Hi:
note: i did all the "what to do if your computer is running slow" but it was still in really good shape from the last time i did those things before i started posting in this board. it is still rather slow starting programs, however, including internet explorer. do you think its ok for me to update to IE 8?
Here are the logs you requested.
Please note that i leave on holiday starting wednesday so i may not reply again until the middle of next week. i much appreciate your help so far and would like you to keep the correspondence open until we have completed it all.
thanks!
Malwarebytes' Anti-Malware 1.41
Database version: 2869
Windows 5.1.2600 Service Pack 3
9/28/2009 9:37:27 PM
mbam-log-2009-09-28 (21-37-27).txt
Scan type: Full Scan (C:\|)
Objects scanned: 177475
Time elapsed: 28 minute(s), 3 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1617\A0066732.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1617\A0066733.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
-----------------------------------------------------------
ComboFix 09-09-28.01 - TMW 09/28/2009 20:44.3.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.213 [GMT -6:00]
Running from: c:\documents and settings\TMW\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\TMW\Desktop\CFScript.txt
FILE ::
"c:\windows\0535251103110107106.yux"
"c:\windows\fdgg34353edfgdfdf"
"c:\windows\system32\drivers\kgpcpy.cfg"
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\0535251103110107106.yux
c:\windows\fdgg34353edfgdfdf
c:\windows\system32\drivers\kgpcpy.cfg
.
((((((((((((((((((((((((( Files Created from 2009-08-28 to 2009-09-29 )))))))))))))))))))))))))))))))
.
2009-09-23 02:26 . 2009-09-23 02:26 -------- d-----w- c:\program files\ESET
2009-09-18 01:32 . 2009-06-21 21:44 153088 ------w- c:\windows\system32\dllcache\triedit.dll
2009-09-13 17:33 . 2009-09-13 17:33 -------- d-----w- c:\program files\iPhone Configuration Utility
2009-09-13 17:27 . 2009-09-13 17:27 -------- d-----w- c:\program files\iPod
2009-09-13 17:27 . 2009-09-13 17:30 -------- d-----w- c:\program files\iTunes
2009-09-13 17:27 . 2009-09-13 17:30 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-13 17:18 . 2009-09-13 17:18 -------- d-----w- c:\program files\Bonjour
2009-09-13 17:15 . 2009-09-13 17:17 -------- d-----w- c:\program files\QuickTime
2009-09-11 01:23 . 2009-09-11 01:23 -------- d-----w- c:\program files\AVG
2009-09-11 01:21 . 2009-09-11 15:33 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-09-11 00:48 . 2009-09-11 00:48 -------- d-----w- c:\program files\MSSOAP
2009-09-11 00:47 . 2009-09-11 00:47 -------- d-----w- c:\program files\Webroot
2009-09-10 23:13 . 2009-09-10 23:13 -------- d-----w- c:\documents and settings\TMW\Application Data\Malwarebytes
2009-09-10 23:13 . 2009-09-10 23:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-10 01:42 . 2009-09-11 01:10 -------- d-----w- c:\documents and settings\All Users\Application Data\SITEguard
2009-09-10 01:41 . 2009-09-10 01:41 -------- d-----w- c:\program files\Common Files\iS3
2009-09-10 01:41 . 2009-09-29 02:27 -------- d-----w- c:\documents and settings\All Users\Application Data\STOPzilla!
