogl_cg.dll
2009-05-18 04:28 . 2009-05-18 04:28 20480 ----a-w c:\documents and settings\Shreya\Application Data\Sun\Java\Deployment\cache\6.0\45\4f710eed-14c590db-n\gluegen-rt.dll
2009-05-18 04:27 . 2009-05-18 04:27 499712 ----a-w c:\documents and settings\Shreya\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-17ad5635-n\msvcp71.dll
2009-05-18 04:27 . 2009-05-18 04:27 499712 ----a-w c:\documents and settings\Shreya\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-17ad5635-n\jmc.dll
2009-05-18 04:27 . 2009-05-18 04:27 348160 ----a-w c:\documents and settings\Shreya\Application Data\Sun\Java\Deployment\cache\6.0\33\258cea61-17ad5635-n\msvcr71.dll
2009-05-18 04:27 . 2009-05-18 04:27 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-18 04:27 . 2009-05-18 04:27 -------- d-----w c:\program files\Java
2009-05-18 04:21 . 2009-05-18 04:21 152576 ----a-w c:\documents and settings\Shreya\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-18 03:39 . 2009-05-18 03:39 -------- d-----w C:\Drivers
2009-05-17 19:07 . 2009-05-20 02:25 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-17 19:07 . 2005-08-25 13:48 118784 ----a-w c:\windows\system32\MSSTDFMT.DLL
2009-05-17 19:07 . 2009-05-20 02:25 -------- d-----w c:\program files\SpywareBlaster
2009-05-17 17:58 . 2009-05-17 17:58 -------- d-----w c:\windows\system32\Lang
2009-05-17 16:41 . 2009-05-17 16:41 0 ----a-w c:\windows\nsreg.dat
2009-05-17 16:41 . 2009-05-17 16:41 -------- d-----w c:\documents and settings\Shreya\Local Settings\Application Data\Mozilla
2009-05-17 16:11 . 2009-05-17 16:11 -------- d-----w c:\windows\system32\LogFiles
2009-05-17 11:31 . 2009-05-26 15:11 77824 ----a-w c:\windows\system32\kdfapi.dll
2009-05-17 11:31 . 2009-05-26 15:11 192512 ----a-w c:\windows\system32\kdfvmgr.exe
2009-05-17 11:31 . 2009-05-26 15:11 53248 ----a-w c:\windows\system32\Kdfhok.dll
2009-05-17 11:31 . 2009-05-26 15:11 387288 ----a-w c:\windows\system32\kdfmgr.exe
2009-05-17 11:31 . 2009-05-17 16:11 475872 ----a-w c:\windows\system32\kdfinj.dll
2009-05-17 11:31 . 2009-05-17 11:31 -------- d-----w c:\windows\kdefense
2009-05-17 08:44 . 2009-05-17 08:44 -------- d-----w c:\documents and settings\Shreya\Local Settings\Application Data\Trend Micro
2009-05-17 08:43 . 2009-05-17 08:43 -------- d-----w c:\windows\LocalSSL
2009-05-17 08:43 . 2009-05-17 08:43 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\Trend Micro
2009-05-17 08:42 . 2009-04-02 23:08 50192 ----a-w c:\windows\system32\drivers\tmactmon.sys
2009-05-17 08:42 . 2009-04-02 23:08 50192 ----a-w c:\windows\system32\drivers\tmevtmgr.sys
2009-05-17 08:42 . 2009-04-02 23:08 153104 ----a-w c:\windows\system32\drivers\tmcomm.sys
2009-05-17 08:41 . 2009-05-17 16:03 -------- d-----w c:\documents and settings\All Users\Application Data\Trend Micro
2009-05-17 08:41 . 2009-05-17 08:42 -------- d-----w c:\program files\Trend Micro
2009-05-17 08:40 . 2009-03-06 02:17 36368 ----a-w c:\windows\system32\drivers\tmpreflt.sys
2009-05-17 08:40 . 2009-03-06 02:17 205328 ----a-w c:\windows\system32\drivers\tmxpflt.sys
2009-05-17 08:40 . 2009-03-06 02:17 1195512 ----a-w c:\windows\system32\drivers\vsapint.sys
2009-05-17 08:40 . 2009-03-03 23:12 80400 ----a-w c:\windows\system32\drivers\tmtdi.sys
2009-05-17 08:40 . 2009-03-03 09:08 335376 ----a-w c:\windows\system32\drivers\TM_CFW.sys
2009-05-16 16:53 . 2009-05-16 16:53 12328 ----a-w c:\documents and settings\Shreya\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-11 05:35 . 2009-05-11 05:35 -------- d-----w c:\documents and settings\Shreya\Local Settings\Application Data\Adobe
2009-05-11 05:35 . 2009-05-11 05:35 -------- d-----w c:\program files\Common Files\Adobe AIR
2009-05-11 05:34 . 2009-05-11 05:35 -------- d-----w c:\program files\Common Files\Adobe
2009-05-06 07:50 . 2009-05-06 07:50 -------- d-----w c:\program files\WinPcap
2009-05-06 07:50 . 2009-05-18 14:18 -------- d-----w c:\program files\GNS3
2009-05-06 02:37 . 2007-02-26 03:03 172032 ----a-w c:\windows\system32\igfxres.dll
2009-05-06 01:58 . 2006-07-02 06:00 1706752 ----a-w c:\windows\system32\drivers\NETw3x32.sys
2009-05-06 01:58 . 2006-06-29 20:28 2732032 ----a-w c:\windows\system32\NETw3r32.dll
2009-05-06 01:58 . 2006-06-29 20:28 561152 ----a-w c:\windows\system32\NETw3c32.dll
2009-05-06 01:57 . 2006-02-27 00:46 81408 ----a-w c:\windows\system32\drivers\Rtnicxp.sys
2009-05-06 01:55 . 2006-08-31 09:34 68608 ----a-w c:\windows\agrsmdel.exe
2009-05-06 01:55 . 2006-08-30 11:40 89542 ----a-w c:\windows\AGRSMMSG.exe
2009-05-06 01:55 . 2006-08-30 09:53 1161152 ----a-w c:\windows\system32\drivers\AGRSM.sys
2009-05-06 01:54 . 2007-07-26 13:06 1191936 ----a-w c:\windows\RtlUpd.exe
2009-05-06 01:54 . 2007-06-28 11:44 2165760 ----a-w c:\windows\MicCal.exe
2009-05-06 01:54 . 2006-05-04 11:26 2808832 ----a-w c:\windows\ALCWZRD.EXE
2009-05-06 01:54 . 2007-08-10 10:21 16384000 ----a-w c:\windows\RTHDCPL.EXE
2009-05-06 01:54 . 2007-08-10 08:52 4603904 ----a-w c:\windows\system32\drivers\RtkHDAud.sys
2009-05-06 01:54 . 2007-08-03 08:22 1826816 ----a-w c:\windows\SkyTel.exe
2009-05-06 01:54 . 2007-03-23 14:19 9715200 ----a-w c:\windows\RTLCPL.EXE
2009-05-06 01:54 . 2006-07-21 11:14 86016 ----a-w c:\windows\SOUNDMAN.EXE
2009-05-06 01:54 . 2005-05-03 13:43 69632 ----a-w c:\windows\ALCMTR.EXE
2009-05-06 01:51 . 2007-02-26 04:29 5700096 ----a-w c:\windows\system32\drivers\igxpmp32.sys
2009-05-06 01:50 . 2009-05-06 01:58 -------- dc----w c:\windows\system32\DRVSTORE
2009-05-06 01:38 . 2009-05-06 01:38 -------- d-----w c:\documents and settings\Shreya\Local Settings\Application Data\Innovative Solutions
2009-05-06 01:38 . 2009-05-06 01:38 -------- d-----w c:\program files\Innovative Solutions
2009-05-04 14:11 . 2004-08-03 17:38 26496 -c--a-w c:\windows\system32\dllcache\usbstor.sys
2009-05-04 14:08 . 2004-08-03 18:56 4096 ----a-w c:\documents and settings\All Users\Application Data\Microsoft\USMT\iconlib.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-25 17:26 . 2009-05-25 17:25 -------- d-----w c:\documents and settings\Shreya\Application Data\Winamp
2009-05-25 17:26 . 2009-05-25 17:25 -------- d-----w c:\program files\Winamp
2009-05-04 13:53 . 2009-05-04 13:31 86327 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-04 13:32 . 2009-05-04 13:32 -------- d-----w c:\program files\microsoft frontpage
2009-05-04 13:28 . 2009-05-04 13:28 21640 ----a-w c:\windows\system32\emptyregdb.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2009-05-17 497008]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-13 4351216]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-02-26 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-02-26 155648]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-02-26 131072]
"snp2std"="c:\windows\vsnp2std.exe" [2005-10-20 339968]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2009-04-01 995528]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-18 148888]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-04-10 37888]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2007-08-10 16384000]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2006-08-30 89542]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2009-05-17 497008]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\GNS3\\Dynamips\\dynamips-wxp.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