2009-09-10 01:18 . 2009-09-11 16:15 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-10 00:06 . 2009-09-10 00:06 -------- d-----w- c:\documents and settings\TMW\Local Settings\Application Data\Mozilla
2009-09-08 23:52 . 2009-09-08 23:52 -------- d-sh--w- c:\documents and settings\TMW\IECompatCache
2009-09-04 01:34 . 2009-06-26 16:50 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-09-04 01:34 . 2009-06-26 16:50 81920 ----a-w- c:\windows\system32\dllcache\ieencode.dll
2009-09-03 00:10 . 2009-09-03 00:10 -------- d-----w- c:\program files\Safari
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-21 23:25 . 2005-03-03 01:35 -------- d-----w- c:\program files\Java
2009-09-18 10:10 . 2008-08-09 14:42 -------- d-----w- c:\program files\MozyHome
2009-09-15 13:10 . 2008-11-28 21:55 -------- d-----w- c:\documents and settings\TMW\Application Data\Apple Computer
2009-09-13 17:27 . 2008-11-28 21:53 -------- d-----w- c:\program files\Common Files\Apple
2009-09-11 15:55 . 2005-04-27 02:57 -------- d-----w- c:\program files\Nero
2009-09-11 15:53 . 2009-04-01 00:20 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-09-11 00:42 . 2006-06-08 02:10 -------- d-----w- c:\program files\Trend Micro
2009-09-05 16:19 . 2005-03-10 18:49 73688 -c--a-w- c:\documents and settings\TMW\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-29 01:42 . 2009-04-11 14:27 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-29 01:42 . 2008-11-28 21:53 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-14 12:58 . 2009-09-10 01:19 7396 ----a-w- c:\windows\system32\drivers\pctcore.cat
2009-08-12 01:31 . 2009-05-10 15:36 -------- d-----w- c:\program files\Google
2009-08-12 01:10 . 2009-04-01 00:20 -------- d-----w- c:\program files\McAfee
2009-08-12 01:08 . 2006-05-24 22:50 -------- d-----w- c:\program files\CoffeeCup Software
2009-08-05 09:01 . 2004-08-04 11:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-31 21:23 . 2009-03-14 22:31 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:01 . 2004-08-04 11:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 05:43 . 2004-08-04 11:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2006-06-06 02:46 . 2006-06-06 02:46 88 --sh--r- c:\windows\SYSTEM32\84D9348185.sys
2006-06-06 02:46 . 2006-06-06 02:44 3350 --sha-w- c:\windows\SYSTEM32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-09-21_23.57.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-29 02:33 . 2009-09-29 02:33 16384 c:\windows\Temp\Perflib_Perfdata_f4.dat
- 2005-03-10 18:29 . 2009-09-21 23:55 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2005-03-10 18:29 . 2009-09-28 08:00 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2005-03-10 18:29 . 2009-09-21 23:55 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-03-10 18:29 . 2009-09-28 08:00 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-03-10 18:29 . 2009-09-28 08:00 16384 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat
- 2005-03-10 18:29 . 2009-09-21 23:55 16384 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat
+ 2009-09-29 02:32 . 2009-09-29 02:32 38240 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
- 2009-06-13 15:56 . 2009-06-13 15:56 38240 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
+ 2006-10-27 02:49 . 2006-10-27 02:49 509200 c:\windows\Installer\$PatchCache$\Managed\00002109020090400000000000F01FEC\12.0.6021\WRD12CVR.DLL
+ 2009-04-04 13:35 . 2009-04-04 13:35 38325760 c:\windows\Installer\fbae641.msp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
@="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"
[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]
2009-09-14 19:04 2847032 ----a-w- c:\program files\MozyHome\mozyshell.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
@="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"
[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]
2009-09-14 19:04 2847032 ----a-w- c:\program files\MozyHome\mozyshell.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"IAAnotif"="c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2005-03-03 26112]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]
"NapsterShell"="c:\program files\Napster\napster.exe" [2008-05-29 323216]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-09 305440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-31 149280]
c:\documents and settings\TMW\Start Menu\Programs\Startup\
PMB Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2009-5-10 333088]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
MozyHome Status.lnk - c:\program files\MozyHome\mozystat.exe [2009-9-14 2891576]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2005-4-16 118784]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
R1 mozyFilter;mozyFilter;c:\windows\SYSTEM32\DRIVERS\mozy.sys [8/9/2008 8:42 AM 54776]
R2 WUSB54GSVC;WUSB54GSVC;c:\program files\Wireless-G USB Network Adapter\WLService.exe [8/16/2005 6:26 PM 41025]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - GTNDIS5
.
Contents of the 'Scheduled Tasks' folder
2009-09-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
.
.
------- Supplementary Scan -------
.
uStart Page =
hxxp://www.google.com/uSearchMigratedDefaultURL =
hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page =
hxxp://yahoo.sbc.com/dsluInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java -
file://c:\windows\Java\classes\xmldso.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} -
hxxp://download.eset.com/special/eos/OnlineScanner.cabFF - ProfilePath - c:\documents and settings\TMW\Application Data\Mozilla\Firefox\Profiles\dwjhl18j.default\
FF - prefs.js: keyword.URL -
hxxp://us.yhs.search.yahoo.com/avg/sear ... -web_us&p=FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-09-28 20:50
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2009-09-29 20:53
ComboFix-quarantined-files.txt 2009-09-29 02:52
ComboFix2.txt 2009-09-23 01:32
ComboFix3.txt 2009-09-22 00:03
Pre-Run: 40,354,213,888 bytes free
Post-Run: 40,408,223,744 bytes free
161 --- E O F --- 2009-09-29 02:32