R2 Security Activity Dashboard Service;Security Activity Dashboard Service;c:\program files\Trend Micro\TrendSecure\SecurityActivityDashboard\tmarsvc.exe [5/17/2009 2:13 PM 181584]
R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [5/17/2009 2:12 PM 50192]
R2 TmPfw;Trend Micro Personal Firewall;c:\program files\Trend Micro\Internet Security\TmPfw.exe [5/17/2009 2:12 PM 497008]
R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [5/17/2009 2:10 PM 36368]
R2 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [5/17/2009 2:12 PM 677128]
R3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [5/17/2009 2:10 PM 335376]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [11/7/2007 1:52 AM 34064]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-DriverMax - (no file)
SafeBoot-procexp90.Sys


.
------- Supplementary Scan -------
.
TCP: {80952285-645A-46D5-96A3-C76AB207D71C} = 218.248.240.46,218.248.240.23
FF - ProfilePath - c:\documents and settings\Shreya\Application Data\Mozilla\Firefox\Profiles\h9v497uy.default\
FF - prefs.js: browser.startup.homepage - hxxp://timesofindia.indiatimes.com/
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Mozilla Firefox\extensions\browserhighlighter@ebay.com\components\Shim.dll
FF - component: c:\program files\Trend Micro\TrendSecure\TISProToolbar\FirefoxExtension\components\FFTMUFEHelper.dll
FF - component: c:\program files\Trend Micro\TrendSecure\TISProToolbar\FirefoxExtension\components\FFToolbarComm.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-26 21:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
Completion time: 2009-05-26 21:13
ComboFix-quarantined-files.txt 2009-05-26 15:43

Pre-Run: 30,139,502,592 bytes free
Post-Run: 30,284,926,976 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
c:\wubildr.mbr="Ubuntu"

175

[turtledove]

Hello mak_20789,

I would like two files checked as a precaution please:

Submit a file for analysis
We need to have something checked for malware. Please go to Jotti's.

• Copy and paste the following text into the field under File to upload & scan: One Line at a Time
  

  Code: Select all

      c:\windows\system32\drivers\npf.sys
      c:\windows\system32\ezsidmv.dat
      

  
  
• Click Submit. The file will now be scanned for malware and the results will be displayed from the screen. Select the part where the virus scan results are shown
  (the part starting with A-squared and ending with VBA32) and copy and paste this to notepad.
  
• Copy and paste the whole notepad file you just made into your reply.

**Please wait for all the scanners to finish then copy and paste the results in your next response.
*If the site is too busy do the same at this site: visit Virustotal

We will proceed from there.

Thank you
TD

[mak_20789]

Hi turtledove,
the both the files came clean, however when I uploaded npf.sys for the first time report came with different file name:

Filename: 28.tmp
Status:
Scan finished. 0 out of 20 scanners reported malware.
Scan taken on: Mon 11 May 2009 09:33:34 (CET) Permalink

I did once again and it again came as 28.tmp.

For the third time it came as npf.sys

Filename: npf.sys
Status:
Scan finished. 0 out of 20 scanners reported malware.
Scan taken on: Thu 28 May 2009 16:32:25 (CET) Permalink


The other file also was clean:

Filename: ezsidmv.dat
Status:
Scan finished. 0 out of 20 scanners reported malware.
Scan taken on: Thu 28 May 2009 16:27:02 (CET) Permalink

[turtledove]

Hello mak_20789,

Thank you for the reports. Please note, if you need to add more information like you have to your previous post, please put the edit as a new post. That way we won't miss the new information.

*Copy/Print out instructions*
One question, do you have a Firefox Icon on the desktop as well? Or just the 2 IE icons?
If no Firefox Icon, go to Programs-->>Mozilla Firefox Folder-->>Right click on firefox.exe and select Send to Desktop-->>(or Create Shortcut)
See if that shortcut works right . Do both browsers icons work right now?


Next
Eset NOD32 Online AntiVirus

Run Eset NOD32 Online AntiVirus
http://www.eset.eu/online-scanner
Note: You will need to use Internet Explorer for this scan.

• Tick the box next to YES, I accept the Terms of Use.
  
• Click Start
  
• When asked, allow the activex control to install
  
• Disable your current Antivirus software. You can usually do this with its Notfication Tray icon near the clock.
  
• Click Start
  
• Make sure that the option "Remove found threats" is checked, and the option "Scan unwanted applications" is checked
  
• Click Scan
  
• Wait for the scan to finish
  
• Re-enable your Anvirisus software.
  
• A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.
  

Next
Please rerun HijackThis and scan, save new log.

Please Post:
ESET log.txt
New HijackThis Scan log
How the Firefox icon created works, and how Internet Explorer works now as well

Thank you
TD

[mak_20789]

Hi turtledove,
thank you for your reply.

1) I have 1 Firefox and 2 IE icons on my desktop. Of the 2 IEs on doesn't have that arrow.
And since I already have a Firefox icon, I didn't do the first steps you told me.

2) Here is the scan result:

ESETSmartInstaller@High as downloader log:
all ok
# version=6
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.5863
# api_version=3.0.2
# EOSSerial=17e8268714dae442a43007125b098271
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-05-29 08:07:33
# local_time=2009-05-29 01:37:33 (+0530, India Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 2
# compatibility_mode=516 41 100 100 26430156250
# scanned=28406
# found=0
# cleaned=0
# scan_time=579



2) Here is the HijackThis log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:42:03 PM, on 5/29/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Trend Micro\TrendSecure\SecurityActivityDashboard\tmarsvc.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\ProToolbarUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\vsnp2std.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\TrendSecure\TSCFCommander.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\TrendSecure\TSCFPlatformCOMSvr.exe
C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\PlatformDependent\ProToolbarComm.exe
C:\WINDOWS\system32\mspaint.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Shreya\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Trend Micro Toolbar BHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2DAD3559-2923-4935-AD49-B673D2539944} (IASRunner Class) - http://www-307.ibm.com/pc/support/acpir.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{80952285-645A-46D5-96A3-C76AB207D71C}: NameServer = 218.248.240.46,218.248.240.23
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\TrendSecure\TISProToolbar\TSToolbar.dll
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: Security Activity Dashboard Service - Trend Micro Inc. - C:\Program Files\Trend Micro\TrendSecure\SecurityActivityDashboard\tmarsvc.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

--
End of file - 6583 bytes

[turtledove]

Hello mak20789,
The reports look good.

Lets see if we can get the updating issue fixed next.

First

Download to your Desktop FixPolicies.exe, a self-extracting ZIP archive from here

• Double-click FixPolicies.exe.
  
• Click the "Install" button on the bottom toolbar of the box that will open.
  
• The program will create a new Folder called FixPolicies.
  
• Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd.
  
• A black box should briefly appear and then close. This will enable your Control Panel and stop the Administrative warnings, if any malware infection resets the registry policy keys again. You can run this as many times as you like.

Second
Please see if you can now access the Microsoft and Cisco sites, and do the updates.
Let me know if they work or are still a problem.

Third
Remove the IE icon with arrow by right clicking, choose delete, then ok.
Empty Recycle bin.

Post
How everything is now or any other problems please.
Are both Browsers working correctly now?
Thank you

TD